Implications of Sharing Corporate Data with Generative AI – Stephen Blystone, Intrusion

This is Techstrong tv. Hey guys, thanks for the thrill. We are here with Stephen Blystone, who's assistant Vice President for Engineering at Intrusion, and we're talking about chat G P T and securing the data that we share with it.

Stephen, welcome to the show. Thanks, Mike. Happy to be here.

All right. People are taking corporate data and they're basically showing it to chat g p t in the hopes that something good will happen. I mean, what could go wrong with all that, Steven?

So, um, I guess my first question to you is what should people be thinking about from a cybersecurity perspective? Yeah, of course. So I'd say there's a couple different, uh, things.

First, uh, I think people, employees tend to think of chat G p T as more of like a, a screen on the, you know, just on their, their web browser. They don't think of what is actually happening behind the scenes. So what happens is, whatever you share with chat, G p t by default can be used to train and improve chat G P T.

And so whether that's just, you know, what's the, uh, recipe for some soup or it's, you know, here's some code, can you optimize it? It, that conversation can be used to further improve chat G P T. And most people don't realize that, uh, there are ways to opt out of that.

Um, there are two different ways to opt out of that, uh, but that's, that's something that most people aren't aware of. Uh, what happens there. Hmm.

Some organizations are perfectly content to let employees do what they like. Others are preventing them from actually using chat G B T outta concerns about where that data goes cuz there's no governance over it. What's, what's your sense of where we're all gonna land on this conversation?

Yeah, you raised a good point. Um, I know Samsung recently, uh, within the last few weeks prevented their users from doing it because, uh, three of their users, uh, uploaded sensitive data to Chatt p t uh, one was sensitive database source code and asked chatt PT to, to check for errors. Uh, one was, uh, some additional source sensitive code to, uh, optimize and then also someone uploaded a recorded meeting and asked CHATT p t to generate minutes for it.

Um, and so I don't know that, uh, those were, uh, opted out of the training, uh, options. So those could be used. Um, there are companies that encourage the use of it, uh, like Amazon, Microsoft to invested a billion dollars in open AI in 2019, um, and Open AI owns chat, c P t, uh, there's other companies like even Apple just recently, uh, started blocking the customers.

Uh, so to your point, I think it's, it's to everyone's advantage to learn how to use it. Uh, but there's really, uh, policies need to be put in place by companies of how to, how to do that, um, policies and also education, you know, teaching the employees what happens and, uh, the proper ways to use it. Mm-hmm.

We've also seen providers of applications integrate with chat G B T and as a user of those applications, might I not be aware of where my data might end up? And is that gonna be a problem? Yeah, that, that's a fair concern.

Um, I, I'd say read privacy policies for any application you use, uh, because it may not even, uh, necessarily be used by chat G P T, but that, that specific app could use it as well. I do know that there's certain, uh, privacy policies around the APIs of, of chat G P T that are different from the web interface. And so, uh, I believe with the APIs, uh, and I can verify this later, but I believe with the APIs it does not train by default.

Uh, whereas the, the actual chat application it does, uh, so there, there's of course always concern putting your data anywhere, but I think with those applications it's probably lessened due to the, the difference in the license or the, the restrictions on api. Do people actually read the licenses of their applications or maybe I need chat GB t to summarize 'em cuz they're about 10,000 words long. Yeah, that, that's, that's definitely a, a important thing.

You, you don't really know what's in there. Most people don't. And so a summary of it or, uh, you know, reading articles about the privacy policy, there's many articles about privacy policies are on chatt p t, uh, and so you can reference those for any new app though that you're using that may use open ai.

It, that is definitely a concern. Um, with there being so many words, it's you, it's easy to miss something if you're not a lawyer and know some of those technical terms in there. As I understand it, chat G P T may be only one of many large language models we might wind up using.

So is this gonna be a bigger issue as we go along because there's gonna be all these, um, LLMs and different sizes. So what should we be planning for? Yeah, there's, uh, Chet is just one.

There's uh, bar, there's uh, Claude, there's all these different ones popping up. And so it's, it's across the board. Uh, it's really about learning.

Uh, I'd say before you use one, um, like open a has a, a page on, uh, their security, the things they they put in place, uh, like it mentions that they have, uh, C P a gdpr, SOC two type two compliance among others. Uh, and so that, that's, that's one good thing there about open ai. Um, others like Microsoft or, or Google that they're rolling out, uh, may have different licenses.

Um, but that is something to, to keep in mind. Are governments gonna get involved in this conversation? We saw the EU has come up with some, uh, interesting approaches to saying when you can and cannot use particular generative AI platforms.

Uh, I believe they are, and I know there's, uh, conversations, uh, I believe just this last week, uh, on Capitol Hill about that topic, um, the, the c o of, uh, OpenAI went there and, and spoke with them about some of those concerns. Uh, I think it's a balance of, um, you want to restrict certain applications or, or monitor certain audit, certain applications of ai, but you also don't wanna limit the, uh, or, or monopolize all the resources because if they make it too strict, then open eye and just the, the really big companies with a lot of money can, can really lead the the way. Um, but there's a lot of open source L l m opportunities that are, are popping up like llama, alpaca, uh, M P T, um, some of these others, their red pajama that, uh, if, if there's too many restrictions it could limit those and stifle the whole innovation and, and limit it just a, a few key companies.

How would somebody in charge of data security determine that somebody had actually shared data with some sort of L L M that they shouldn't be sharing data with? How do I get in front of that? So there, there's a few, uh, ways.

One is monitoring network activity. com for example, you can see, uh, that calls were made from certain users. Um, you can go and find out, you know, is this a user?

You go ask some questions there. Um, I know there are other tools out there that can track data that can see, uh, where data flows and like if, if since the data is, uh, emailed out or since chat G B T, um, for example, the, uh, company Cyber Haven, um, monitored data from February 26th. 4%.

And of that there are about 319 instance per week per a hundred thousand employees where sensitive internal only data, uh, was sent up to chatt p t and then similar numbers for source code and client data as well. And so there are tools out there that can monitor the specific data and, and the tracking of it. Uh, but that's definitely the numbers there.

4% in little, little over a month. Will there also eventually be data privacy issues that go with this? Cuz a lot of the data that winds up being shared is actually data somebody might have about their customers and we can have all kinds of downstream implications to go with this.

Yeah, yeah, definitely. Um, it, it's, it's definitely a concern. Um, I, I know with gdp, GDPR in Europe and other policies like that, there's, there's concern around that.

Uh, I'd say it's, it comes down to a few, uh, strategies, um, for employees. And this goes into the policy I talked to, talked about, uh, previously. It may be that, uh, education is big to, to let you know their employees know, but then, um, the, the, the phrase you wanna keep in mind is, will the information I'm sharing with chat T p t negatively impact our business or help competitors or hurt our customers if it were leaked out?

If so, it's probably not best to share with chat t p t cuz would you share your customer information with some random person on the street? Uh, probably not. You shouldn't at least.

And so there's strategies like when writing code, for example, you know, say you wanna provide, uh, data, but you wanna anonymize that data before you send to chat G p T. So instead of, um, column names that are, tell what kind of application you're using, like, um, you know, social security number and all these different sensitive, uh, column names, you may change it just to be column one, column two, column three, and any sensitive data, you just change the values of it in there. Uh, that's, that's representative of it.

But without, um, without revealing any sensitive information, then you can upload a chat, p t ask questions about it and just translate it back from the, the dummy data you uploaded back to the data you're, you're concerned about. And similar, like with Samsung, when they uploaded sensitive source code, the, the best tragedy I found is to let chat pt write code as a starting point. And so, like for example, as a web developer, write code for a website with a header at the top, copyright at the bottom and responsive table contain five columns in it.

And you can have a back and forth about, you know, I want to look this way, I want to look this way. And, but it's all using very generic terms. But as a developer, most of your time is spent writing, you know, I'll say boiler plate code and it's not really like the, the core business logic.

And so let chat b t be that leverage for you to write all that code very quickly, very efficiently, and it can optimize different ways for you. And then from there you can go in and implement the business specific portions of it. Uh, so I think with strategies and policies like that, it'll help alleviate a lot of this concern for, for, uh, customer data like you just mentioned.

And for, for company data As we go along with this whole thing. Um, do you think it'll put more of an emphasis on data security in general? It seems like we've always been kind of highly focused on the classic, uh, perimeter defenses, but maybe you'll be thinking a lot more about how to secure each individual bit of data.

I, I definitely agree with that. Uh, and one interesting side effect of all this too is that a, like Stack Overflow and a lot of the, the sources of some of this data that chat PT used, uh, before it used to be free or, or low cost over some from DA some data, but now all those providers are increasing their, their API costs. So if you want to grab the data from us, it's gonna cost more money.

Um, there are still some free providers out there, but as a side effect of, of that, uh, you know, the companies that we're providing free data are now charging. Um, and then like you said, it, it comes down to identifying and tracking where your data is and where it's going. Do you think there'll be some lawsuits about all this in the future?

Because, you know, not everybody knows exactly, uh, what they're doing with chat G P T and I know they probably have a licensing agreement, but nevertheless there's a lawyer who's probably gonna say, you know, you didn't make it clear enough. Uh, yeah, a absolutely. Um, there could be lawsuits from, from various fronts.

One is, you know, it could be like you, you shared data, but also chat PT could write code and there's, there's errors in it and if you use it on some, uh, really like a medical application for example, and you don't test it thoroughly, if there's errors, who's at fault? Is it the developer who use chat p t? Is it chat G B T?

Um, I could see lawsuits going, you know, both ways potentially. And so it really goes into the, the legal agreement that chat p t has in place to protect them. Um, and, and the l l m other l l m providers, uh, by, I do think there's a, a chance of lawsuits in the future potentially.

So is it incumbent upon the cybersecurity people that walk around and kind of educate all the folks that work in their organizations about these issues? Or is there some other way to get at this thing because, um, end users don't always pay attention? Yeah, that, that's, that's definitely a, a concern.

Cause I, I know some people, even corporate trainings, they, it just, they, they kind of breeze through those and don't really pay attention to the message. So I, I think coming from the top down is important. Uh, educate the C-Suite, um, first off, just so they're aware and they can start to, uh, send down to all their different business groups and then, uh, it, it just, you know, maybe some sort of weekly, bi-weekly, you know, here's more information about these topics, chatt, p t, cyber security, uh, cuz cybersecurity is becoming more and more prevalent and, and needed out there.

Uh, so just keeping it top of mind is I think probably the best thing. Cuz even if you, uh, teach someone, they may not use chat g p T for months and then when they start using again, they'll have forgotten the training. So having that regular interval, you know, even just like a, a email newsletter or something going out, we'll just keep it top of mind for everyone.

All right folks. Well you heard it here. If you're showing data that chat g p t, and it's really not your data, it's the company's data.

And you should probably stop if you're in charge of cybersecurity, you should assume that somebody's doing the former because, well, that's just the way humans are. Steven, thank you for being on the show. Thanks for having me.

All right, back to you guys in the studio.