VulnerabilityGPT: Cybersecurity in the Age of LLM and AI

Presenter: Matthew Toussain
Follow Matt: / 0sm0s1z
Related Course: www.sans.org/sec460
With the rapid development of large language models (LLM) and generative AI, the landscape of cybersecurity has experienced a paradigm shift. In this one-hour webcast, we will delve into the emerging information security risks and opportunities associated with LLM and cyber deception operations. As these technologies become increasingly sophisticated, it is imperative for organizations to stay informed about potential threats and best practices in order to maintain a strong security posture.
The webcast will begin by examining the risks posed by LLM, specifically focusing on the role of AI in cyber deception operations. We will explore how threat actors are leveraging generative AI to create more convincing phishing attacks, fake news, and other malicious campaigns. Attendees will gain valuable insights into the latest trends in LLM-enabled cybercrime and the strategies required to mitigate these risks.
We will then shift to the positive impact of generative AI in the information security services industry. The discussion will demonstrate how these technologies can enhance the efficiency of cybersecurity operations and contribute to the creation of high-quality findings and reports. Attendees will learn about innovative applications of AI in threat intelligence, vulnerability management, and incident response, as well as the importance of collaboration between security professionals and AI researchers.
Join us in exploring the rapidly evolving world of AI-driven cybersecurity and arm yourself with the knowledge and strategies needed to secure your organization in the face of emerging threats. This webcast is a must-attend for information security professionals, IT managers, and anyone interested in staying ahead of the curve in the ever-changing world of cybersecurity.

[@karengomez3143]

Takeaways: GPT is making many structured relation placement between words in different levels (layers) so different inputs could bring a set of outputs, but it's not a DB, and it's not searching for patterns within a created DB. Within the GPT answers are the alignment response rules, what would be if a response is following the user's request in spite of company intent or social or compliance rules. GPT models are not that good at making a whole story or remembering a conversation, so it's not good in making novels, but it has a window response that would be good from a user's point of view aligning to their intend. Guardrails are limits or ways to make a system in place to follow alignments. Grounding as a hallucination mechanism, providing context to the user's query through a database management (large language model), so whenever the user is asking a question that needs more info about, or that is recent, the app would bring another page, just like google would retrieve twitter webpage when someone is asking for it. AI application: Scammer response generator

[@manamsetty2664]

Awesome talk 👏 Really good explanation about what AI is doing Great animations Was always engaged throughout the talk Questions need to be audible though that was the only issue

[@user-be2bs1hy8e]

This is true AI Safety, all the closed-sourced policy holders guiding the system is doing is showing the AI how to say no to end-user. I mean alignment is not a bad thing but the block box approach is just tuning models to select what human alignment is for the user.

[@karengomez3143]

Takeaways: Attacks: -Injection (silly activities could defeat an AI model, since this data is not in the training data). -Grounding (allows an AI to show false outputs, through data creation, (Search, Engine, Optimization) and then the result is shown by the AI. -Prompt Hijacking (when the context is modified by someone that does not have the authority to do it, like a user's input being treated as a developers). Exploits: -Conversation attacks to Business flaws (wrong discounts, upgrades, math) -Guardrails attacks

[@georgeb8637]

8:00 - all letters in English language 9:41 neural network 22:13 - AI confessing love 26:58 Hallucination 32:06 prompt engineering 40:53 - AI apology 😂 46:58 - Go game beat by human 54:00 - sequencing attack

[@achunaryan3418]

AAAA

[@manamsetty2664]

At the beginning of the talk i thought this was a random comment but the end made it clear.

[@rumpelstiltskin9729]

The news segments were so cringe

[@d_lom9253]

This is only helpful for a very niche crowd. If your have to protect your network or anything like that, wasting time

[@Carnyride79]

Good talk but you like to stroke your ego quite often and to say Elon doesn't know what he's talking about is a stretch

[@Peethemayan4516]

How so?

[@8starsAND]

Sans is very overrated, I don’t know how they got so big