• Written by Muhammed Abdulla NC, CEO

A new deployment of AsscherAi often starts with a simple question from a manager, such as a category manager asking which supplier has the best on-time delivery record. Before answering, the team needs to consider security and privacy, to ensure that the query does not compromise sensitive information. Getting started with enterprise AI security requires careful planning and a structured approach.

Choosing a first case

When getting started with AsscherAi, it is helpful to choose a first case that already has a known answer to compare against. This allows the team to verify that the system is working correctly and that the security and privacy measures are in place. For example, a procurement manager may already know which supplier has the best on-time delivery record, based on manual analysis of the purchase order table. By using this as a first case, the team can check that AsscherAi produces the same answer, and that the query does not reveal any sensitive information about the suppliers or the organisation's purchasing habits.

This approach also helps to identify any potential issues with data quality or formatting, which can affect the accuracy of the results. By starting with a simple case, the team can work through any problems and ensure that the system is working as expected, before moving on to more complex queries.

Data processing and storage

When deploying AsscherAi, it is essential to consider where the data is processed and stored, and whether the system trains on any sensitive information. The data may be stored in a database, such as the customer relationship management system, or in a data warehouse, such as the sales data mart. The team needs to ensure that the data is handled correctly, and that any sensitive information is protected. This may involve working with the IT department to ensure that the data is stored securely, and that access is restricted to authorised personnel.

The team should also consider whether AsscherAi trains on any sensitive information, such as personal data or financial information. If it does, the team needs to ensure that the training data is anonymised, and that any sensitive information is removed. This may involve working with the data owners to ensure that the data is prepared correctly, and that any sensitive information is protected.

Prompt injection

Prompt injection is a potential security risk for AsscherAi, as it allows an attacker to inject malicious prompts into the system. This can be a data-boundary problem, as the attacker may be able to access sensitive information by crafting a prompt that exploits a vulnerability in the system. To mitigate this risk, the team should implement strict input validation, to ensure that any prompts are valid and do not contain malicious code.

The team should also consider implementing additional security measures, such as authentication and authorisation, to ensure that only authorised users can access the system. This may involve working with the IT department to implement single sign-on, or to restrict access to the system based on user roles. For more information on implementing security measures, please visit our website.

What to stop doing

If the comparison between the expected answer and the actual answer fails, the team needs to stop and re-evaluate the system. This may involve checking the data quality, to ensure that the data is accurate and up-to-date. It may also involve checking the system configuration, to ensure that the system is set up correctly. The team should not continue to use the system until the issue is resolved, as this could compromise the security and privacy of the organisation's data.

In some cases, the team may need to stop using a particular data source, or to restrict access to certain users. This may involve working with the data owners to ensure that the data is handled correctly, and that any sensitive information is protected. The team should also consider seeking advice from a security expert, to ensure that the system is secure and that any potential risks are mitigated. To contact our support team, please visit our contact page.

Limitations

This approach to getting started with enterprise AI security does not provide a comprehensive security plan, and it is not a substitute for a full risk assessment. It is also not suitable for all types of organisations, such as those that handle highly sensitive information, such as financial or personal data. In these cases, a more comprehensive approach to security and privacy is required, and the team should seek advice from a security expert.

The team should also be aware that this approach is not a one-time task, but rather an ongoing process. The team needs to continually monitor the system, to ensure that it remains secure and that any potential risks are mitigated. This may involve regularly reviewing the system configuration, and updating the security measures as necessary.

Next steps

Once the team has completed the first thirty days of getting started with enterprise AI security, they can begin to expand the system to include more complex queries and data sources. This may involve working with other teams, such as the data science team, to develop new models and algorithms. The team should also continue to monitor the system, to ensure that it remains secure and that any potential risks are mitigated.

The team should also consider developing a comprehensive security plan, to ensure that the system is secure and that any potential risks are mitigated. This may involve working with a security expert, to identify potential risks and develop strategies to mitigate them. By taking a structured approach to getting started with enterprise AI security, the team can ensure that the system is secure and that any potential risks are mitigated.