Preparing for the Next Generation of AI Cyberattacks

Why AI gives bad actors another tool to exploit vulnerabilities

July 19, 2023

Artificial intelligence (AI) has potential benefits for health care, but it also gives cybercriminals another tool to enhance their digital attacks.

In a new issue brief, the HHS Health Sector Cybersecurity Coordination Center (HC3) warned of the potential challenges of AI and how hospitals and health organizations can stay safe.  HC3 said AI is a “double-edge sword” for health systems, creating new threats and technologies to stay protected.

With AI, it’s easier than ever to design and execute attacks on health systems, including phishing emails, impersonation attacks, use of complex malware code, and ransomware, the report notes.

“The dark web contains many examples of discussions of the use of ChatGPT and other AI technologies to create malware and launch cyberattacks,” the report notes.

Among the key takeaways:

• Faster phishing:  Chat GPT and other automated language apps make it easy to design phishing emails or templates that give access inside a server or system.
• Malware:  Automated language apps remove the barrier to entry for bad actors to create malware, eliminating the technical requirements to execute these campaigns.
• What you can do:  AI could help bolster your defenses against digital threats. Health systems can expect additional support via penetration testing, AI training, cyber threat analysis, and better detection systems.
• Key resource:  The National Institute of Standards and Technology recently released a risk framework that is a good starting point to understand the potential harms to your staff and your organization.
• Quotable:  “Moving forward, expect a cat-and-mouse game,” the report notes. “As AI capabilities enhance offensive efforts, they’ll do the same for defense; staying on top of the latest capabilities will be crucial.”

The report is available to review online.

For more information about health care cybersecurity, contact Jason Tomashunas, CHEP, HAP manager, emergency management.