Taming Shadow AI: A CTO’s Guide with Andrius Buinovskis, Head of Product at NordLayer

Andrius Buinovskis (0:00)

And in 2015, actually, what's my first time when I started to work for cybersecurity, I discovered what is happening in the business world, fighting against advanced persistent threats. I saw what is happening and how it is happening, how it is easily to hack into your phone and so on and so on. I got so paranoid that I was avoiding to use a smartphone for half a year.

Joel (0:27)

I wanted to give a special thank you to NordSecurity for sponsoring today's episode. Nord has been kind enough to give us a discount link for their newest product, NordLayer browser, that we have put in the show notes below. If you don't know, NordLayer browser gives IT control over browser sessions so that work data stays protected where the work actually happens. Well, man, I'm excited to be talking about this.

I haven't done an episode on Shadow AI yet. We've done so much Shadow IT stuff in the past and you've spent a lot of time thinking about Shadow AI. So, B, you could just start with giving me an overview of what it is.

Andrius Buinovskis (1:06)

Yes. First of all, we have to return to a couple of years ago, probably, if we take one decade ago. So, how the whole environment looked like. Most of the data was still residing on devices. What actually employees were using, there was tools and software to process the data which was on device. Okay, maybe some data was on servers in a local network. And the transition was only starting to happen, to Cloud and so on.

So, and at that moment, to get that data for bad actors was taking some time. They had to hack in or into the device itself, or into company's network.

And one of the ways it was so, to spreading some malicious software, which will land into device. And if employee is actually hooked on this software, at that moment, it was a shadow IT, right? That somebody is using a software which is not provided by the company. And actually, they download malicious software at this stage. So they can spread the virus or malicious application script running around in the network. And that was the consequence of Shadow AI at that moment. And that data was being stolen from the company's environment, from the device, from the network.

Then the transition went and it was exploded, right?

So all the information going to SaaS applications, right? So it means that the data itself is less on a device or company network or on premises, but more on SaaS applications, right? In this situation, you don't need to hack in to the company's network, but you need just to log in to SaaS applications. So it means you have to trick a user to provide the credentials to log in to the SaaS application, right? Which is most often accessible via browser. And this way, all data goes to cloud environments. Then if you want to manipulate the data in cloud environments or just to adjust, right? More tools are built to work in the browser. The second point, you come into the situation that you can do everything via browser what you previously did only on your device. You can do everything. You can edit photos, can edit music, you can do video changes and so on. All that part was just connecting tools on SaaS level, right? So you are connecting one tool to another. You are allowing access to your Google Drive, Office 365 doc. And these tools, if they are not tested, if they are not evaluated by your security team, they tend to be malicious, right? And if you are using not secure tool, this is a kind of shadow AI, because organization admins don't know what actually you are using. And this way you are creating a kind of attack vector here, space, a window, right? So you are providing this extended access to your documents, to your data. And this is how the data is being leaked. And then, so explosion of AI, right? So we not only, at least not us, but the bad actors or hackers, right?

Go to acquire credentials, but we are actually exposing all the data. We are giving all the data and sensitive data to these AI models to be trained.

So we are not evaluating the importance of leaked secrets, tokens, right? Or a list of clients with social ID numbers that might be leaked unintentionally, right? So I mean, just you are providing too extensive access to the documents, to your environments, and that might be even SaaS applications. And all the data is just transitioned to that. And this is how the rise of Shadow AI comes into play. There are always no more trusted models and less trusted models. There are providers which actually provide zero-day retention models. This means that on your specific data, it will not be trained, no other companies will be capable to use that data and so on. There are others who actually just spread that data around. There are also malicious, right? So which are just waiting until you will post more sensitive data. And this is how Shadow AI comes into play. And the companies and the organization needs to understand what kind of tools they are using and what kind of data they are providing to these AI tools.