Mention ‘Artificial Intelligence (AI)’ or ‘Machine Learning (ML)’ in conversation, and thoughts immediately jump to images of time-traveling cyborgs, global nuclear war simulations, and pod bay doors. While these front-of-mind examples make for good entertainment, they will (hopefully) stay in the realm of mostly-fiction. The reality is that artificial intelligence, and its subgenre machine learning, are not futuristic concepts limited to research papers on applied mathematics and complex algorithms. In fact – real world examples of beneficial AI are everywhere:
News aggregators surfacing targeted articles likely to be of interest
Recommended content on entertainment streaming services
Chatbots on ecommerce sites
Identifying harmful content on social media
The details on how the various machine learning algorithms work are beyond the scope of this article. Conveniently ignoring the details – what makes AI and ML so effective today boils down to data. Big data. Most organizations now have access to Big Data through the security tools they are using in their organization and as a result machine learning is now at all of our fingertips in new and innovative applications. The rise of ‘Big Data’ as an input to machine learning has drastically improved the effectiveness of artificial intelligence. One area greatly impacted by this new efficacy is IT Security. Organizations can now better understand their threat exposure, the effectiveness of their mitigating controls, and, holistically, their risk of attack. But what about Identity Security?
The United States Cyber Command (USCYBERCOM) lists ‘Persona and Identity’ as one of six challenge areas facing the United States (and others) today. These identity attack vectors include authentication, spoofing, identity fabrication, phishing, and malign influence. In fact, several of the largest-profile security incidents in 2020 were the result of identity-based attacks.
This series of blogs from the Identity Defined Security Alliance’s AI/ML Technical Working Group will explore how Artificial Intelligence and Machine Learning are being utilized today, and how they can be used in the future to provide organizations with more effective Identity Security. We will discuss current examples, forward looking concepts, as well as outline some of the challenges associated with applying AI/ML to Identity Security. The articles will be broken down into three common processes in identity Security and exploration of how advances in AI can be applied to:
- Access Requests – In increasingly complex environments, how do users know what access they need? How do approvers know whether requested access is appropriate?
- Access Attestation/Certification – Attestation of user access is critical for maintaining compliance, but can be a burden when certifiers have to process page after page of line items. This fatigue can result in inaccurate reviews. How can AI/ML help?
- Access Management – How can AI/ML help to make real-time authorization and authentication decisions by factoring in enterprise wide security signals? Can historic access behaviors indicate future incidents and how can we use this data to prevent future incidents?
Artificial Intelligence and Machine Learning allows us to achieve a level of visibility, automation, and end-user experience that has historically eluded organizations. Stay tuned to this blog series to see how this can be applied to key tenants of Identity Security!
About the Author: The Artificial Intelligence and Machine Learning Technical Working Group subcommittee was formed in July 2020. The team, led by Adam Creaney, includes Srinivas Kasula, Tom Malta, Asad Ali, Allen Moffett, Andrea Tomassi, Jerry Chapman, Namson Tran, Eric Uythoven and Ravi Erukulla.
