Security Awareness in the Age of Deep Fakes: How to Train Employees in a World of Misinformation

The increasing popularity of Generative AI technologies has taken the world by storm these past couple of years. These tools have allowed the average user to create stunning AI-generated images, audio, and video and blurred the lines between real and fake. However, this has also given rise to the very real threat of misinformation in the age of AI, where it will be impossible to tell if the information is factually correct or fake. DeepFakes is one such application of AI that allows hyper-realistic videos of people in imaginary scenarios with viral videos of actors like Tom Cruise and Morgan Freeman present on the Internet. At the same time, this gives rise to a severe cybersecurity threat as DeepFakes can be leveraged to enhance the threat of Social Engineering attacks with fake video and audio. This article reviews this threat and what can be done to prevent it. 

What are DeepFakes

DeepFakes is AI-generated content that uses the power of machine learning algorithms to create audio and video content. While the technology has existed for several years, it has become more accessible and mainstream in recent years. This has led many users to experiment with DeepFake videos and make them viral. Unfortunately, it has also fallen into the hands of Cybercriminals who have recognized its potential as a tool for improving social engineering attacks.

How DeepFakes can be misused

DeepFake scams can be considered the next evolution of social engineering attacks. Unlike traditional attacks, which rely on phishing emails or more targeted spear-phishing techniques, Deepfakes allow attackers to create highly realistic audio and video to fool their victims. The realistic nature of these attacks means that even security-conscious individuals can get tricked into handing over sensitive information by seeing a video of someone they trust.  The impact of these attacks is not just restricted to identity theft and financial fraud but can extend to extortion and misinformation. Attackers can spread the news about well-known figures like politicians and senior executives to tarnish a company’s reputation and impact their stock price. 

These attacks also have profound implications regarding remote working and granting access to employees in remote locations. A database administrator could be interviewed with all reference checks being passed. Yet, at the other end, it could be a cybercriminal who has stolen the identity of this individual and is impersonating him using DeepFake. This could allow cybercriminals to access sensitive data without committing a security attack! This is not theoretical as these attacks have already taken place, with the FBI Internet Crime Complaint Center (IC3) releasing an advisory on the same, educating users on this new type of attack. The combination of DeepFake technology and stolen personally Identifiable Information (PII) to commit fraud can be an incredibly dangerous combination to defend against with remote workers in sensitive roles like database administration, programming, business, etc. 

How to create Awareness in a DeepFake age

People typically believe what they see, especially when they are talking to a person of authority. While educating users about being skeptical about the source of an email or a phone call is easy, detecting DeepFake scams can be much more difficult. Initial attacks have been seen by users becoming suspicious when the lip movement of the audio and the person were not synching however, this is an easy hurdle for cybercriminals to overcome as technology improves.

It is essential to create awareness around these scams, especially among staff with access to sensitive data. Employees should be trained to spot telltale signs of Deepfakes and how such scams work. 

In addition to awareness, other controls that might be implemented are: 

1. Improve your current procedure for hiring and interviewing remote positions that might have access to sensitive data. Train HR and hiring managers on other methods to verify interviews through additional methods, such as face-to-face or two-factor authentication, as traditional interview procedures may no longer be sufficient for sensitive positions. 
2. Invest in AI-based tools that use the power of AI to detect liveness detection and can spot if DeepFake technology is being used by attackers. These tools can identify patterns that might be invisible to the human eye and serve as additional control. 
3. Upgrade your security training and incident response procedures to incorporate DeepFake attacks. HR and Media personnel should also be trained in preparing for situations where a malicious person might use DeepFake to spread fake information posing as a C-level employee. 

Conclusion

DeepFakes are rapidly evolving and present a unique new challenge for cybersecurity professionals worldwide. A mixture of technical controls and awareness can help companies prepare for these attacks. The era of simple email-based social engineering attacks is far behind us as we enter new and uncharted territory. The way to success is to embrace this new age of AI and empower your staff with information on countering its malicious usage. 

Frequently Asked Questions