Compliance Stuff

The power of AI is creating new and evolving cyber risks. This article explores those risks, the legal landscape and consequences for organizations in the UK and US that fail to implement sufficient cyber protections, and the steps that legal departments should be taking to protect their organizations. AI cyber risk – both an internal and external challenge From an internal cyber defense perspective, AI as a technology is not substantially more risky than other new and novel IT systems. The internal risk stems from the rapid adoption of new technologies creating new attack avenues. AI is fueling a boom in new AI companies and the integration of AI into existing platforms. The speed of this change means the new technology may be less well tested and, accordingly, comes with heightened risks of undetected or unpatched vulnerabilities.  It also introduces change risk as new technology is onboarded. This often requires bringing new systems onto an existing IT estate or new connection...

Keypoint: The New York State Department of Financial Services (NYDFS) issued an  industry letter  outlining the threats posed to U.S. companies who hire remote technology workers linked to North Korea and may embezzle funds from their new employers. On November 1, 2024, NYDFS issued guidance warning companies against an increasing risk posed from individuals applying for employment in IT roles who are in fact operating on behalf of North Korea. These applicants seek employment in order to infiltrate western companies’ computer systems and illicitly generate revenue for the North Korean regime. As recently as August 8, 2024, the FBI arrested Matthew Knoot of Nashville, Tennessee, for his involvement in a scheme designed to assist North Korean threat actors secure remote IT positions with companies in the United States and the United Kingdom. These threat actors were paid hundreds of thousands of dollars in income that was funneled to the North Korean government to generate rev...