InfoSecBulletin Cybersecurity for mankind
OWASP released the LLM AI Cybersecurity & Governance Checklist. The 32-page document helps organizations create a strategy for using large language models and reducing associated risks.
Sandy Dunn, CISO at Quark IQ, started working on the checklist in August 2023 as a supporting resource to OWASP’s Top 10 Security Issues for LLM Applications, published in the summer of 2023.
B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum
Cisco Confirms
Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks
AWS Key Hunter
Test this free automated tool to hunt for exposed AWS secrets
Check Point Flaw Used to Deploy ShadowPad and Ransomware
CVE-2024-12284
Citrix Issues Security Update for NetScaler Console
CISA and FBI ALERT
Ghost ransomware to breach organizations in 70 countries
Hacker chains multiple vulns to attack Palo Alto Firewall
150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh
Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru
“I created the first version to help CISOs and cybersecurity professionals who were confused about what they needed to consider and where to begin with AI,” she said.
Steps to Take Before Implementing an LLM Strategy:
Review your cyber resilience and security training strategies and engage with leaders about AI implementation into your workflow as steps before deploying an LLM strategy.
It gives an overview of five ways organizations can use LLMs based on their needs.
The document states that it is important to consider factors such as the sensitivity of the use case, the required capabilities, and the available resources in order to determine the right balance between convenience and control when using public consumer applications or training proprietary models on private data.
Dunn said that even though the list isn’t complete, understanding these five model types is a practical starting point for evaluating options.
The document lists 13 things to consider when implementing an LLM use case to avoid unnecessary risk.
Dunn commented: “The four things I really wanted people to take from the checklist were the following:
Generative AI is a vastly different technology than we’ve tried to protect organizations from before and it will require a completely different mindset to protect an organization;
AI brings asymmetrical warfare: The adversary has an advantage because of the complexity and breadth of the attack surface. The first thing to address is how fast attackers will be able to use these tools to accelerate their attacks, which we are already seeing;
Approach AI implementation holistically;
Use existing legislation to inform your strategy: Even though very few AI laws are currently enforceable, many existing laws like the EU’s General Data Protection Regulation (GDPR) and privacy and security state laws impact your AI business requirements.”
