最后更新于2023年12月22日(星期五)16:00:00 GMT

It’s been little over a year since ChatGPT was released, 和 oh how much has changed. Advancements in 人工智能 和 机器学习 have marked a transformative era, 影响着我们生活的方方面面. These innovative technologies have reshaped the l和scape of natural language processing, enabling machines not only to underst和 but also to generate human-like text with unprecedented fluency 和 coherence. 随着社会接受这些进步, the implications of Generative AI 和 LLMs extend across diverse sectors, from communication 和 content creation to education 和 beyond.

With AI service revenue increasing over six fold within five years, it’s not a surprise that cloud providers are investing heavily in expanding their capabilities in this area. Users can now customize existing foundation models with their own training data for improved performance 和 customer experience using AWS’ newly released Bedrock, Azure OpenAI服务和GCP Vertex AI.

Ungoverned Adoption of AI/ML Creates Security Risks

预计市场价值将超过1美元.到2030年达到8万亿美元, AI/ML continues to play a crucial role in threat detection 和 analysis, 异常与入侵检测, 行为分析, 事件响应. It’s estimated that half of organizations are already leveraging this technology. In contrast, only 10% have a formal policy in place regulating its use.

Ungoverned adoption therefore poses significant security risks. A lack of oversight through Shadow AI can lead to privacy breaches, 不遵守规定, 有偏见的模型结果, 造成不公平或歧视性结果的. Inadequate testing may expose AI models to adversarial attacks, 和 the absence of proper monitoring can result in model drift, 随着时间的推移影响性能. 越来越普遍的, security incidents stemming from ungoverned AI adoption can damage an organization's reputation, 侵蚀客户信任.

Safely Developing AI/ML In the Cloud Requires Visibility 和 Effective Guardrails

为了解决这些问题, organizations should establish robust governance frameworks, 包括数据保护, 偏见减轻, 安全评估, 和 ongoing compliance monitoring to ensure responsible 和 secure AI/ML implementation. Knowing what’s present in your environment is step 1, 和 we all know how hard that can be.

InsightCloudSec has introduced a specialized inventory 页面 designed exclusively for the effective management of your AI/ML assets. 包含各种各样的服务, spanning from content moderation 和 translation to model customization, our platform now includes support for Generative AI across AWS, GCP, 和Azure.

Once you’ve got visibility into what AI/ML projects you have running in your cloud environment, the next step is to establish 和 set up mechanisms to continuously enforce some guardrails 和 policies to ensure development is happening in a secure manner.

Introducing Rapid7’s AI/ML Security Best Practices Compliance Pack

We’re excited to unveil our newest compliance pack within InsightCloudSec: Rapid7 AI/ML Security Best Practices. The new pack is derived from the OWASP Top 10 Vulnerabilities for 机器学习, OWASP排名前十的法学硕士, 以及其他针对csp的建议. 有了这个包, you can check alignment with each of these controls in one place, enabling a holistic view of your compliance l和scape 和 facilitating better strategic planning 和 decision-making. Automated alerting 和 remediation can also be set up as drift detection 和 prevention mechanisms.

This pack introduces 11 controls, centered around data 和 model security:

The Rapid7 AI/ML Security Best Practices compliance pack currently includes 15 checks across six different AI/ML services 和 three platforms, with additional coverage for Amazon Bedrock coming in our first January release.

For more information on our other compliance packs, 和 leveraging automation to enforce these controls, 查看我们的 文档 页面.