New Data Security Governance Strategies to Address AI-Related Challenges

Artificial intelligence is often viewed as a solution to various problems, including those encountered in data governance. Organizations use AI to automate and streamline data management processes.  AI enables faster data quality evaluation, classification, and compliance with privacy and security regulations. Additionally, AI helps organizations more efficiently deal with retention and deletion decisions.

However, artificial intelligence rears its insensately inimical side even in the supposedly mechanical world of data governance where nuanced human decision-making is seldom required. AI may be bringing advantages with it, but it is also exposing IT systems to new risks.

The good news, though, is that many are aware of these dangers. A recent study shows that organizations are worried about the negative impacts of AI on their security strategy. Around half of the organizations surveyed in the study say that their data security strategies do not match the evolution of AI. Also, 56 percent of the respondents regard the exposure of sensitive information to AI systems as their biggest area of concern.

Data governance challenges in the age of AI

Data governance is the identification of an organization's important data and the process of making sure that such data is of high quality to make it useful to the organization. It is not just about collecting and storing data from various sources. It entails the need for the following crucial attributes.

• Quality – Data should be accurate, consistent, and relevant. Noise should be eliminated to ensure proper usage and meaningful analysis.

• Usability – Being usable means that data is properly structured, labeled, documented, and classified to facilitate quick search and retrieval. Also, data should be in formats that are compatible with the existing tools employed by the intended users.

• Availability – Data should be accessible whenever it is needed. Server downtimes should be avoided as much as possible. Availability does not mean easy access for everyone, though. Data should also be made secure, as described below.

• Security – Securing data entails sorting according to sensitivity and the implementation of mechanisms or processes to protect sensitive data. Data access should be strictly regulated.

• Integrity – This means that the fundamental qualities of data should remain intact as it is stored, copied, transmitted, or converted into other formats. 

The above-mentioned qualities of data governance have different implications in different settings involving artificial intelligence. AI presents distinct challenges to data governance depending on the situations data is subjected to. To develop more effective data security governance, given the growing prevalence of AI, it helps to understand modern data governance challenges vis-a-vis the development and use of AI.

In the case of quality and usability, the AI-induced data governance challenge arises in situations wherein an organization collects data to train an AI system. Data for AI training should be kept accurate, structured, complete, and untampered to ensure that the AI system being developed operates as intended. With the amount of data involved in training AI, there are many opportunities for mistakes and inconsistencies. Add to this the possibility of threat actors purposely poisoning data lakes to impair AI systems.

On the other hand, there are data governance challenges affecting data availability and security because of threat actors that have learned to employ artificial intelligence in their attacks. DDoS perpetrators, for example, can use AI to automate the identification of vulnerabilities and orchestrate the activities of a multitude of denial-of-service bots that have made their way to various devices including IoT, wearables, and embedded systems. Threat actors also use AI to rapidly produce malware and tweak them to evade signature-based cybersecurity platforms.

When it comes to integrity, there are AI-driven data governance challenges because of the possibility of adversarial machine learning. Cybercriminals can employ tactics to manipulate AI models mainly through the injection of malicious data into AI training models or the introduction of malicious software that can distort, delete, skew, or completely change data. Adversarial machine learning attacks can subvert the operation of AI systems, which can lead to catastrophic consequences, especially for AI used in critical applications like utilities and healthcare.

The need for new data governance strategies

It is advisable to develop new or update existing data governance strategies to address the changes that come with the growing adoption of AI technology. The following key concepts should help organizations in formulating suitable strategies.

AI vs AI

Organizations should harness the power of artificial intelligence to counter its negative side. Data quality evaluation and usability testing can be conducted automatically with the help of AI. AI-powered cybersecurity systems can continuously check data for accuracy, consistency, completeness, and integrity. Additionally, AI is useful in analyzing network activities and user behaviors to detect potential anomalies or instances of cyber attacks.

Emphasizing data access security

The use of AI to automate various processes has created numerous situations wherein data access is barely regulated. Different apps may be granted unfettered access to data to complete different tasks speedily. In the process, data security and privacy may be compromised. One of the best examples of this is the use of AI chatbots to quickly get answers to questions about an organization or its products. This may make it easy for employees, customers, or stakeholders to get information, but it also risks the sharing of data to parties who should not have access to such data. 

ChatGPT figured in the news for its supposed privacy violations. The popular AI chatbot reportedly collected data from users to help grow its knowledge base and improve its ability to answer nuanced questions. ChatGPT's terms and conditions also force users to grant their permission to share user-submitted data with vendors and service providers, affiliates, legal entities, AI trainers, and other businesses.

Continuous monitoring and security audits

AI is tireless, persistent, and consistent, so when cybercriminals use it in their attacks, they can undertake countless attempts and repetitions. As such, data security should be ceaseless. Security validation should be undertaken continuously. A few minutes or hours of security weakness are enough for cyber attacks to succeed.

Cybersecurity education and training

This is an oft-repeated advice for cybersecurity in general, but it bears emphasizing the need to educate and train everyone in an organization about the security risks that come with AI. It is important to acquaint everyone with the different ways AI can compromise data governance, including the right responses and the knowledge of using different tools to address attacks.

Cross-functional collaboration

Lastly, it helps to actively facilitate collaboration among the different departments or teams in an organization, especially the legal, compliance, IT, and business units. This is important to agilely respond to threats and work together in spotting and sorting vulnerabilities, urgently implementing mitigation measures, and ensuring that the cybersecurity policies are properly communicated to and followed by everyone in an organization.

The takeaway

Data security is a vital concern in an age where data is considered the most important currency. The rise of AI has made data more useful and relevant but it has also created new risks and threats. Data governance should advance in line with the evolution of how data is used, particularly with AI involved. This means utilizing AI to fight adversarial AI, paying more attention to data access and privacy, ensuring continuous monitoring, and enabling effective cybersecurity education and cross-functional collaboration.