New Framework to Address AI Implementation in Critical Infrastructure

Executive Summary

The Roles and Responsibilities Framework for Artificial Intelligence in Critical Infrastructure was released on November 14^th by the U.S. Department of Homeland Security. The purpose of the framework is to address the growing use of AI which is bound to impact a variety of industries all around the world. AI shows promise by improving many industries in many ways, but with the implementation of any new technology there are always security concerns. [4] Although it is great that the Department of Homeland Security is thinking about ways to attack security concerns before the commonplace implementation of AI, there are concerns the framework could change dependent on President-elect Donald Trump’s incoming administration. [1]

Background

According to IBM, “42% of IT professionals at large organizations report that they have actively deployed AI while an additional 40% are actively exploring using the technology. Additionally, 38% of IT professionals at enterprises report that their company is actively implementing generative AI and another 42% are exploring it.”, [2] further supporting the idea that AI is here to stay. Although there are many organizations that have taken pause utilizing such new technology, even those who are hesitant are still exploring how AI can improve their organization and further increase efficiency. Love it or hate it, it is likely AI will reach all industries in some capacity and critical infrastructure is no exception.

The Roles and Responsibilities Framework for Artificial Intelligence in Critical Infrastructure provides guidelines for the safe implementation of artificial intelligence and advances cybersecurity best practices surrounding AI. The framework evaluates five roles across five responsibility areas.

The roles include: (i) cloud and computer infrastructure providers, (ii) AI developers, (iii) critical infrastructure owners and operators, (iv) civil society, and (v) the public sector. [4]

The responsibility areas include:  (i) securing environments, (ii) driving responsible model and system design, (iii) implementing data governance, (iv) ensuring sage and secure deployment, and (v) monitoring performance and impact for critical infrastructure. [4]

Ensuring all parties involved with an ICS understand their roles and responsibilities is vital to ensure proper implementation of security controls and effective incident response. [4] Lastly, the framework provides technical and procedural recommendations which can be broadly applied to the security of ICSs although most organizations will require tailoring based on the composition of their ICS(s).

Significance

Technology will continue to evolve at a breakneck pace and security experts around the world are always scrambling to keep up with new and evolving threats. However, Parsons from the SANS Institute believes proper and secure AI utilization has the potential to enhance cybersecurity in industrial control system (ICS) environments. [3] He believes AI could enhance threat detection, help to create more resilient systems, and provide more information to incident response teams. These enhancements in security could also translate to better productivity, availability, and efficiency overall.

Conclusion

Addressing threats is a never-ending battle getting in front of security concerns before widescale implementation of new technology is important. Having frameworks like these are valuable to both organizations looking to use AI and those developing different AI models. Afterall proper implementation can be useless in the face of insecure design and poor implementation can be just as damaging even with the most secure technology in the world. In the past frameworks from organizations like the National Institute of Standards and Technology (NIST) have been instrumental in the formation of comprehensive and effective policies and procedures for many organizations. Organizations operating ICSs should continue to utilize frameworks especially when it comes to cybersecurity and should evolve their policies as technology changes and best practices advance.

References

1. Associated Press. (2024). Homeland Security Department Releases Framework for Using AI in Critical Infrastructure. https://www.securityweek.com/homeland-security-department-releases-framework-for-using-ai-in-critical-infrastructure/
2. (2024). Data Suggests Growth in Enterprise Adoption of AI is Due to Widespread Deployment by Early Adopters, But Barriers Keep 40% in the Exploration and Experimentation Phases. IBM Newsroom. https://newsroom.ibm.com/2024-01-10-Data-Suggests-Growth-in-Enterprise-Adoption-of-AI-is-Due-to-Widespread-Deployment-by-Early-Adopters
3. Parsons, D. (2024.). ICS/OT Cybersecurity & AI: Considerations for Now and the Future (Part I). https://www.sans.org/blog/ics-ot-cybersecurity-ai-considerations-for-now-the-future-part-i/
4. U.S. Department of Homeland Security. (2024). Roles and Responsibilities Framework for Artificial Intelligence in Critical Infrastructure. U.S. Department of Homeland Security. https://www.dhs.gov/sites/default/files/2024-11/24_1114_dhs_ai-roles-and-responsibilities-framework-508.pdf