CISA released a blog post last week reminding software designers that artificial intelligence (AI) tools are software and that they “must consider the security of the customers as a core business requirement, not just a technical feature, and prioritize security throughout the whole lifecycle of the product, from inception of the idea to planning for the system’s end-of-life.”
CISA’s urging to make AI systems Secure by Design is timely, taking into consideration recent reports of threat actors using AI for attacks and disruption of systems.
Threat actors have been leveraging vulnerabilities in software for many years and continue to leverage zero-day vulnerabilities to date. Software developers are conflicted between getting products to market quickly and embedding security in the software. This conflict has to be addressed when developing AI tools to learn from the mistakes of the past and to try to prevent threat actors from using software, including AI systems, as weapons. The CISA blog post is an important read for all software developers and engineers, as well as their bosses.