By Employees do most of their work inside a browser, and AI extensions running there are emerging as a critical attack surface. Without clear rules on what employees may use, what sensitive data stays out of AI tools, and which extensions are installed, a security team has nothing to enforce.
In this interview on TFiR, Steve Winterfeld, Advisory CISO at Akamai, breaks down how security teams should govern browser-based AI extensions, from written rules to technical enforcement.
Guest: Steve Winterfeld, Advisory CISO at Akamai
Show: CISO Insights
LinkedIn: Steve Winterfeld
Watch the discussion on YouTube
Here is what every security team needs to know.
Technical Deep Dive
Q: How do security teams build governance for AI browser extensions?
Steve Winterfeld, Advisory CISO at Akamai, says governance starts with defining the rules: what employees may use, how they have been educated on what sensitive data to keep out, and whether they use a public AI, a public AI with RAG pulling company information, or a private AI instance. Winterfeld adds that teams must track which extensions employees have, check whether they are safe or changing, and audit them. That documentation then needs technical controls that validate and enforce the rules.
“First, you need the documentation side: What have you told people they are allowed to do? Then, you need the technical enforcement.” Steve Winterfeld, Advisory CISO, Akamai
Resources & Documentation
- Account Protector, an Akamai product for protecting user accounts
- Bot Manager, an Akamai product for managing bot traffic
- API Security, an Akamai product for securing APIs
***
👇 Click to Read Full Raw Transcript
Swapnil Bhartiya: We live our whole world inside a browser. We’re also seeing browser-based AI extensions emerge as a critical attack surface. How should security teams be thinking about this specific vulnerability?
Steve Winterfeld: So this is another one that’s kind of a blend. You know, first of all, what are my rules? What, what have I said employees can go use? What am I allowing them to do? How have I educated them on what not to put in there? What sensitive data? Am I using a public AI? Am I using a public AI with RAG that’s pulling my information? Do I have a private AI instance? And so these are things that once you kind of understand these, then I know what the danger of my browser is to how it’s connecting. The next is I want to kind of keep track and govern. You know, what extensions do people have? Are they safe? Are they being changed? Am I auditing them? So all of these are just kind of this whole new threat vector that you need to have as part of your program. You know, first you need that documentation side. What have you said people are allowed to do? And then you need that technical enforcement. How are you validating and enforcing that kind of thing? And so that’s often where, you know, it— I would think you would go and get a technical control, get something, you know, that— and this is why we have data on it, because we’re monitoring this for customers— that’s managing this for you. So your program is complete on that side.
