Cybersecurity Policy Report, BSA: AI Regulations Should Promote Cyber Defense Uses, (Oct 10, 2023)
Policy-makers worldwide should ensure that their efforts to regulate artificial intelligence technologies don’t undermine the growing use of AI by cyber defenders, according to software trade association BSA.
“Policymakers should promote using AI to bolster cybersecurity, which can be done while ensuring appropriate regulation around its high-risk uses,” BSA said in a report published today.
“As the importance of AI for cybersecurity increases, it is also critical that laws and policies improve security, and security is not used as a justification for other political or protectionist objectives,” the report says.
Malicious actors are already using AI tools to improve “social engineering” attacks, evade security measures, write more effective malware, and automate “brute force” attacks that involve guessing passwords, the report says.
“Enabling cyber defenders to use AI for cybersecurity can defend against these attacks,” it says. AI can be used, for example, to speed up software analysis to detect vulnerabilities and to sift through threat alerts to prioritize those that need immediate action, it notes.
Policy-makers should “promote using AI as a key cyber defense tool” and allow cross-border data flows “needed to analyze normal behavior and detect malicious behavior,” it says.
“Policymakers should work with like-minded countries in a globally coordinated effort to ensure laws and policies advance the ability for cyber defenders to use AI for cybersecurity,” the report says.
“This coordination should aim to harmonize rules across policy domains, such as cybersecurity and privacy, and leverage or develop internationally recognized standards where appropriate,” it adds.
“BSA members are developing AI-enabled tools that help to better counter malicious actors, and better protect customers and citizens,” Henry Young, BSA’s director–policy, said in a news release. “As policymakers worldwide form rules governing the development and use of artificial intelligence, a risk-based approach will help to promote rather than inhibit the use of AI for cybersecurity.”
News: InternationalLegislation DataSecurity