ChatGPT - 資安與金融業

OpenAI於2022年11月推出的ChatGPT（Chat Generative Pre-trained Transformer）是一款近期非常流行的聊天機械人，廣泛應用於資料搜集、文章撰寫、語言翻譯、程式碼編寫和調整、計算等領域。那麼，ChatGPT在金融方面能夠提供什麼樣的助力呢？然而，ChatGPT可能會出現資安問題？

1966年，麻省理工學院推出了世界上公認的第一個聊天機械人Eliza，其應用範圍主要是模擬與心理治療師的對話。隨著聊天機械人的功能不斷演進，其應用範圍已經不僅限於單一用途。現代的聊天機械人配備學習功能，能夠自動學習和理解人類語言的語法和語意，並具備與人類進行自然對話的能力。

金融業可以利用ChatGPT獲得多種效益。其中最常見的應用之一是在客戶服務方面，為客戶提供24小時不間斷的對話、回覆或推廣，提高客戶的滿意度和體驗。此外，ChatGPT還可以分析大量關於金融方面的數據，從而預測市場的走勢，有助於投資者做出更明智的投資決策。同時還可以應用在機構上的風險評估和風險控制，通過自然語言處理技術來監測客戶的交易行為和交易風險，提高風險管理的效率和準確性。

ChatGPT雖然可以為金融企業帶來好處，但在資訊安全方面仍然是企業需要考慮的重點。因此，有些企業已經禁用員工使用ChatGPT。這是因為ChatGPT本身需要龐大的資料庫支持運作，其中包括了不少敏感資訊，如個人身分資訊和銀行資訊等。如果這些敏感資訊被非法獲取或洩露，會對用戶和企業造成嚴重的損失。知名消費電子產品及電子元件製造商三星就曾因員工將半導體設備、程式碼相關的資訊上傳給ChatGPT以方便工作，導致公司機密資料外洩。這也表明，企業在使用ChatGPT時需要特別注意資訊安全問題。

因此，如何對資料進行加密及保護，配合國家如何監管，制定法規會成為ChatGPT的一大課題。只有在資訊安全問題得到充分解決和保障的情況下，ChatGPT才能夠被廣泛使用。


尹展軒
Senior IT Consultant

More Updates

Leveraging OutSystems' rapid development strengths, our team achieves true Agile development, focusing intensely on user requirements. However, requirements are never fixed; they take time to refine within the project's cycle. If a developer simply builds projects based on the initial requirements, it leads to significant rework when those requirements are inevitably revised. This creates serious technical debt that can derail a project's schedule. To combat this, we strictly follow the OutSystems Canvas Design architecture to define each module's usage and content. We generalize logic into foundational modules, optimizing reusability and providing high adaptability when requirements change. This approach allows us to eliminate complicated dependencies—avoiding the deployment nightmares that plague monolithic systems. The Real-World Challenge: "The Spaghetti Monolith" We’ve all seen it. A project starts fast. The "Idea-to-App" time is record-breaking. But as sprints pass and requirements evolve, the "interest rate" on technical debt spikes. Suddenly, changing a simple UI element breaks a core business process because the logic was trapped inside the screen. Deployment becomes a "big bang" event where everything must go live at once because of circular dependencies. In our team, we don't just "code fast"; we architect for resilience. Our Solution: The 4 Layer Canvas Strategy We treat the 4 Layer Canvas not just as a suggestion, but as our structural imperative. Here is how we use it to handle volatile requirements:  Isolating Volatility (End-User Layer): We keep our User Interfaces (UI) and interaction logic in the End-User Layer. This layer is highly volatile—it changes constantly based on user feedback. By isolating it, we can redesign a "Customer Portal" without risking regressions in our core business rules.Stabilizing Business Logic (Core Layer): We abstract our entities and business rules into the Core Layer. This is the backbone of our factory. Whether the data is accessed by a Mobile App, a Web Portal, or a Timer, the validation rules remain consistent. This promotes the "Don't Repeat Yourself" (DRY) principle.Enabling Independent Deployments: By using Service Actions (Weak Dependencies) in our Core layer, we decouple our modules. This allows different squads to deploy changes independently without forcing a factory-wide refresh—a critical enabler for our CI/CD pipelines.The Governor: AI-Driven Architecture How do we ensure we stick to these rules when moving at Agile speeds? We don't just rely on manual code reviews; we use the AI Mentor System. This tool acts as our automated architect. It scans our entire factory to detect architectural violations that humans might miss, such as: Upward References: Preventing foundational libraries from depending on business logic.Side References: Ensuring our End-User apps don't tightly couple with one another.Circular Dependencies: Identifying the "deadly embrace" between modules that locks deployments.The AI Mentor System quantifies this debt, allowing us to pay it down proactively before it hinders our release velocity. Join a Team That Values Architecture In our Taiwan office, we believe that low-code doesn't mean "low-architecture." We are building resilient, composable enterprise ecosystems that can scale. If you are a developer who cares about structural integrity, clean code, and mastering the art of OutSystems architecture, we want to hear from you. 

𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴 𝗶𝘀 𝗲𝘃𝗲𝗿𝘆𝘄𝗵𝗲𝗿𝗲 𝗻𝗼𝘄

Does the following screenshot look familiar to you? Calendar invites that seem to appear out of nowhere in Microsoft Teams or Outlook, asking you to “review important information” or “resolve an account issue”?A phishing campaign has been found abusing Microsoft Teams calendar invites to deliver malicious links and files directly onto users’ calendars. These events often mimic Microsoft notifications, come from odd or external addresses, and include attachments such as .htm or .js files that, when opened, they can lead to credential theft, malware installation or even full remote access for the attacker.With phishing tactics evolving so quickly, ongoing awareness training remains critical and essential. Effective programs use realistic phishing simulations combined with targeted training to help employees recognize and report suspicious emails quickly, turning them into an active detection layer alongside your technical controls.At Ringus, we offer phishing simulation assessment services, with the following key features:💫Tailor-made realistic phishing templates💫Flexible campaign duration and cadence💫Comprehensive reporting and analytics with insights

𝗡𝗲𝘄 𝗥𝗲𝘁𝗿𝗶𝗲𝘃𝗮𝗹 𝗔𝘂𝗴𝗺𝗲𝗻𝘁𝗲𝗱 𝗚𝗲𝗻𝗲𝗿𝗮𝘁𝗶𝗼𝗻 (𝗥𝗔𝗚) 𝗔𝗜 𝗚𝘂𝗶𝗱𝗮𝗻𝗰𝗲

Germany's Data Protection Conference just released comprehensive guidance on AI systems with Retrieval Augmented Generation (RAG) - a game-changer for organizations implementing AI governance under ISO 42001.Key Compliance Requirements:🔎Data Accuracy - Enhanced Large Language Model (LLM) responses but error accountability remains🔎Transparency - Improved document traceability within RAG knowledge bases🔎Purpose Limitation - Technical implementation through client/functional separation🔎Data Minimization - Strategic vector database content management🔎Data Subject Rights - Full rights coverage across prompts, outputs, and databases👉 Why This Matters for ISO 42001:RAG systems are becoming mainstream for internal chatbots and enterprise AI. The Data Protection Conference guidance directly aligns with ISO 42001's requirements for AI risk management, data governance, and algorithmic accountability.Organizations deploying RAG technology must now ensure their AI management systems comply with both German data protection standards and international ISO 42001 frameworks.Our cybersecurity and privacy consultation expertise helps organizations navigate these complex requirements, ensuring your RAG implementations meet regulatory standards while maximizing business value.