{"id":45798,"date":"2020-04-15T15:31:26","date_gmt":"2020-04-15T22:31:26","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/industry\/microsoft-in-business\/?p=45798"},"modified":"2023-06-16T08:47:14","modified_gmt":"2023-06-16T15:47:14","slug":"securing-ai-and-ml-projects-data-and-cyber-risk-management","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/industry\/microsoft-in-business\/business-transformation\/2020\/04\/15\/securing-ai-and-ml-projects-data-and-cyber-risk-management\/","title":{"rendered":"Securing AI and ML projects: Data and cyber risk management"},"content":{"rendered":"

As\u00a0Artificial Intelligence and Machine Learning continue to cement themselves as foundational resources\u00a0for\u00a0growth and transformation\u00a0across the financial services industry,\u00a0organizations must account for the added influx of data flooding into their enterprises. Every data science achievement must also account for how we secure and protect that data, making embedded\u00a0data security risk management a far more pronounced need than it has ever been.<\/p>\n

The tech boom of the previous decade has introduced a professional tension between the aspirations of today\u2019s data scientists and the pragmatic structure of seasoned security professionals. How can businesses innovate securely? How can data scientists and risk management teams collaborate to deliver a stronger product? It\u2019s a delicate balance between safety and ambition, and one that business leaders must account for every day. Fortunately, we have a few recommendations for business leaders looking to seed strong cyber risk management across their AI and ML project lifecycles.<\/p>\n

    \n
  1. Start with\u00a0culture<\/strong><\/li>\n<\/ol>\n

    For decades, security teams have supported the needs of their enterprises and during that time, they\u2019ve become quite good at understanding the necessities, processes, and challenges IT infrastructure and line of business owners face. As a result, security professionals have built assessments and frameworks that support the platforms and infrastructure they\u2019re intimately familiar with, but data science and AI introduce a brand-new landscape. Enterprise security and risk teams are entering a space where they don\u2019t have those same historical experiences to draw from and, as a result, are initially circumspect. The key to helping traditional security teams feel more comfortable with AI solutions lies in cultivating a culture of mutual engagement where cybersecurity leaders and their teams can collaborate directly with data scientists and privacy officers. These collective environments enable risk managers and cyber defenders to better understand a day in the life of a data scientist, what their priorities are, what challenges they experience, and how critical data is sourced. This ability to empathize with the creators and the consumers of AI-enabled services equips security professionals with the context they need to understand the applications of AI and ML while also helping them better anticipate the types of threats they may be exposed to or inheriting.<\/p>\n

      \n
    1. Secure executive support<\/strong><\/li>\n<\/ol>\n

      Collaborative cultures start at the top of any organization. AI and machine learning ambassadors should have project buy-in from the Chief Information Security Officer, Chief Risk Officer and Data Protection Officer at the beginning of every AI or machine learning effort. By aligning these stakeholders, AI teams can better connect with security and IT to ensure compliance and security while avoiding the project delays that come due to introducing security and compliance at the last minute. Instead of delivering a near-complete asset to a security team that lacks the project context and skilled expertise to support the data scientists’ ambitions, each team can now work together to help mitigate vulnerabilities and manage threats.<\/p>\n

        \n
      1. Adopt data-centric and intelligence-driven security models<\/strong><\/li>\n<\/ol>\n

        Data-centric and intelligence-driven security models provide risk management\u00a0and compliance across\u00a0the\u00a0traditional line of business\u00a0portfolio and advanced data science projects.\u00a0Specifically, data ought to enrich and validate our methodologies behind operational procedures and technical controls, including:<\/p>\n

        Data control<\/strong><\/p>\n

        Protect sensitive data regardless of location, device type, hosting model, or user population.<\/p>\n

        How?<\/em><\/p>\n