Accelerate securely: The Generative AI Security Scoping Matrix
summary
Generative AI security centers on a five‑scope matrix: scope one: consumer apps, scope two: enterprise buy, scope three: pre‑trained models via APIs, scope four: fine‑tuned models, and scope five: self‑trained models, with most organizations focused on scopes two and three. AWS Bedrock, Guardrails for Bedrock, KMS, RAG and OWASP Top 10 for LLMs are used to assess risk. Key claims: you cannot surgically delete PII from models, fine‑tuning inherits data classification, and controls like IAM, encryption, DLP/WAF and monitoring plus SLAs and provisioning are required for resilience.
AI-written summary · about
chapters (13)
- 0:00Introduction and objectives
- 0:47Setting the stage
- 2:03Security foundations
- 5:13The scoping matrix framework
- 7:54Data flow diagram basics
- 10:44Universal security truths
- 13:31Scope 1: Consumer apps
- 18:09Scope 2: Enterprise apps
- 21:30Scope 3: Pre-trained models
- 28:35Scope 4: Fine-tuned models
- 32:02Scope 5: Self-trained models
- 33:53Conclusion and next steps
- 37:56Thank you and wrap up
related talks
27mHarnessing Generative AI: Security strategies for next-gen applications
44mGenerative AI Security — A Practical Guide to Securing Your AI Application
09mSecuring Generative AI Workloads
40mSecuring Generative AI: Is it all an Illusion?
40mSecure Your GenAI Applications
45mSecuring and Governing Generative AI: Learnings from Microsoft
27mGenerative AI for technology leaders
35mGenAI Application Security: Not Just Prompt Injection