Page 156 - CyberSecurityEssentialsEnglish

Chapter Four

Using AI Safely Without Losing Control

The 4D framework for privacy, verification, security, bias, and synthetic content
How to gain higher productivity while judgment, responsibility, and control stay in human
hands
Chapter question: how do we use artificial intelligence without leaking data, accepting a
wrong output, or delegating authority we cannot govern?

The central sentence: control does not mean stopping AI. It means knowing what we allow
it to do, what we verify, and what we record.

The practical 4D path: define the task and the risks, delegate the smallest sufficient role,

discern and review the evidence, then document the tool and the decision.

Story: A Video Meeting That Looked Real but Was Not
In early 2024, Hong Kong police announced an unusual fraud: an employee at the branch of
a multinational company received requests for financial transfers after a video meeting that
appeared to include company executives and colleagues. Reliable press reporting later

identified the company as Arup and put the loss at about 200 million Hong Kong dollars,
roughly 25 million United States dollars [18][19].

The deception did not rest on a clumsy message or a strange link. It rested on manufactured
trust: faces and voices in a meeting, job titles that looked familiar, and an urgent financial
request. The problem was not that the employee saw nothing. It was that he saw and heard

something convincing in a channel that is not by itself sufficient to authorize a high-impact
action.

The incident shows that the defense does not depend on detecting every forgery technically.

What matters more is that limits on delegation and an independent verification channel
exist: a call to a number known in advance, dual approval for transfers, separation between
the person who requests and the person who authorizes, and a record that shows why an

action was carried out and who reviewed it.

Inside organizations, the same risk may appear far less dramatically: a tool that summarizes
a policy and drops an important exception, an agent that reads a document containing
hidden instructions, or a system holding wider permissions than it needs. Safety here is not

the opposite of productivity. It is the condition for reaching a result you can defend if
someone asks: what happened, who decided, and on what basis?
Source: Reporting on the Arup deepfake case and its lessons [18][19].

155