In episode 191 of Cybersecurity Where You Are, Sean Atkinson sits down with Sasha Elvenaes, Sr. Multidimensional Threat Analyst at the Center for Internet Security® (CIS®), and Rian Davis, Multidimensional Threat Analyst at CIS. Together, they discuss how threat actors are misusing generative artificial intelligence (GenAI) to plan physical threats.

Here are some highlights from our episode:

• 00:40. Introductions to Sasha, Rian, and their research on GenAI misuse
• 01:56. The impact of GenAI on lowering the barrier for operationalizing physical threat activity
• 03:37. Exploitation of GenAI model design to circumvent models' guardrails
• 05:58. The misuse of session persistence to streamline physical threat research
• 07:57. GenAI misuse: A call for critical infrastructure operators to think about security differently
• 11:52. Factors that make large-scale events a target of physical threat activity
• 14:33. The use of GenAI as a strategy for organizations to see what threat actors could see
• 15:37. Ongoing question: How can drones help mitigate risks while protecting public safety?
• 17:13. Extrapolation as a reinforcement of GenAI session persistence
• 20:15. The new reality: Look at what information AI can provide to threat actors
• 25:01. Traditional methods vs. GenAI conversations for threat planning
• 27:58. Continuous vulnerability assessments, communication, and other recommendations

Resources

• An Examination of Generative AI and Physical Threat Planning
• An Examination of AI-Enabled Threats to Event and Stadium Security
• Multidimensional Threats
• Man who exploded Cybertruck in Las Vegas used ChatGPT in planning, police say
• Episode 190: Separating Mythos AI Fact from Fiction
• Episode 185: AI Prompt Injection from a Risk Perspective
• 5 Steps to Help Secure Your City before a Large-Scale Event
• Unmanned Aircraft Systems (UAS): Evolving Risks to Large-Scale Public Gatherings
• 8 Security Essentials for Managing Your Online Presence
• Vulnerability Assessments

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].