The IT Nerd

Deloitte’s new research shows that UK workers are spending nearly £1bn of their own money on AI for work. Could employers’ restrictions drive even more of that use out of sight?

Paul Stokes, CEO and co-founder, Prevalent AI has provided this comment.

“The Deloitte GenAI Workforce Survey shows that enterprises have struggled to keep up with the demands for AI adoption. If British workers are using personal tools to deliver corporate goals, then they are exposing sensitive company data to unnecessary risk.

Technology leaders need a pragmatic approach to AI adoption. By providing the right level of access to employees, together with guardrails and the structured use of enterprise data, they can drive employee productivity while meeting organisational and regulatory requirements around data protection and privacy.”

Honesty, the use of “shadow AI” needs to be cracked down upon because that is only going to end badly. First should come the education, then should come more stricter measures in my opinion.

The Guardian has details on yet another epic hack. This time it’s consulting firm Deloitte who got pwned by hackers. And the way that the hackers got in screams of amateur hour in their IT department:

The Guardian understands Deloitte clients across all of these sectors had material in the company email system that was breached. The companies include household names as well as US government departments.

So far, six of Deloitte’s clients have been told their information was “impacted” by the hack. Deloitte’s internal review into the incident is ongoing.

The Guardian understands Deloitte discovered the hack in March this year, but it is believed the attackers may have had access to its systems since October or November 2016.

The hacker compromised the firm’s global email server through an “administrator’s account” that, in theory, gave them privileged, unrestricted “access to all areas”.

The account required only a single password and did not have “two-step“ verification, sources said.

So, let me simplify this for you. The administrator account allows a user to do anything they want. Usually, this account is disabled, or has some sort of strong protection such as two factor authentication to ensure that this exact scenario does not happen. Those protections were clearly not in place. Thus they got pwned. Another issue is the fact that the attackers had access to this email system for months. So who knows what they got away with? Finally, the time it took to disclose this is problematic. There really needs to be more transparency on that front.

Here’s what’s ironic about all of this. In 2012, Deloitte was ranked the best cybersecurity consultant in the world. But clearly in the five years since that award, things have slipped at the firm.

Pity.