article thumbnail

GUEST ESSAY: How AI co-pilots boost the risk of data leakage — making ‘least privilege’ a must

The Last Watchdog

Related: Weaponizing Microsoft’s co-pilot Until now, lackluster enterprise search capabilities kept many security risks in checkemployees simply couldnt find much of the data they were authorized to access. Over-provisioned access The risks of excessive access are nothing new.

Risk 219
article thumbnail

On Risk-Based Authentication

Schneier on Security

A Study on Usability and Security Perceptions of Risk-based Authentication “: Abstract : Risk-based Authentication (RBA) is an adaptive security measure to strengthen password-based authentication. I’ve blogged about risk-based authentication before. Paper’s website.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

On Generative AI Security

Schneier on Security

” Their blog post lists “three takeaways,” but the eight lessons in the report itself are more useful: Understand what the system can do and where it is applied. Automation can help cover more of the risk landscape. LLMs amplify existing security risks and introduce new ones.

Risk 242
article thumbnail

Security Risks of Client-Side Scanning

Schneier on Security

I’m part of a group of cryptographers that has just published a paper discussing the security risks of such a system. (It’s Ross Anderson wrote a great blog post on the paper. (It’s It’s not a cryptographic backdoor, but it’s still a backdoor — and brings with it all the insecurities of a backdoor.

Risk 351
article thumbnail

Security Risks of AI

Schneier on Security

Stanford and Georgetown have a new report on the security risks of AI—particularly adversarial machine learning—based on a workshop they held on the topic. Many AI products are deployed without institutions fully understanding the security risks they pose.

Risk 296
article thumbnail

AI Security Risk Assessment Tool

Schneier on Security

” Details on their blog. Microsoft researchers just released an open-source automation tool for security testing AI systems: “ Counterfit.”

Risk 335
article thumbnail

DORA Compliance: A Practical Guide to Effective Third-Party Risk Management

Responsible Cyber

Effective from January 2025, DORA mandates that financial institutions implement robust measures to manage Information and Communication Technology (ICT) risks, with a significant emphasis on Third-Party Risk Management (TPRM). Contracts must clearly outline service expectations, security requirements, and compliance obligations.

Risk 105