Can Your AI Use Sensitive Data Safely? 5 Capabilities You Need Transcript, AI Summary & Key Points

00:00 AI can leak data at machine speed. We spent decades building controls to keep humans from accessing sensitive data. Now we're giving that data to machines that can process it at machine speed. So, we need controls that can operate at machine speed too. Consider this. Often the data that makes AI the most useful is also the most sensitive stuff as well.

00:25 So I'm talking about things like customer information, we call it personally identifiable information, health data, ah, personal health information, or financial information. So this is the kind of stuff that creates a conundrum for us. Do you throw caution and your digital crown jewels to the AI wind so that you can get the best results? Or do you play it safe and get bland generic outputs?

00:49 Maybe there's a third option, and you could go down that path and optimize meaningful outcomes without compromising the keys to the kingdom. In order to do that, you need to do some homework first though. So let's talk about five foundational controls that you need in order to use sensitive data with AI without compromizing the company and its customers.

01:13 It all starts with visibility. After all, you can't protect what you can see. And the problem is that most organizations lack a single view of where all their sensitive and regulated data lives. Oh, and this stuff doesn't just sit in place. That's because data is the lifeblood of AI and that blood has to circulate to keep the system alive. That means you have to see where it moves if you're going to secure it.

01:40 And where might that be? Well, it could be on premises. It could on servers and endpoints, It could be in the cloud as a SaaS or some hosted system. It could be in flight, traversing a network. And not only that, you also need to know who is using this information and why. You need a single view across all systems and all parts of the organization that gives you the visibility and insight into the risk you're taking so that you can mitigate the potential downsides.

02:16 After you've seen it, you need to identify what it actually is and classify it by sensitivity level. If you don't do that before your data is consumed by an AI, it might consume you, metaphorically speaking, of course. Just as you can't secure what you can see, you also can't security what you don't really understand. And you won't know if the controls you have in place are appropriate to match the value if you don't classify it first.

02:45 Too much control and you blow the budget and stifle innovation. Too little and you risk fines and lose customer trust. Too often, governance is something that happens only after the AI has used it and the data has moved. At that point, you're playing catch-up. A proactive approach is what's necessary. You need this instead because manual tagging of data is slow, error-prone and leaves gaps if it isn't perfectly complete.

03:16 Well, this thing also needs to be automated. You need a capability which can read the data and classify it automatically according to sensitivity level. And you also need all of this to operate continuously because data is coming into the system and it's leaving all the time. You need to classify data early and often before it reaches the AI systems so that you can prevent damage before it happens.

03:44 Knowing which systems the data is on is important. But in some cases, it can be just as important to know where that system is located. There are two related concepts that are important to understand here, and they deal with this idea of residency. So, data residency, well, that's where the data is stored. This is, ah, on what system and where it might be geographically.

04:10 Data sovereignty is another concept which deals with which laws are involved with the data, and where it happens to exist. What governmental authority applies to the data that we're talking about. So, some data is required by law to reside within certain jurisdictional boundaries. In other words, it's not enough just to protect it. It also has to live within those geographical areas.

04:36 Often these are specific national territories. So let's take an example. Suppose a US company stores some data in a German data center. So we've got our data over here. Um. What the data residency of this is Germany. The jurisdiction, though, may be different, but what happens is because the data is stored there, it may be subject to German and European Union laws, things like GDPR, the generalized data protection regulation, because of the fact that it resides there.

05:14 So jurisdiction matters as well. That's the sovereignty aspect, that jurisdictional part. But sovereignty gets more complicated with cloud providers. If we've got, let's say, a US company that owns a cloud system, a cloud data center, that's actually housed in Germany. Now, it's a question of whose laws apply, and everyone's gonna have different answers to that, about whether US laws could compel the provider in Germany to per … to disclose that data or not.

05:46 So, that's why we, it gets sticky. A useful way to remember all of this is that residency is asking that question where is my data? And sovereignty is asking whose laws control my data? Another thing to consider is that even if you know where your data is stored, that doesn't necessarily mean that's where it is processed. So, you may hear a third term, data localization, which is the legal requirement that certain data must be stored and processed within a particular country or region.

06:18 And that can be particularly difficult to know when you're dealing with a cloud environment, ah, because it's involving lots of different locations and that location may not be exposed as metadata. So it may not obvious to you. So residency deals with where the data is physically stored. Sovereignty is about jurisdiction and who has the authority over it.

06:41 Localization deals with the data that is legally required to stay and be processed within a particular jurisdiction. It can get complicated, but the bottom line is that organizations need enforceable controls over where their data lives and how it crosses jurisdictions. And by the way, make sure your legal team agrees with your approach. As AI adoption grows within your organization, the number of users, applications, and models accessing data also grows too.

07:12 You're gonna need clear controls over who can access sensitive stuff and under what conditions they can do it. Ultimately, sensitive data needs to remain inside governed boundaries with controlled interactions. We call that access control. And it's part of a larger domain of things called identity and access management. Now, I like to think of IAM, identity and access management, as four As.

07:37 And those As are this. The first one is administration. That's where we're going to go create accounts, ah, deprovision or provision accounts, make them happen, tear them down, add capabilities to them. We're gonna use something like an approval workflow process. We're gonna try to implement this notion of the principle of least privilege where you have only the access rights that you need.

08:04 The second A is gonna be authentication. And with authentication, this is how we're finding out who you are. Are you who you claim to be? And we'll use technologies like multifactor authentication and pass keys and things like that in order to figure out if you're who you claimed to be. The third A is authorization. And authorization is if this is who are you, this is are you allowed to do this or not?

08:31 It's actually a harder question to answer. This is where we introduce things like role-based access control. Ah. We've got other things like conditional access control and things of that sort. So, these are the things that we're gonna put in place for making sure that you have access control. The fifth control is evidence, and that comes from the fourth A.

08:53 No, I didn't forget, you thought I had. The fourth A is audit. Audit is the control where we go back and make sure that we did the previous three A's correctly. Auditors and regulators want ret … real evidence, not assumptions. You don't wanna have to rebuild lineage moo … and data movement records manually after the fact. It's much better if you have continuous evidence showing where data moved, where it lives, and which AI workloads use it.

09:24 The bottom line is that auditors live on data. If you don't feed them, then you'll end up on the menu, again, metaphorically speaking. So keep them well-fed with evidence. Here's a way to think about it. Data moves throughout your environment, right? Okay, so you need to capture those data movements through automated logging. Then you're gonna store them and create an immutable audit trail.

09:53 An immutable means it can't be changed because if someone could change it, now we can't trust it anymore. Then you gonna analyze reports of the activity that you've gathered and then prove all of this out to your auditors and regulators. And auditors will want to know things like where is the data? Who accessed it? Um. What did they do with it? And which AI used it?

10:21 You're gonna need to know all of these pieces of information in order to show the evidence. Another way to look at all of this is that trustworthy AI depends on trustworthy data. And trustworthy data, well, that depends on having controls in place that allow you to trust it. So, what that means is you need to be able to see it and know where it goes.

10:44 You need to identify it and know how sensitive it is and what protections are needed. You need to constrain it so that you don't run afoul of company policies, national laws and industry regulations. You need control it so that only the right people have access and prove it, so that the auditors know you did all the other stuff correctly. When these controls are in place, sensitive data moves from being a compliance exposure keeping you up at night to a strategic AI asset that allows you to fully leverage all the gold

11:12 hiding in your data. Then you win. And the auditors aren't scrounging for snacks.