Leveraging The Benefits Of LLM Securely 

Generative AI (GenAI) based on large language models (LLMs) has created a breakthrough in the way humans interact and leverage AI technology. From generating human-like text to powering conversational interfaces and automating complex tasks.

Even though we are at the early stages of LLM adoption, businesses are ramping up their capabilities to build LLM-powered applications.

Initial findings from our customers reveal that one out of four customers are building LLM-powered applications and around 20% of them are using OpenAI as their LLM . And according to a developer survey by Stack Overflow 70% of developers are using or are planning to use AI tools in their development process. However, while businesses are strongly driven to embrace LLM adoption, in many cases a fear or lack of knowledge relating to the evolving attack vectors that come with it and AI-powered threats will be slowing down innovation. 

The Open Worldwide Application Security Project (OSWAP) Top 10 list for LLM applications has driven further awareness around the risks from LLM adoption by highlighting the critical need for security tools and processes to confidently manage the rollout of GenAI technology. Three key areas of focus within the OWASP Top 10 for LLMs include Prompt Injection, Insecure LLM Interaction, and Data Access.

But how do these specifically affect cloud native applications, and what is important to know about these attack vector techniques? 

Examining the top three LLM risks, identified by OSWAP: 

1.    Prompt Injection:  A new but serious attack technique specific to LLMs. Here the attacker crafts inputs designed to mislead or manipulate the model, with the intention to generate unintended or harmful responses. The model relies on input prompts to generate outputs and allows attackers to inject malicious instructions or context in line with these prompts. Prompt injection, if not identified, can lead to unauthorised actions or data breaches, compromising system security and integrity.

2.    Insecure LLM Interaction:  LLMs interact with other systems, increasing the risk that their outputs can be leveraged for malicious activities, such as executing unauthorised code or initiating cybersecurity attacks. These threats pose significant risks to data leaks, and identity theft and compromise both security and data integrity. 

3.    Data access:  LLMs store all the information they consume, heightening the level of data leakage risk when sensitive information is unintentionally exposed or accessed by an unauthorised person through the model’s output. The risk associated with improper data access controls is significant as it can lead to unauthorised data exposure, or breaches jeopardising both privacy and security. Proper controls are essential to mitigate this risk and ensure sensitive information stored within an LLM is processed and stored securely.

Businesses must be able to confidently navigate the complexities of LLM-based application development and deployment, ensuring compliance with regulatory standards and safeguarding against malicious exploits.

Here are the three key steps organisations must take to secure LLM applications from code to cloud:

1.    Discovery step: It is important to remember that as GenAI brings more simplicity for setting up applications, cybercriminals are seeking the same benefits. For example, AI agents can easily and quickly optimise productivity and speed into operations, but this evolution must be coupled with a robust security strategy for managing and monitoring agent-based systems. 

It starts by asking some crucial questions, about who and how GenAI is being used across the organisation and for what LLM applications. A thorough assessment is needed here, that identifies the various LLM applications or planned applications and how they interact with the full lifecycle. From code to cloud. The process involves identifying which microservices in the application have used or are backed by LLM-generated code and assessing the most common vulnerabilities associated by the nature of the application.

Understanding the different kinds of threats and integrating them with a business strategy will make sure LLM applications securely empower rather than hinder the business.

2.    Protecting vulnerabilities across the cloud lifecycle: Then it is about protecting the application that uses AI across the entire cloud application lifecycle. It is essential to employ advanced code scanning technology to identify and mitigate the unsafe use of LLM in application code, including unauthorised data access , misconfigurations, and vulnerabilities specific to LLM-powered applications.

By actively monitoring the workloads of LLM-powered applications, organisations can prevent unauthorised actions that LLMs might attempt, such as executing malicious code due to prompt injection attacks.

3.    Implementing guardrails: Employing specific GenAI assurance policies serve as guardrails for developers of LLM-powered applications. These policies will prevent unsafe usage of LLMs when based on practices from the OWASP Top 10 for LLMs.

With GenAI assurance policies enforced, alongside holistic protection across the entire cloud native application lifecycle, businesses and industries can truly embrace the transformative potential of GenAI.

New standards and comprehensive protection for LLM-powered applications from code to cloud bridges the gap between security requirements and development processes. Thus, allowing organisations to fully embrace innovation while mitigating potential risks.

Gilad Elyashar is Chief Product Officer at Aqua Security

Image: Google DeepMind

You Might Also Read: 

The Cybersecurity Risks Of Generative AI:

DIRECTORY OF SUPPLIERS - AI Security & Governance:

___________________________________________________________________________________________

If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

 


 

« US Blocks Leading Cybersecurity Firm Kaspersky
Large - Scale Supply Chain Hack On Auto Industry »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Code Decode Labs

Code Decode Labs

Code Decode Labs provides consulting for IT Technology, Cyber Security, Advanced Defense & Policing Technologies, Intelligent Networks, and Information Security.

Bishop Fox

Bishop Fox

Bishop Fox is a leading authority in offensive security, providing solutions ranging from continuous penetration testing and attack surface management to product and application security assessments.

HackerOne

HackerOne

HackerOne was started by hackers and security leaders who are driven by a passion to make the internet safer.

Zymr

Zymr

Zymr specialize in cloud computing solutions including Cloud Security, Cloud Mobility, Cloud Apps, Cloud Infrastructure and Cloud Orchestration.

Cysec - TU Darmstadt

Cysec - TU Darmstadt

CYSEC is the Cybersecurity faculty of the Technical University of Darmstadt and performs internationally renowned research in numerous areas of cybersecurity.

Apomatix

Apomatix

Apomatix is a platform that simplifies the complexity of cyber risk audit and management.

AnubisNetworks

AnubisNetworks

AnubisNetworks is one of Europe’s leading threat intelligence and email security suppliers.

Beazley

Beazley

Beazley are a specialist insurer with three decades of experience in providing clients with the highest standards of underwriting and claims service worldwide.

Cube 5

Cube 5

The Cube 5 incubator, located at the Horst Görtz Institute for IT Security (HGI), supports IT security startups and people interested in starting a business in IT security.

THEC-Incubator

THEC-Incubator

THEC-Incubator program is designed for international and ambitious tech startups in the Netherlands. Areas of focus include Blockchain and Cyber Security.

GreyNoise Intelligence

GreyNoise Intelligence

GreyNoise Intelligence is a cyber security company that collects, labels, and analyzes Internet-wide scan and attack data.

Gigit

Gigit

Gigit’s Service portfolio focuses on your business’ needs and the integration of comprehensive cybersecurity policies, plans, procedures, and practices into your business culture and operations.

IMQ Group

IMQ Group

IMQ is one of Europe’s top players in the field of conformity assessment. We offer certification services to support all the major sectors of the manufacturing and service industries.

APCERT

APCERT

APCERT cooperates with CERTs and CSIRTs to ensure internet security in the Asia Pacific region, based around genuine information sharing, trust and cooperation.

ThreatView by Turaco Labs

ThreatView by Turaco Labs

ThreatView combines extensive experience in digital forensics with advanced analytics and threat detection capabilities to protect eCommerce websites.

ClearFocus Technologies

ClearFocus Technologies

ClearFocus Technologies provides advanced cybersecurity services that secure our nation’s most sensitive assets.