>
    Discover Risks Posed by GenAI Apps
    Focus
    Download PDF
    Focus
    1. Home
    2. AI Access Security
    3. Administration
    4. Discover Risks Posed by GenAI Apps
    Download PDF
    AI Access Security

    Discover Risks Posed by GenAI Apps

    Table of Contents

    Discover Risks Posed by GenAI Apps

    Discover risks posed by generative AI (GenAI) applications based on the use case, allowed traffic, data in motion or at rest, risky application, or application users.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Panorama or Strata Cloud Manager)
    • Prisma Access (Managed by Panorama or Strata Cloud Manager)
    One of the following:
    • AI Access Security license
    • CASB-PA license
    • CASB-X license
    Use the AI Access Security Insights dashboard to filter the generative AI (GenAI) application usage on your network. The AI Access Security Insights dashboard provides in-depth details to help you understand which GenAI apps are being used and by who.

    Discover Risks Posed by GenAI Apps by Use Case

    Discover risks posed by generative AI (GenAI) applications based on the GenAI application use case.
    Review the Supported Use Cases for full descriptions of all use case categories that a GenAI app falls into.
    1. Log in to Strata Cloud Manager.
    2. Select InsightsAI Access to view the AI Access Security Insights dashboard.
      The AI Access Security Insights dashboard displays GenAI application usage on your network by use case by default as well as the following high-level information about your top GenAI use cases:
      • Time Filter
        Filter your GenAI use case breakdown for the time period you want to investigate. You can select Past 1 Hour, Past 3 Hours, Past 24 Hours, Past 7 Days, or Past 30 Days.
      • Top Use Cases
        The AI Access Security Insights dashboard dynamically displays the top four GenAI app use cases based on activity on your network, along with the total number of GenAI apps and users who accessed any GenAI in the selected time period. This allows you to quickly investigate security incidents related to your most widely used GenAI apps and implement access control policy rules.
        • Applications—Total number of GenAI apps that fall into the particular use case. A line graph provides an at-a-glance breakdown of Sanctioned, Tolerated, and Unsanctioned GenAI apps.
        • Users—Total number of users who accessed any GenAI app that falls into the particular use cases.
      • All Other Use Cases
        • Applications—Total number of GenAI apps that fall into any other GenAI app use case. A line graph provides an at-a-glance breakdown of Sanctioned, Tolerated, and Unsanctioned GenAI apps.
        • Users—Total number of users who have accessed any GenAI app that falls into any other GenAI app use case.
      • Threats Detected
        Threats are detected by the Vulnerability Protection profile attached to the Web Security policy rule. This profile detects threats such as malicious and phishing URLs, malicious files, or malware. The Threats Detected is a summary of all threats across all GenAI apps and enforcement points.
        • Alerted—Total number of threats detected that generated an alert.
        • Blocked—Total number of threats detected that were blocked by your NGFW or Prisma Access tenants.
      • Sensitive Data Detected
        Sensitive data is detected when traffic matches the match criteria in your Enterprise Data Loss Prevention (E-DLP) data profile.
        • Alerted—Total number of DLP Incidents that generated an alert.
        • Blocked—Total number of DLP incidents that were blocked by your NGFWs or Prisma Access tenants.
    3. Review use case to see a detailed breakdown of all Sanctioned, Tolerated, and Unsanctioned GenAI apps in the use case you're interested in.
    4. Review the use case details page to understand GenAI applications usage.
      The use case details page provides granular data about the GenAI app usage. You can use this information to understand GenAI app usage to help inform you of what policy rules your security administrators need to write to strengthen your security posture. This ensures that your organization is safely adopting GenAI apps and to prevent exfiltration of sensitive data.
      • Use Case Summary
        The use case summary aggregates all important GenAI app usage information for the use case you're investigating.
        • Most Used Applications—The most used GenAI application for the use case. This also includes the application tag (Sanctioned, Tolerated, or Unsanctioned) currently assigned to the GenAI app.
        • Application Breakdown—Summary of the total number of GenAI apps associated with the use case as well as a summary of the application tags across all detected GenAI apps.
        • User Breakdown—Summary of the total number of users who accessed any of the GenAI apps associated with the use case. A summary of how many users accessed Sanctioned, Tolerated, or Unsanctioned GenAI apps is also provided.
      • Applications
        A list of all GenAI apps associated with the use case accessed by your users. You can apply a Sort By filter to the use case GenAI apps to sort them by User Count, Threats Count, Transferred Count. GenAI apps are sorted from highest to lowest count.
        The applications list displays the following information about each GenAI app detected.
        • Application Name—Name of the detected GenAI app. Click the app name to view detailed usage information. You're redirected to the Activity Insights Applications
        • Tag—Current GenAI application tag. You can apply a new tag by clicking the tag you want to apply.
          Palo Alto Networks groups the child app-IDs for app functionality in a container App-ID. However, tagging an App-ID container is not supported. You must individually tag the specific child App-ID that are sanctioned, unsanctioned, or tolerated within your organization.
        • Users—Total number of users who accessed the GenAI app. Click the user count to see a list of all the users.
        • Threats—Total number of detected threat activity.
        • Transferred—Total amount of data in gigabyte (GB) uploaded to or downloaded from the GenAI app.
        • Sensitive Asset—Number of DLP incidents generated due to sensitive data detected and blocked by Enterprise Data Loss Prevention (E-DLP).
        • Enterprise Available—Indicates whether the GenAI app offers an enterprise plan or license schema.
        • Data Used in ML—Indicates whether the GenAI app uses user-uploaded data for training purposes.
        • Risk Score—Risk score of the GenAI app.
      • Use Case Highlights
        • Applications—Total number of GenAI apps that fall into any other GenAI app use case. A line graph provides an at-a-glance breakdown of Sanctioned, Tolerated, and Unsanctioned GenAI apps.
        • Users—Total number of users who have accessed any GenAI app that falls into any other GenAI app use case.
      • Rules
        The Rules section displays a list of all default and custom policy rules written to target the GenAI apps associated with the use case. Policy rules written to both allow and block traffic to GenAI apps are listed here.
      • Recommended Actions
        • Alerted—Total number of DLP Incidents that generated an Alert across all GenAI apps associated with the use case.
        • Blocked—Total number of DLP incidents that were Blocked across all GenAI apps associated with the use case.
    5. Create a custom Security policy rule to control access to a GenAI application.
      In the example above, Openai-Base is the most used GenAI app in the Code Assistant & Generator use case. Additionally, this is an Unsanctioned application and indicates this an application not approved for use on your corporate network.
      In this case, you can modify the default GenAI access policy rule to explicitly block all access to OpenAI if this is an application your organization should not access.

    Discover Risks Posed by GenAI Apps by Risky Apps

    Discover risky generative AI (GenAI) applications accessed on your network.
    1. Log in to Strata Cloud Manager.
    2. Select InsightsApplications.
    3. Configure the filters for the application list to narrow down the GenAI apps you want to investigate.
      1. Configure the Time Range and Scope Selection to filter for the specific time range and enforcement point you want to investigate.
      2. Add Filter and add the following filters.
        • Source Type - Users—Filters the list of applications to only display GenAI apps accessed by users in your organization. This is a required filter.
        • GenAI Application - TRUE—Filters the list of application to only display GenAI apps. This is a required filter.
        • App Risk Score—For the App Risk Score filter, select the specific risk score you want to investigate. All GenAI applications are displays if you don't select at least one risk score.
          In this example, we are investigating applications with a risk score of 4 and 5 because these are the risk scores attributed to the riskiest applications.
    4. Review the list filtered GenAI applications.
      Some important information to review is:
      • Application Name—App-ID of the GenAI app.
      • Data Usage—Amount of data uploaded to or downloaded from the GenAI app. This can help you understand the GenAI app usage; a GenAI app with a large volume of data usage could mean that this app is widely used and might need strict controls to prevent exfiltration of sensitive data and malicious actors.
      • Tags—Current application tag for the GenAI app. If some of the listed GenAI apps are approved for use, you can modify the tag to Tolerated or Sanctioned.
        Palo Alto Networks groups the child app-IDs for app functionality in a container App-ID. However, tagging an App-ID container is not supported. You must individually tag the specific child App-ID that are sanctioned, unsanctioned, or tolerated within your organization.
    5. Create a custom Security policy rule to control access to a GenAI application for specific users.
      For example, based on your investigation you discover that there are multiple unsanctioned GenAI apps with a large volume of data usage. This poses a security risk because there are users accessing an unapproved app on the network and you don't know what data is being downloaded or uploaded. Until you can perform proper due diligence to understand the GenAI app purpose and who is permitted to use the GenAI app, you can Block the GenAI app for all users.
      Conversely, you notice there are some Unsanctioned GenAI apps listed that but they are GenAI apps approved for use on your network by specific users with a large volume of data usage. In this case, you can change the tag to Sanctioned and write a policy rule to Allow usage of the application but only for users in specific roles or departments. In the policy rule you can associate an Enterprise Data Loss Prevention (E-DLP) data profile to prevent exfiltration of sensitive data and a Vulnerability profile to stop attempts to exploit system flaws or gain unauthorized access to systems.

    Discover Risks Posed by GenAI Apps by App Users

    Discover the risks posed by risky users accessing generative AI (GenAI) applications.
    1. Log in to Strata Cloud Manager.
    2. Select InsightsAI Access to view the AI Access Security Insights dashboard.
      This displays the top GenAI apps that risky users accessed to help narrow your focus.
    3. Click Review use case for the GenAI app Use Case associated with the GenAI app your risky users are accessing.
      The AI Access Security Insights dashboard displays the GenAI application accessed on your network by use case by default and displays the following high-level information about your top GenAI app users. Click on the user count o view the User Name or IP Address and the number of GenAI Applications that user accessed.
      • User Breakdown
        The provides a summary of the total number of users accessing any GenAI app associated with the selected GenAI use case. A breakdown is provided of how many users are accessing Sanctioned, Tolerated, and Unsanctioned applications.
        Click Total Users to view a list of all users accessing GenAI apps associated with the selected use case.
      • Users by GenAI Use Case
        This provides a summary of the total number of users accessing each individual GenAI app associated with the selected GenAI use case. The Sanctioned, Tolerated, and Unsanctioned GenAI apps are listed with the total user count for each individual app.
        Apply the User Count Sort By filter to sort GenAI apps from higher to lowest user count.
    4. Create a custom Security policy rule to control access to a GenAI application for specific users.
      For example, based on your investigation you discover that a large number of users are accessing the bing-ai-uploading GenAI app. While this is a Sanctioned GenAI, it's only sanctioned for a specific set of users within your organization. You can decide to write a policy rule to explicitly block access to users which shouldn't have access to this GenAI app to prevent misuse and a Security policy rule to explicitly allow access to users who are approved to access the GenAI app. Alternatively, you can write a policy rule to allow access for all users but implement data loss and threat prevention measures to prevent exfiltration of sensitive data and prevent threats such as malicious and phishing URLs, malicious files, or malware.

    © 2024 Palo Alto Networks, Inc. All rights reserved.