Securing GenAI Systems: The OWASP LLM Top Ten

Name: Securing GenAI Systems: The OWASP LLM Top Ten
Rating: 3.8 (8 reviews)

If your company needs security awareness training for AI - then look no further!

Created byPack Of Coders - POC

Last updated 5/2024

English

English [Auto],

What you'll learn

Improve your security awareness of AI systems and the vulnerabilities that can impact them
Students will learn about some of the most common vulnerabilities that are found in AI systems
Learn where to spot these vulnerabilities in your AI ecosystem
Understand the threats these vulnerabilities pose to your applications and users
Discover steps to take that can mitigate the impact of these vulnerabilities and help your AI software operate in a safe manner
Learn about common these seen across vulnerabilities and AI security practices

Course content

13 sections • 38 lectures • 1h 40m total length

Introduction1:42
Note: While this course was being created, it seems like the Top 10 list was being refined. Some lists reference Model Theft as a vulnerability, others reference Weak Access Control. Since access control is is covered in several areas of the course, we decided to reference the variation of the list with Model Theft.
Course Structure1:40
Outline the three-part lesson structure for each OWASP LLM top ten vulnerability; section summary, vulnerability details, and threat and defense, highlighting item identification, objectives, characteristics, ecosystem placement, and best practices.
Resources1:11
Ethics0:55

AI Foundations6:59
Explore how large language models work as predictive ai systems, trained on vast corpora, and how domain-specific, proprietary LMs offer targeted, affordable solutions while emphasizing security in GenAI systems.
The OWASP LLM Top Ten7:36
Explore the OWASP LLM top ten vulnerabilities, including prompt injection and denial of service, and learn to secure supply chains, plugins, sensitive data, and guard against model theft.
Common Themes Across the Top Ten5:00

OWASP LLM #2: Insecure Output Handling2:28
Apply standard security controls to ai output by sanitizing, validating, and encoding it to prevent downstream exploits. Recognize untrusted inputs can create scripting risks; enforce safe encoding.
Understanding the Vulnerability1:44
Secure output handling across applications and plugins interacting with the LLM to prevent injection attacks; validate input and encode output before passing data to users, backends, or privileged functions.
Threat and Defense2:42
Validate and sanitize every prompt input, then encode and inspect output before delivery to the client to prevent vulnerabilities like cross-site scripting across entry and exit points.
Quiz - Insecure Output Handling

OWASP LLM #4: Model Denial of Service1:48
Learn to protect the language model from denial of service by preventing resource-heavy queries that threaten availability and raise costs, often driven by automated high-volume requests.
Understanding the Vulnerability2:01
Learn how denial-of-service attacks threaten the availability of genai systems, targeting the context window and input/output bounds, and sanitize untrusted content while enforcing rate limits.
Threat and Defense2:56
Quiz - Model Denial of Service

Requirements

An understanding of basic computing and software concepts is helpful

Description

In the rapidly evolving landscape of Artificial Intelligence (AI) and Machine Learning (ML), ensuring the security of these systems is paramount. This course delves into the intersection of AI and cybersecurity, focusing on the OWASP LLM (Large Language Model) Top Ten vulnerabilities as a way to drive the conversation.

If your company needs security awareness for your AI and development teams...then you'll see the value in this course!

The course begins with an exploration of the fundamental concepts of AI and ML, providing participants with a solid understanding of how these technologies work and their significance in various domains. From there, the focus shifts to the security aspect, introducing the OWASP Top Ten vulnerabilities specific to AI and ML systems.

Throughout the course, participants will:

Explore OWASP LLM Top Ten: Gain insights into the most prevalent security risks and misconfigurations affecting AI and ML systems, as identified by OWASP.
Understand Threat Scenarios: Delve into real-world scenarios where AI and ML systems are vulnerable to exploitation, understanding the potential impact of security breaches on organizations and society.
Learn Mitigation Techniques: Acquire knowledge on mitigating OWASP LLM Top Ten vulnerabilities through a combination of best practices, security tools, and robust development methodologies.

Who Should Attend:

This course is designed for AI/ML practitioners, cybersecurity professionals, software developers, system architects, and anyone involved in the development, deployment, or management of AI and ML systems. It is suitable for individuals seeking to enhance their understanding of AI/ML security and mitigate risks within their organizations.

Prerequisites:

Familiarity with basic concepts of AI/ML and cybersecurity is recommended but not required. Participants should have a keen interest in understanding and improving the security posture of AI and ML systems.

The course is structured as a self-paced online learning experience, allowing participants to progress through the material at their own convenience.

Enroll today to embark on a journey towards understanding key aspects of securing GenAI against common vulnerabilities, safeguarding the future of AI applications.

Who this course is for:

Anyone interesting in learning about securing GenAI systems
Development Teams that need security aware training for AI
Security Engineers
Security Architects

Securing GenAI Systems: The OWASP LLM Top Ten

What you'll learn

Explore related topics

Course content

Introduction4 lectures • 5min

Foundation Concepts3 lectures • 20min

Prompt Injection3 lectures • 8min

Insecure Output Handling3 lectures • 7min

Training Data Poisoning3 lectures • 7min

Model Denial of Service3 lectures • 7min

Supply Chain Vulnerabilities3 lectures • 8min

Sensitive Information Disclosure3 lectures • 7min

Insecure Plugin Design3 lectures • 8min

Excessive Agency3 lectures • 8min

Requirements

Description

Who this course is for: