BLOG - Ai In Cybersecurity Education

As a computer scientist, I love to see new technology take us to places we could not go to a few years ago. AI is a technology that checks a lot of boxes. It is incredibly valuable for many different applications, it threatens to disrupt some industries, it could be used for nefarious purposes, and it scares people. As AI became available to anyone, many schools became concerned about how students could utilize it to cheat on assignments. I have caught my fair share of AI-generated papers and content and have challenged students to do better. But, I also must admit that there are some good use cases for this technology in the classroom. Some of these could be used by cybersecurity professors to encourage students to use this new technology effectively and productively. Some actions in this field could benefit from the use of AI and students should be trained on how to use these capabilities. 

Coding
AI is great at writing code. I was recently working on a side project that required some coding in Python. I knew I could spend part of the day writing and testing the code, but decided to let AI do the work for me instead. What would have taken me 6-8 hours was finished in less than 10 seconds by AI and the code ran flawlessly. I made a few personalization tweaks but largely left the code unchanged and have been using this new application every day over the past few months. Cybersecurity is one of those fields that require programming to develop new security capabilities and to monitor for nefarious activity. AI is a tool professors can implement in the classroom to have students configure defensive appliances in short order and can even create customized configurations for specific use cases.

Intrusion Detection Systems
Intrusion Detection Systems are a critical appliance for network defense, and they constantly need to be updated to monitor the latest threats. These are often updated by adding new alerts to configuration files, but one error in those files can cause the wrong traffic to be flagged or not flag any traffic at all. AI could be used not only to generate a new list of alerts but also do so in a very precise and efficient matter. One of the reasons these lists are updated is because of past hacking incidents that revealed shortfalls in defensive measures. Students could be trained on how to feed all past incident reports into AI and have it create a custom Intrusion Detection System configuration based on all past known hacking activity targeting a specific network. 

Network Configurations
AI is great at determining the areas an attacker may target on a network. One of the challenges to cybersecurity, especially as a network grows, is managing the patches and updates regularly required by the software, applying changes to appliances to allow trusted connections into and out of a network, and overseeing special configuration requirements for specific team needs. Each one of these changes can open up a network for a new type of attack. Professors can show students how to chart all network configurations and provide them to AI to determine where gaps may exist in the security posture. A good cybersecurity professional can find gaps on their own if they spend enough time looking at all the variables, but AI could do it in a few seconds and free up their time for other tasks where AI cannot help. 

We also need to consider that many tools we have available to us today use a type of advanced heuristics based on set rules to look for anomalies in network traffic. This type of capability could be replaced with AI to find a greater degree of anomalies. Some appliances already exist that implement AI in real-time detection boasting increases in detection accuracy by almost 50% and showing the ability to recognize zero-day threats before they cause any damage. This is a significant increase in capability that cybersecurity professors should implement in the classroom.

Using Caution with AI
While AI is a very valuable tool, there are also some use cases that professors should caution against using. Most AI capabilities live on large systems outside of the control of the users. One cannot control what AI does with the data it is provided nor does one know what other individuals may have access to the data processed by AI. With this in mind, students should be cautioned against using AI for processing or analyzing sensitive data. This in itself can be another assignment where students determine what categories of data should be restricted from being shared with AI. Companies may not want their designs for a flying car processed by a system that could feasibly share that information with someone else. 

Professors who assign these types of assignments to students are preparing them to excel in industry through the use of AI. The tedious work of analyzing data, manually updating configurations, and searching for anomalies can be delegated to a tool capable of completing those tasks in a faster and more efficient manner. Students still need to be aware of how to do all these tasks manually in situations where AI capabilities are unavailable or when managing more sensitive data sets. But in other cases, the use of AI can make network security tasks more efficient. AI is being used in the medical field to analyze X-rays, in the banking industry to prevent fraud, and in self-driving cars to make split-second decisions. Its use within cybersecurity is only going to increase. The better prepared our students are now, the more secure networks will be in the future.