Cyber Security Shots

Amazon

1. Supply chain security improved with package group in AWS codeArtifact. It can be applied against patterns like format, namespace and configure origin control (Allow or Block) of ingestion or publish new packages (Link)

Across Cybersecurity Industry

1. SonarQube is introducing SBOM Manager
2. Fujitsu spills customer data (Data Leak)
3. SQL Injection vulnerability (CVSS 9+) in FortiClientEMS  released on March 12th

Topic for the week

Prompt Injection

1. It is the Top threat in OWASP LLM Top 10. Manipulating LLM Model to perform tasks against its goal/objective by inserting malicious prompt.
2. There are two types of prompt injection
   1. Direct prompt injection, Providing prompts directly to LLM
   2. Indirect prompt injection, Providing prompts indirectly via Datasource, that are hidden.
3. Causes
   1. Input validation
   2. LLM Design/architecture
4. Mitigation
   1. Proper inputs validation and filtering.
   2. Monitoring inputs/output of the LLM Models.
   3. Monitor for anomaly prompt
   4. Defining trust boundary,
   5. Least Privilege model depending on the type of the tasks to be formed (Example user inputs prompt and prompts that can insert data to the model)