Morey Haber, Chief Security Advisor at BeyondTrust, is an identity and technical evangelist with over 25 years of IT industry experience.
AI is widely recognized as an acronym for “artificial intelligence.” In the last year, AI has also been associated with the latest technology revolution for generative AI, large language models, and solutions that promise to change the way we do work, process information and interface with electronic technology in general.
The term AI is so broad, however, that it has recently been associated with everything from deepfake technology used in social engineering attacks to the latest coffee makers that optimize settings based on previous usage and environmental conditions. AI means many things, and in this security professional’s opinion, it will take time and possibly legislation to calm the buzz into a definition that has demonstrable results.
From an end user’s perspective, AI can mean anything from HAL 9000 in 2001: A Space Odyssey through the simple little chatbot you just interacted with to obtain technical or account support on a website. This brings up an interesting question: When does artificial intelligence become an artificial identity?
By definition, as noted in a book I co-authored with Darran Rolls titled Identity Attack Vectors 2nd Edition, an identity can be paraphrased as an entity associated with a human or machine that can be associated with multiple accounts. Every human has one physical identity but can be assigned to multiple electronic identities based on the systems they interface with.
When this is applied to AI, we can easily assume every human has some intelligence (even though we may question it at times) and an identity. For a machine, however, the identity and intelligence linkage may not be obviously apparent unless the system possesses human traits like KITT from Knight Rider or Pixar’s WALL-E.
This helps define our problem. Certainly, a coffee maker with AI does not have an identity even though it uses AI as code to perform its function. A chatbot may have AI for challenge response questions, but its only interaction is textual-based and may have a virtual presence as an identity.
This raises questions science-fiction writers have been discussing from Isaac Asimov to the sentience of Lt. Commander Data in Star Trek: The Next Generation. When is artificial intelligence sophisticated enough to possess the traits to provide equality of a human and machine identity?
Clearly, we are a long way off from having true artificial identities that can mimic all human traits electronically, but proof from Watson playing Jeopardy! and modern deepfake videos show that linking multiple artificial intelligence solutions together may provide a system that could fool many people via videoconference. In my opinion, this is what’s coming next.
End users will see threat actors and creative writers merge artificial intelligence solutions to create artificial identities that will be more than scripted content and possess interactive capabilities based on trained material from sources like ChatGPT to spoof human interaction. In addition, there is a lack of technology to fact-check the responses as well as a lack of laws to govern intellectual property dissemination via AI to provide controls on the output.
As we move to the back half of the roaring 2020s, we all should be cognizant of the advances in artificial intelligence. While the buzz is appearing everywhere, it’s only a matter of time before the consolidation and linkage of multiple AI technologies come together and begin to look more human. When it does, artificial intelligence will become artificial identities, and we’ll have to adapt the tools we use to manage identities in order to manage humans and machines through future aspects of electronic communications.
This will be much more than just the skills we see in solutions like Amazon Echo but more akin to credentials, multifactor authentication, identity security and even privileged access management that humans use today. We will need to apply all of these to artificial identities, and it may be a real problem that needs solutions by the end of the decade.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
Read the full article here
