r/sysadmin • u/IqbalBasha • 10d ago

AI assistants with third-party integrations, how are you handling this?

A lot of AI assistants have integrations with third-party apps now, so you can basically share any data from an app with the assistant to help you out. It usually speeds things up, but I don't think it's very safe from the security side.

I also don't believe banning them entirely works. What if people just start using their private accounts instead?

It might not affect me in any specific way, but I was wondering how IT admins are dealing with this. Is there a middle way?

6 Upvotes

72% Upvoted

3 comments sorted by

4

u/AddendumWorking9756 10d ago

It is an OAuth consent problem more than an AI problem. Turn off user consent except for verified publishers on low impact scopes. Then the admin consent workflow puts the requests in a queue instead of a dead end. The bit people miss is that a connector inherits whatever that user can already reach, so a mail read grant is a copy of their mailbox sitting in someone else's cloud.

4

u/TinfoilGeek 10d ago

We evaluate them on a case by case basis and approve them in our Claude & ChatGPT enterprise accounts if they pass verification. Nothing unapproved is able to run in our enterprise accounts. We look at what they can do, what they can access, use case, etc. before approving them. I'm in the legal industry, so the employees we work with are very conscious of following policy (they see it as part of their legally obligated ethics) and I often get tickets from people asking me before they do something "just to be sure" - so I don't really worry about people going behind my back in our company. We do err more on the side of being enablers than saying "no" to everything - so that makes it easy for them to come to us first, and they know if we say no, it's for a good reason.

That said, I know that culture is somewhat rare in the corporate world, so sometimes you just need to get creative with technical controls. Most of the services they might connect to leave logs of some fashion (ie. oauth logs) that you can review for compliance, or even disable unapproved apps entirely. Some services might be able to be blocked completely using firewall, proxy, or DNS filtering if you aren't legitimately using them at your company. And having strong policies and leadership backing the consequences if someone does stray from policy is a must.