{"id":20374,"date":"2023-07-27T06:51:45","date_gmt":"2023-07-27T06:51:45","guid":{"rendered":"https:\/\/web3unplugged.io\/blog\/?p=20374"},"modified":"2023-07-27T06:51:48","modified_gmt":"2023-07-27T06:51:48","slug":"netskope-threat-labs-source-code-most-common-sensitive-data-shared-to-chatgpt","status":"publish","type":"post","link":"https:\/\/web3unplugged.io\/blog\/netskope-threat-labs-source-code-most-common-sensitive-data-shared-to-chatgpt\/","title":{"rendered":"Netskope Threat Labs: Source Code Most Common Sensitive Data Shared To ChatGPT"},"content":{"rendered":"\n

Netskope<\/a>, a leader in Secure Access Service Edge (SASE), today unveiled new research showing that for every 10,000 enterprise users, an enterprise organization is experiencing approximately 183 incidents of sensitive data being posted to the app per month. Source code accounts for the largest share of sensitive data being exposed.<\/p>\n\n\n\n

The findings are part of Cloud & Threat Report: AI Apps in the Enterprise<\/em><\/a>, Netskope Threat Labs\u2019 first comprehensive analysis of AI usage in the enterprise and the security risks at play. Based on data from millions of enterprise users globally, Netskope found that generative AI app usage is growing rapidly, up 22.5% over the past two months, amplifying the chances of users exposing sensitive data.<\/p>\n\n\n\n

Growing AI App Usage<\/strong><\/p>\n\n\n\n

Netskope found that organizations with 10,000 users or more use an average of 5 AI apps daily, with ChatGPT seeing more than 8 times as many daily active users as any other generative AI app. At the current growth rate, the number of users accessing AI apps is expected to double within the next seven months.<\/p>\n\n\n\n

Over the past two months, the fastest growing AI app was Google Bard, currently adding users at a rate of 7.1% per week, compared to 1.6% for ChatGPT. At current rates, Google Bard is not poised to catch up to ChatGPT for over a year, though the generative AI app space is expected to evolve significantly before then, with many more apps in development.<\/p>\n\n\n\n

Users Inputting Sensitive Data into ChatGPT<\/strong><\/p>\n\n\n\n

Netskope found that source code is posted to ChatGPT more than any other type of sensitive data, at a rate of 158 incidents per 10,000 users per month. Other sensitive data being shared in ChatGPT includes regulated data- including financial and healthcare data, personally identifiable information \u2013 along with intellectual property excluding source code, and, most concerningly, passwords and keys, usually embedded in source code.<\/p>\n\n\n\n

\u201cIt is inevitable that some users will upload proprietary source code or text containing sensitive data to AI tools that promise to help with programming or writing,\u201d said Ray Canzanese, Threat Research Director, Netskope Threat Labs. \u201cTherefore, it is imperative for organizations to place controls around AI to prevent sensitive data leaks. Controls that empower users to reap the benefits of AI, streamlining operations and improving efficiency, while mitigating the risks are the ultimate goal. The most effective controls that we see are a combination of DLP and interactive user coaching.\u201d<\/p>\n\n\n\n

Blocking or Granting Access to ChatGPT<\/strong><\/p>\n\n\n\n

Netskope Threat Labs is currently tracking ChatGPT proxies and more than 1,000 malicious URLs and domains from opportunistic attackers seeking to capitalize on the AI hype, including multiple phishing campaigns, malware distribution campaigns, and spam and fraud websites. <\/p>\n\n\n\n

Blocking access to AI related content and AI applications is a short term solution to mitigate risk, but comes at the expense of the potential benefits AI apps offer to supplement corporate innovation and employee productivity. Netskope\u2019s data shows that in financial services and healthcare \u2013 both highly regulated industries \u2013 nearly 1 in 5 organizations have implemented a blanket ban on employee use of ChatGPT, while in the technology sector, only 1 in 20 organizations have done likewise.<\/p>\n\n\n\n

\u201cAs security leaders, we cannot simply decide to ban applications without impacting on user experience and productivity,\u201d said James Robinson, Deputy Chief Information Security Officer at Netskope. \u201cOrganizations should focus on evolving their workforce awareness and data policies to meet the needs of employees using AI products productively. There is a good path to safe enablement of generative AI with the right tools and the right mindset.\u201d<\/p>\n\n\n\n

In order for organizations to enable the safe adoption of AI apps, they must center their approach on identifying permissible apps and implementing controls that empower users to use them to their fullest potential, while safeguarding the organization from risks. Such an approach should include domain filtering, URL filtering, and content inspection to protect against attacks. Other steps to safeguard data and securely use AI tools include:<\/p>\n\n\n\n