Protecting Sensitive Data from AI Leaks – Safeguard Your Info

AI tools such as Microsoft 365 Copilot and ChatGPT are becoming essential for businesses, helping improve productivity and streamline operations. However, these tools introduce new security challenges, particularly around protecting sensitive data. During Cyber Security Awareness Month, it is important to understand how to secure your data when using AI tools. This article will discuss the risks of using AI in business and provide actionable steps to mitigate those risks.

Growing Use of AI in Businesses 

AI tools, particularly Microsoft 365 Copilot and ChatGPT, are transforming the way businesses operate. However, as AI becomes more prevalent, it also raises concerns about how businesses can secure sensitive data when leveraging these technologies. 

Key Security Risks 

While AI tools offer impressive capabilities, they also pose significant risks if not managed properly: 

• Data Leakage: Sensitive data can be accidentally input into AI tools, which might store it or use it for model training. 

• Compliance Risks: Improper use of AI could lead to non-compliance with data protection regulations like GDPR or HIPAA, putting your business at risk of legal penalties. 

• Intellectual Property Risks: There is a possibility that sharing proprietary data with AI services may result in the unintended loss of intellectual property. 

Steps to Mitigate These Risks 

Businesses must implement robust safeguards to protect their data. Here are a few key steps: 

• Microsoft Purview: Purview is Microsoft’s suite of compliance and data governance tools and helps businesses classify and govern their data, ensuring that sensitive information is only shared with approved AI platforms. Purview also assists in tracking data movement and implementing governance policies to prevent accidental exposure. 

• Microsoft Cloud App Security: This solution provides visibility into the AI applications being used within the organisation. It assesses risk levels and ensures that only compliant AI tools are integrated into the company’s workflow. Examples of protecting sensitive data from AI leaks include blocking copy and paste or download from critical applications. Blocking access to known low reputation or unsanctioned AI or alerting on new unsanctioned AI used in your organisation so you can control the behaviour. 

• Data Loss Prevention (DLP) Solutions: Implementing DLP solutions helps prevent sensitive data from being shared with unauthorised platforms. By setting rules around data handling, companies can reduce the likelihood of breaches. Examples of protecting sensitive data from AI leaks include blocking copy and paste of keywords into documents or AI using Microsoft Purviews Sensitive Info Types. Or alerting on DLP events. 

Educating Your Staff on AI Security 

Technology solutions are vital, but the first line of defence is a well-educated workforce. Many data leaks occur due to employee mistakes or ignorance of AI risks. That is why businesses must prioritise staff education. 

• Why Education Matters: Employees may unknowingly input confidential data into AI tools, especially if they are not trained on the proper usage. Staff education helps mitigate this risk by teaching employees to recognise sensitive information and understand what data should not be shared with AI platforms. 

• Training Programmes: Conduct workshops and training sessions on safe AI usage. Provide clear guidelines on data classification, anonymisation, and sharing restrictions. Additionally, real-time coaching tools can be implemented to alert employees when they are about to input sensitive data into AI tools. Security Awareness training tools such as Huntress Labs SAT, provide great content on PII, DLP, Data Leakage and Sensitive Information. 

• Encouraging Proactive Reporting: Encourage employees to report suspicious activities or potential data breaches at once. An open reporting culture helps the company act quickly to address risks and prevent larger issues. 

Implementing a Written AI Security Policy 

 Beyond staff education, having a robust AI security policy in place is essential to safeguarding your business. A1 Technologies recently achieved ISO 27001 certification, a globally recognised standard for information security management. Through this process, we identified key risks tied to emerging technologies, particularly around generative AI. The potential for data loss and intellectual property leakage when using these technologies is not always well understood by staff, contractors, or third-party suppliers. 

 To mitigate these risks, we developed a comprehensive AI Security Policy, establishing clear guidelines as part of our broader commitment to data protection and governance. Here is a sample AI Security policy that we are providing to help safeguard your organisation: 

Example Company Policy on the Use of AI Services 

Purpose
This policy aims to ensure the secure and compliant use of AI services such as Microsoft 365 Copilot, a team-licensed version of ChatGPT, and any form of public AI within <company>, in alignment with ISO 27001 standards. It outlines the security risks associated with these services, safe practices, and operational guidelines for staff. 

Scope
This policy applies to all employees, contractors, and third-party users of <company> who have access to company data and use AI services. 

Security Risks 

• Data Leakage: Copying sensitive company data into AI services may result in unintended data exposure. These platforms may store data for training purposes, potentially leading to data breaches. 

• Compliance Risks: Unauthorised data sharing with AI services can lead to non-compliance with data protection regulations such as GDPR, HIPAA, and other industry-specific standards. 

• Intellectual Property Risks: Sharing proprietary or confidential information with AI services might result in the loss of intellectual property rights. 

Safe Practices for End Users 

• Data Classification: Ensure that information is classified correctly. Only non-sensitive and non-confidential information should be inputted into AI services. 

• Authorisation: Confirm that you have the appropriate authorisation to use AI services for work-related tasks. If in doubt, consult your manager. 

• Data Anonymisation: Anonymise data wherever possible before sharing it with AI services to protect personal or sensitive information. 

• Avoid Sensitive Information: Do not input personal, financial, or confidential information into AI services. 

• Use for Approved Purposes: AI services should only be used for approved business purposes. 

• Use of Internal Documents: Documents classified as internal, confidential, or highly confidential are prohibited from being used in AI services. 

• Use of Public Documents: Public documents must be anonymised prior to use in AI services. 

• Contractor Restrictions: Contractors must not use <company> data in AI services under any circumstances. 

Operational Guidelines for End Users 

• Training and Awareness: All staff must complete the required training on the security risks and safe practices associated with AI services. 

• Report Issues: Report any suspicious activity or potential data breaches immediately to the IT department or your manager. 

• Consult Before Sharing: If unsure about the safety of sharing certain information with AI services, consult with your manager or IT department. 

• Adherence to Policy: Follow all company policies and guidelines when using AI services to ensure compliance and protection of company data. 

Specific Guidelines for Different AI Services 

• Using Microsoft 365 Copilot 

• Ensure that internal, confidential, or highly confidential documents are not used without express approval. 

• Limit data shared with Copilot to information intended for internal collaboration and exclude sensitive client data. 

• Comply with Microsoft’s data handling policies and ensure that use of Copilot follows company and regulatory standards. 

Using a Team-Licensed ChatGPT Account 

• Ensure internal, confidential, or highly confidential documents are not used in ChatGPT. 

• Follow safe practices for data classification and anonymisation when using ChatGPT. 

• Restrict access to the ChatGPT account to authorised team members. 

• Ensure that the team-licensed version of ChatGPT complies with encryption and data retention policies. 

• Restrict use to approved business purposes and avoid entering any sensitive or confidential information. 

Using Any Other Form of Public AI 

• Prohibited Use: Do not use public AI services to handle company data, as they lack necessary security controls and pose significant risks. 

• Alternatives: Use approved internal tools and services that comply with company security policies and regulatory requirements. 

Roles and Responsibilities 

• Employees: Must adhere to the safe practices and guidelines outlined in this policy when using AI services. 

• Managers: Ensure team members are aware of and comply with this policy and provide guidance on data classification and AI usage. 

• IT Support: Provide support and guidance on the secure use of AI services and address any queries or concerns from end users. 

Review and Compliance 

• Policy Review: This policy will be reviewed annually or as needed to ensure alignment with ISO 27001 standards and evolving security risks. 

• Compliance: Non-compliance with this policy may result in disciplinary action, up to and including termination of employment. 

Contact Information
For any questions or further clarification regarding this policy, employees should contact the IT department or the Information Security Officer. 

Conclusion 

AI tools like Microsoft 365 Copilot and ChatGPT offer immense benefits, but they also present new security challenges. To protect your business, it’s essential to prioritise staff education, implement security policies, and leverage tools like Microsoft Purview and Cloud App Security. By taking these steps, businesses can confidently embrace AI without compromising the security of their sensitive data. 

Clint Shiels

With 25 years in the tech industry focused on Microsoft and security, Clint has provided consulting services, complex solution design and IT aligned business advisory to hundreds of organisations across Australia and the UK. With a methodology to understand business requirements and outcomes first and foremost then deliver a clear roadmap to succeed in achieving client outcomes using modern workplace delivery services.