ChatGPT Made These
An important aspect of LLM security, this practice involves reviewing and auditing the model's training data for potential biases.
What is data bias analysis?
In 2021, a cyberattack on this company resulted in the shutdown of one of the largest fuel pipelines in the United States.
What is Colonial Pipeline?
A common type of phishing, where attackers pretend to be a legitimate organization like a bank or a social media platform to steal login credentials.
What is "spear phishing"?
A common security practice to prevent SQL injection involves using these to separate SQL queries from user input.
What are "prepared statements" or "parameterized queries"?
This event was held this month to reduce the amount of unused features or options (and thus attack surface) in our product.
What was "Taking the Chainsaw to Zombie Code"?
To prevent data leakage, organizations should implement this technique to hide sensitive information generated by LLMs.
What is data redaction?
In 2021, one of the largest cyberattacks in US history, over 30,000 US businesses were affected by a sweeping attack on services running this software, one of the largest email servers in the world.
What is "Microsoft Exchange"?
A strong security measure that can help protect against phishing involves enabling this two-factor authentication method.
What is "2FA" or "Two-Factor Authentication"?
To minimize the attack surface of a program, developers should follow this secure coding principle, which means disabling or removing unnecessary features and services.
What is "reducing the attack surface"?
When possible, you should do this with sensitive data before crossing borders.
What is "delete it"?
LLMs can exhibit this concerning behavior when they generate content that promotes hate speech or violence.
What is "toxic content generation"?
This company, in the US, reported a major data breach in 2017, which impacted the personal data of 148 million US citizens. As a company that handles extremely sensitive data, it came under fire due to its negligence and poor security posture.
Who is "Equifax"?
Cybercriminals often use these malicious websites that closely resemble legitimate sites to trick users into entering their credentials.
What are "phishing websites" or "phishing pages"?
Garrett often talks about this strategy, which involves ensuring attackers can't get very far even if they do exploit a vulnerability.
What is "Blast Radius"?
This threat actor was behind the MGM attack and is highly capable in cloud environments, ages 19-22, with 130 attacks in 2022
Who is "Scattered Spider"?
This security measure involves monitoring LLM-generated content in real-time to identify and block harmful outputs.
What is real-time content filtering?
In April 2022, information from over 8 million users was downloaded by a former disgruntled employee through this app, a stock trading feature accessible through the service.
What is "Cash App Investing"?
When attackers use emotional tactics to manipulate individuals into revealing sensitive information, they are engaging in this type of phishing.
What is "social engineering"?
Is produced by the following code in an web page:
<script>
console.log("</script><script>alert(1)</script>");
</script>
What is "an alert box"?
This Russian threat actor has been active since 2008.
Who is "Cozy Bear"?
One common LLM security challenge is the risk of these harmful inputs that can manipulate model behavior.
What are adversarial inputs?
In late 2016, this company learned that two hackers were able to access the names, email addresses, and mobile phone numbers of 57 million users of their app. They also got the driver's license numbers of 600,000 drivers.
Who is "Uber"?
This executive is often impersonated asking you to contact them via text in a gift card scam.
Who is "Henry"?
This cloud strategy mitigates one root or admin user having access to all services.
What is "multi-account strategy"?
Before traveling you should consult this internal resource?
What is the "Traveling" Guru card?