AI Forces CISOs and CDOs to Collaborate on Cybersecurity
AI isn't just a disruptor for businesses—it's also becoming a matchmaker in management, bringing CISOs and chief data officers (CDOs) together. The CDO's job is to leverage company data to deploy applications that speed up business processes. "In the past, I'd only talk to the CISO once every two months. Now, we're on the phone every week!" says José Alberto Rodriguez Ruiz, CDO at Cornerstone, a US-based HR management solutions company. "I actually talk to him almost every day now!" adds Tom Catchings, Cornerstone's CISO. This new collaboration isn't just an American phenomenon. "Honestly, we used to politely ignore each other, the CDO and I. But AI has brought us closer, because now we're both working with the same thing: data," says Odile Duthil, cybersecurity director at Caisse des Dépôts and president of Clusif, a French association of cybersecurity experts.
The CDO complements the CISO to secure AI
"Before, people only came to me for datasets to run projects. I was basically seen as just a data provider. Since AI projects started, my responsibilities have changed. I still provide data, but now I'm also responsible for its quality. AI only works well if it's fed quality data. If it's fed corrupted or unstable data, it will make mistakes," emphasizes Alfred Ortolani, CDO at Intescia Group, a company specializing in B2B data intelligence. Tom Catchings has noticed this shift in the CDO role as well: "AI is transforming the CDO role more than any other, because data is now essential. Ensuring data is clean, comprehensive, and pure is critical for AI projects. In the past, we could let some data errors slide. Not anymore."
AI trained on compromised data can hallucinate, leak confidential information to unauthorized people, behave unpredictably, and give bad advice. Organizations that neglect their data are also vulnerable to data poisoning—an attack that introduces malicious training data to manipulate AI behavior. That's why the CDO and CISO must work together to secure AI projects. "With AI, the risks aren't just technical—they can come from the data itself. That's why the CISO and I need to work together on all AI risks. The CISO needs to know what data is being used and how. We provide that knowledge, and he ensures its security," says Cornerstone's CDO. "Even before an AI project launches, the CISO and I review the data involved and discuss its exposure to cyber risks," adds Alfred Ortolani.
"Previously, it was the CISO who defined which data could be accessed for any project. With this new collaboration driven by AI, the CDO is stepping into what used to be the CISO's territory," says Eric Singer, external CISO and member of the Club des experts de la sécurité de l'information (Cesin). François Ehly, external CISO, senior manager at Almond and also a Cesin member, disagrees: "AI brings new cyber risks, some of which are also the CDO's responsibility, like analyzing AI errors that stem from training data." "There's no overlap in roles—just a better understanding of each person's responsibilities. It's a partnership, not a rivalry or a merger. Everyone keeps their own expertise," reassures Alfred Ortolani.
A partnership that's becoming institutionalized
This emerging collaboration is even being promoted by digital transformation consulting firms like Meritis. Influenced by ISO 42001, the AI management standard "which bridges cybersecurity and data management (...), we recommend involving the CDO in securing AI projects before they're deployed," says Gaëtan Eleouet, director of software engineering at the firm. In some companies, this partnership is becoming formalized. That's the case at Intescia Group. "When I joined the company two years ago, these teams worked in silos. So I encouraged collaboration between the CDO and CISO through new guidelines. These require both to be involved at the start of every AI project," says Philippe Sidommo, the company's CTO, who manages the CIO, CISO, and CDO. The same is true at Cornerstone. The US company has set up an "AI governance committee" where the CISO, CDO, and CIO "meet before launching any project, with meetings every two weeks," according to Tom Catchings. "It's time to formalize these relationships."
This article was automatically translated from French. Read the original version: https://www.journaldunet.com/cybersecurite/1557455-cybersecurite-comment-l-ia-oblige-rssi-et-cdo-a-travailler-ensemble/