SECURITY ESSEN MAGAZINE


generative AI to bypass traditional biometric, human, and cryptographic trust systems. In simpler terms, it effectively


breaks the most trusted fundamental security principle of all – that “seeing is believing”. In 2024, years after Chikli began his campaign of deception, an employee of the engineering giant, Arup, made a seemingly transfer


of millions of


routine dollars,


following a video call with “senior managers”. Except, it turned out, the employee


hadn’t been talking to Arup managers at all, but to deepfakes created by artificial intelligence. The rewards were high – in this case, $25 million


makes deepfakes a potential weapon in information warfare: the danger lying in the fact that AI systems are trained on real


images, and the


resulting forgeries are technically almost indistinguishable from the originals. This, he says, blurs the lines between the real and the artificial – with profound consequences for trust, democracy, and social cohesion. David Bothe, a prominent German


IT security expert and Institute for Internet Security researcher


has


analysed the threat of deepfakes in a corporate security context, bridging the gap between technology and human psychology. Rather than treating deepfakes as


EVEN AT THE MOST BASIC LEVEL OF AMATEUR HOUR, THE ERA OF FAKE IDS PRODUCED BY TAMPERING WITH


PHYSICAL DOCUMENTS TO FOOL NIGHTCLUB DOORMEN IS WELL AND TRULY OVER


– but the technical barriers were low, according to an assessment by Arup’s principal spokesman. Chief Information Officer, Rob


Greig told a World Economic Forum session on cybersecurity: “I would call


it engineering. It


cyberattack in the purest sense. None of our systems were compromised and there was no data affected. “People


believing


technology-enhanced social wasn’t even a


were deceived into they were carrying out


genuine transactions that resulted in money leaving the organisation. My understanding is that this happens more frequently than a lot of people realise. Audio and visual cues are very important to us as humans and these technologies are playing on that. I think we really do have to start questioning what we see.” Cybersecurity expert Mirko Ross,


in an interview with the Süddeutsche Zeitung, warned of a new dimension in digital manipulation in which Artificial Intelligence is creating attack vectors that can massively influence public debates – subtly, quickly, and globally. “Anyone who owns a computer can become a deepfaker,” he said. And that


40 | BACK TO CONTENTS


just a technical software vulnerability, he analyses how they specifically weaponise corporate exploiting psychological


dynamics, high-


pressure situations and using emotion to bypass intellect. Part of the issue is awareness. Standard enterprise IT fails


training to protect against deepfake-


driven social engineering, ignoring the “compliance”


trap: He points


out that while traditional courses successfully impart static knowledge about phishing or password security, they fail to cultivate secure decision- making behaviours when an employee is confronted by a live, dynamic deepfake impersonation. Bothe argues


that because


generative AI has industrialised highly personalised corporate attacks, organisations cannot rely solely on firewalls or email filters. Last month,


the European


Commission published its Code of Practice on the transparency of AI- generated content, reinforcing how organisations should identify, label, and manage it under the EU AI Act. A key change in security circles has been a shift from simple visual analysis toward a zero-trust model that relies on hardware-level validation, multi- modal biometrics, and strict out-of- band verification procedures. Many of the leading research


organisations estimate that standalone identity verification tools are no longer reliable on their own, forcing the industry to deploy a multi- layered defence strategy against the likes of biometric spoofing which involves the mimicking of facial


distinct movements and real-time


injection attacks which involve the use of malware to directly inject pre-


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36  |  Page 37  |  Page 38  |  Page 39  |  Page 40  |  Page 41  |  Page 42  |  Page 43  |  Page 44  |  Page 45  |  Page 46  |  Page 47  |  Page 48  |  Page 49  |  Page 50  |  Page 51  |  Page 52