Leveraging The Benefits Of LLM Securely 

Generative AI (GenAI) based on large language models (LLMs) has created a breakthrough in the way humans interact and leverage AI technology. From generating human-like text to powering conversational interfaces and automating complex tasks.

Even though we are at the early stages of LLM adoption, businesses are ramping up their capabilities to build LLM-powered applications.

Initial findings from our customers reveal that one out of four customers are building LLM-powered applications and around 20% of them are using OpenAI as their LLM . And according to a developer survey by Stack Overflow 70% of developers are using or are planning to use AI tools in their development process. However, while businesses are strongly driven to embrace LLM adoption, in many cases a fear or lack of knowledge relating to the evolving attack vectors that come with it and AI-powered threats will be slowing down innovation. 

The Open Worldwide Application Security Project (OSWAP) Top 10 list for LLM applications has driven further awareness around the risks from LLM adoption by highlighting the critical need for security tools and processes to confidently manage the rollout of GenAI technology. Three key areas of focus within the OWASP Top 10 for LLMs include Prompt Injection, Insecure LLM Interaction, and Data Access.

But how do these specifically affect cloud native applications, and what is important to know about these attack vector techniques? 

Examining the top three LLM risks, identified by OSWAP: 

1.    Prompt Injection:  A new but serious attack technique specific to LLMs. Here the attacker crafts inputs designed to mislead or manipulate the model, with the intention to generate unintended or harmful responses. The model relies on input prompts to generate outputs and allows attackers to inject malicious instructions or context in line with these prompts. Prompt injection, if not identified, can lead to unauthorised actions or data breaches, compromising system security and integrity.

2.    Insecure LLM Interaction:  LLMs interact with other systems, increasing the risk that their outputs can be leveraged for malicious activities, such as executing unauthorised code or initiating cybersecurity attacks. These threats pose significant risks to data leaks, and identity theft and compromise both security and data integrity. 

3.    Data access:  LLMs store all the information they consume, heightening the level of data leakage risk when sensitive information is unintentionally exposed or accessed by an unauthorised person through the model’s output. The risk associated with improper data access controls is significant as it can lead to unauthorised data exposure, or breaches jeopardising both privacy and security. Proper controls are essential to mitigate this risk and ensure sensitive information stored within an LLM is processed and stored securely.

Businesses must be able to confidently navigate the complexities of LLM-based application development and deployment, ensuring compliance with regulatory standards and safeguarding against malicious exploits.

Here are the three key steps organisations must take to secure LLM applications from code to cloud:

1.    Discovery step: It is important to remember that as GenAI brings more simplicity for setting up applications, cybercriminals are seeking the same benefits. For example, AI agents can easily and quickly optimise productivity and speed into operations, but this evolution must be coupled with a robust security strategy for managing and monitoring agent-based systems. 

It starts by asking some crucial questions, about who and how GenAI is being used across the organisation and for what LLM applications. A thorough assessment is needed here, that identifies the various LLM applications or planned applications and how they interact with the full lifecycle. From code to cloud. The process involves identifying which microservices in the application have used or are backed by LLM-generated code and assessing the most common vulnerabilities associated by the nature of the application.

Understanding the different kinds of threats and integrating them with a business strategy will make sure LLM applications securely empower rather than hinder the business.

2.    Protecting vulnerabilities across the cloud lifecycle: Then it is about protecting the application that uses AI across the entire cloud application lifecycle. It is essential to employ advanced code scanning technology to identify and mitigate the unsafe use of LLM in application code, including unauthorised data access , misconfigurations, and vulnerabilities specific to LLM-powered applications.

By actively monitoring the workloads of LLM-powered applications, organisations can prevent unauthorised actions that LLMs might attempt, such as executing malicious code due to prompt injection attacks.

3.    Implementing guardrails: Employing specific GenAI assurance policies serve as guardrails for developers of LLM-powered applications. These policies will prevent unsafe usage of LLMs when based on practices from the OWASP Top 10 for LLMs.

With GenAI assurance policies enforced, alongside holistic protection across the entire cloud native application lifecycle, businesses and industries can truly embrace the transformative potential of GenAI.

New standards and comprehensive protection for LLM-powered applications from code to cloud bridges the gap between security requirements and development processes. Thus, allowing organisations to fully embrace innovation while mitigating potential risks.

Gilad Elyashar is Chief Product Officer at Aqua Security

Image: Google DeepMind

You Might Also Read: 

The Cybersecurity Risks Of Generative AI:

DIRECTORY OF SUPPLIERS - AI Security & Governance:

___________________________________________________________________________________________

If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

 


 

« US Blocks Leading Cybersecurity Firm Kaspersky
Large - Scale Supply Chain Hack On Auto Industry »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Landry & Associates

Landry & Associates

Landry & Associates is a multidisciplinary firm specializing in risk management, performance and technology management.

ComSec LLC

ComSec LLC

ComSec perform threat assessments to identify vulnerabilities and help protect businesses against corporate espionage via electronic eavesdropping.

Planit Testing

Planit Testing

Planit is a leader in Quality Assurance and a specialist in software testing and training services.

Allgress

Allgress

Allgress solutions converge disparate risk silos across enterprise networks and automate governance, risk and compliance management processes.

IT Association of Slovakia (ITAS)

IT Association of Slovakia (ITAS)

ITAS is a professional association of domestic and foreign companies operating in the field of information and communication technologies

NTNU Center for Cyber & Information Security (NTNU CCIS)

NTNU Center for Cyber & Information Security (NTNU CCIS)

NTNU CCIS is a national centre for research, education, testing, training and competence development within the area of cyber and information security.

App-Ray

App-Ray

App-Ray provides fully automated security analysis of mobile applications to find security issues, privacy breaches and data leaking potentials.

SEC Consult

SEC Consult

SEC Consult is a leading European consultancy for application security services and information security.

Cog Systems

Cog Systems

Cog Systems offer an embedded solution built on modularity, proactive security, trustworthiness, and adaptability to enable highly secure connected devices.

WiSecure Technologies

WiSecure Technologies

WiSecure Technologies aims to develop cryptographic products meeting requirements in the new economic era.

ditno

ditno

ditno uses machine learning to help you build a fully governed and micro-segmented network. Dramatically mitigate risk and prevent lateral movement across your organisation – all from one centralised

OmniCyber Security

OmniCyber Security

Omni is a cyber security firm specialising in Penetration Testing, Managed Security and Compliance.

senhasegura

senhasegura

senhasegura is a global Privileged Access Management vendor. Our mission is to eliminate privilege abuse in organizations around the globe and build digital sovereignty.

Cymune

Cymune

At Cymune we help businesses to fight against cybercrime, protect patented data and diminish security risks.

Inveo Group

Inveo Group

Inveo group is the Italian leader for the management of privacy and data protection issues.

Orca Fraud

Orca Fraud

Orca is an AI-driven fraud orchestration platform. We empower fraud fighters to outpace fraud using our custom ML models.