CloudNativeSecurityCon North America 2024

While AI presents an opportunity to innovate across domains, we are learning that it also presents unknown threat vectors that are constantly evolving. So what does threat-modeling look like for today's AI apps? OWASP LLM risks or MITRE ATLAS framework are emerging that list attack TTPs for AI apps. However these are baseline frameworks that need to be customized to each organization's needs. Furthermore, secure behavior of AI apps needs continuous verification as they're built on top of 3rd party models which are untrusted black boxes, but are deeply plugged into organizational data, IP, and internal APIs - highlighting the need to add threat modeling as part of an AI app’s CI/CD vs doing it infrequently. This talk will describe how to automate threat modeling for AI apps using Secops-Chaos- an open source framework that helps encode TTPs as security focused experiments, with hands-on demos of how to map some of the MITRE ATLAS TTPs to AI apps running within Kubernetes environments.