TLDR: A study explores how locally hosted Large Language Models (LLMs) with retrieval-augmented generation (RAG) can support cybersecurity risk assessment in forestry cyber-physical systems. The research, involving 12 experts, found that LLMs can assist by generating initial risk assessments, identifying threats, and providing redundancy checks, helping to address the shortage of cybersecurity specialists. However, human oversight remains crucial due to trust concerns, potential inaccuracies, and the need for domain-specific relevance. Future work suggests agentic systems with specialized roles and human-in-the-loop checkpoints to enhance reliability and transparency.
Cybersecurity is a growing concern, especially in systems where safety is paramount, such as the advanced cyber-physical systems used in modern forestry. These systems, which include autonomous machinery navigating complex terrains, are increasingly connected and rely on AI, expanding their vulnerability to potential attacks. With evolving regulations like the Cyber Resilience Act demanding stringent cybersecurity standards, comprehensive risk assessments are more critical than ever.
However, many organizations face a significant challenge: a shortage of experts skilled in cybersecurity, AI, and regulatory compliance. This often leaves software engineers to handle cybersecurity tasks themselves, leading to a high workload for the few specialists available. This situation highlights a clear need for tools that can support both cybersecurity experts and engineers in evaluating threats and vulnerabilities during the risk assessment process.
A recent study explores the potential of using Large Language Models (LLMs) to address this gap. The research, titled Leveraging Large Language Models for Cybersecurity Risk Assessment — A Case from Forestry Cyber-Physical Systems, investigates how locally hosted LLMs, combined with retrieval-augmented generation (RAG), can assist in cybersecurity risk assessment within the forestry domain. A key aspect of this approach is ensuring compliance with data protection and privacy requirements, which often restrict sharing sensitive information with external parties.
The study involved a design science approach, engaging 12 experts through interviews, interactive sessions, and a survey. The researchers developed a customized LLM, specifically Llama 2, enhanced with a RAG architecture. This setup allowed the LLM to access a curated database of internal, closed-source documents, including existing risk assessments (e.g., from the railway domain following the IEC 62443 standard), project context data, and information from the MITRE ATT&CK knowledge base. This approach aimed to provide the LLM with domain-specific knowledge without extensive retraining, while also reducing the risk of generating incorrect information (hallucinations).
The findings indicate that LLMs can indeed be valuable assistants in cybersecurity risk assessment. Experts found that LLMs could generate initial risk assessments, help identify potential threats, and perform redundancy checks on existing assessments. This means LLMs can act as a supportive tool, identifying aspects that humans might overlook and providing a sanity check, thereby increasing confidence in the overall assessment process. Participants also appreciated the LLM’s ability to handle monotonous and time-consuming tasks, as well as its potential to serve as a brainstorming partner for creative tasks like threat identification.
Despite these benefits, the study also highlighted the critical need for human oversight. Trust concerns were significant, with experts emphasizing that LLM outputs require verification due to potential inaccuracies, inconsistencies, and a lack of specific detail. For instance, some generated risk assessments were found to be too generic, applicable to many systems rather than the specific forestry context, and sometimes lacked adherence to standard definitions or provided arbitrary numerical calculations without clear reasoning. The participants stressed the importance of transparency, where the LLM should explain its reasoning and request human verification when necessary.
Looking ahead, the researchers suggest moving towards an “agentic system” to further enhance LLM support. This involves decomposing the complex risk assessment task into specialized roles, with each agent focusing on a specific activity (e.g., identifying assets, generating threats) in accordance with established standards like IEC 62443. Such a system would also prioritize transparency and traceability by logging the sources of information used by each agent, and enforce human-in-the-loop checkpoints, allowing experts to audit and verify outputs at critical stages. This multi-agent approach aims to mitigate the current limitations of single LLMs and build greater trust in these AI-powered tools.
Also Read:
- The Hidden Vulnerability: RAG’s Effect on LLM Guardrail Reliability
- Navigating the New Frontier: A Comprehensive Look at AI Agent Security
In conclusion, while LLMs show great promise in supporting cybersecurity risk assessments, particularly in safety-critical domains like autonomous forestry, they are best utilized as intelligent assistants rather than fully autonomous decision-makers. With continued development focusing on transparency, traceability, and integrated human oversight, LLM-based tools can play a crucial role in alleviating the shortage of cybersecurity experts and ensuring compliance with future regulations.
