Staying Safe While Using ChatGPT

While a significant number of organizations are contemplating the adoption of ChatGPT in various capacities, several others have already embraced it extensively for their day-to-day operational tasks. ChatGPT has quickly become the go-to chatbot to get answers to just about anything! However, with such tools comes a new set of challenges and risks that can affect businesses across industries.

GS Labs | GAVS conducted a webinar on the topic “ChatGPT: Navigating the Cyber Threat Landscape” with Mr. Abhinay Pandey, Cyber Threat Researcher, CloudSEK. The session was moderated by Mr. Kannan Srinivasan, Cybersecurity and Data Privacy Head, GS Lab | GAVS.

Large Language Models (LLMs) are pivotal to artificial intelligence based solutions such as chatbots. In simpler terms, LLMs can be thought of as highly intelligent programs designed to comprehend human language and respond in a manner that closely mimics human communication. LLMs ingest and process extensive textual information to enhance their language comprehension and response capabilities. There are various approaches to training LLMs, including unsupervised learning and supervised learning.

ChatGPT has several use cases in the healthcare sector, including inpatient triaging and virtual assistance. ChatGPT has recently been used to automatically generate summaries of patient interactions, facilitating the documentation of medical histories. Another application is remote patient monitoring, where wearable devices like smartwatches and various sensors are employed to track a patient’s health remotely.

In the BFSI sector, ChatGPT is used in customer support chatbots, enhancing customer service by answering queries, assisting with transactions, and providing information about financial products and services. It is also used for risk assessment and fraud detection.

In non-BFSI sectors there are notable developments in several key areas, focusing on streamlining customer interactions and enhancing the customer experience. Some uses include customer onboarding, simplifying the Know Your Customer (KYC) process, and targeted marketing.

The primary risk pertains to accuracy. ChatGPT may not consistently provide precise information. While it can offer responses, they might sometimes be vague or only partially accurate. This can lead to misunderstandings and potentially incorrect conclusions, making it crucial to exercise caution when relying on its output for critical tasks. There are also security risks. Users might inadvertently enter sensitive details during interactions with ChatGPT, raising concerns about the potential exposure of customer data. Another critical issue is the rising risk of phishing scams leading to data breaches, financial losses, and reputational damage. The development of malware is an alarming prospect. Malicious actors could potentially exploit ChatGPT’s capabilities to create advanced malware. This could result in a proliferation of new, hard-to-detect threats, necessitating heightened vigilance in the cybersecurity landscape.

The landscape of threat vectors is ever-evolving, which also holds true for ChatGPT. Threat actors continually adapt and exploit new avenues, and it’s crucial to understand how these dynamics have changed. Some cases of how threat actors leverage ChatGPT and related technologies include user data compromise, bypass techniques, AI models to perform nefarious activities, and DDoS attacks.

While dealing with phishing attacks, organizations must take a multi-faceted approach that combines user training, advanced technology, and incident response preparedness. This approach will help contain the risk of increasingly sophisticated phishing attacks, even when leveraging technologies like ChatGPT.

In software development, implementing a robust peer review process is an essential best practice – and will help in cases where ChatPT is used to get code snippets. Conducting code reviews before incorporating any code into the project is important. This process involves accepting code at face value and critically examining it. It helps ensure code relevance, identifies security risks, and contributes to a more efficient development process.

The RASCEF strategy offers valuable insights into harnessing this technology optimally. RASCEF, which stands for Role, Action, Steps, and Context, provides a structured approach to guide a user’s interactions with ChatGPT. Implementing the RASCEF strategy may require more effort initially but will result in a substantial improvement in the accuracy and relevance of ChatGPT’s responses. This structured approach ensures that users can harness the technology’s capabilities in a purposeful and efficient manner.

Here’s a breakdown of each component:

• Role: When engaging with ChatGPT, assign a specific role or persona. For instance, you might instruct it to assume the role of a backend software engineer. This helps set the context for the conversation and informs the model about its designated task.
• Action: Clearly define the action you want ChatGPT to perform. In this example, you could instruct it to generate backend code that stores data or implements specific functionalities. Be precise in your request to ensure the model understands your requirements.
• Steps: Provide explicit step-by-step instructions for ChatGPT to follow. For instance, you can instruct it to retrieve data from a particular source, combine it with another dataset, and then process the information using specific methods. This detailed guidance ensures that the model produces the desired outcome accurately.
• Context: Offer relevant context to ChatGPT. Explain the technology stack you’re using, the database management system in place, your infrastructure, and any constraints or resources available for the task. This context enables the model to respond to your specific environment and requirements.
• Example and Format: Finally, present the format with an example of the outcome you seek. If you’re looking for Python code, provide a sample of the code structure and functionality you expect. While this approach may appear meticulous initially, it significantly enhances the precision and efficiency of the technology’s response.

This blog is a high-level gist of the webinar. You can watch the entire webinar recording here.

GS Lab | GAVS offers comprehensive cybersecurity services that cover the entire spectrum of cybersecurity requirements, including assessments, operations, and strategic planning, effectively addressing your most pressing cybersecurity challenges. To learn more, please visit https://www.gavstech.com/service/security-services/.