Avoiding Common Design and Security Mistakes in Cloud AI/ML Environment
summary
Covers concrete cloud mistakes and fixes: how Jupyter notebooks with excessive service-account privileges let attackers exfiltrate training data, why to treat models as code+data and maintain an ML bill of materials, and how to use AWS SageMaker metrics and Azure interaction logs to detect data drift and prompt-poisoning. Recommends vector‑DB compartmentalization, DLP on inputs, query validation, signed models for edge devices, and model cards for auditing — pragmatic, vendor‑agnostic controls you can apply tonight.
AI-written summary · about
chapters (14)
- 0:00AI/ML security challenges
- 2:21ML operations lifecycle mistakes
- 7:54Shared responsibility in AI
- 11:24AI misconfigurations detection
- 15:31Identity access for ML security
- 17:47Securing in-house ML models
- 21:34Training data and augmented generation
- 25:55Monitoring model performance
- 31:57Q&A on input/output security and GDPR compliance
- 36:46Vendor security reviews for AI
- 41:13Open source licensing risks
- 43:20Developer training for AI security
- 44:28LLM input/output security
- 46:02Closing remarks
related talks
37mSecure By Design: Architecting cloud and AI workloads from the perspective of infosec
31mSecurity Considerations for Services Using AI Models
01h 01mSecure AI: Integrating OWASP Principles in Machine Learning Model Development
26mRunning Secure AI/ML Experiment in a Unified MLOPS-DevSecOps Pipeline
45mKeeping Your AI/ML Data Secure
36mAvoiding 5 missteps that undermine your AI readiness and success
28mSecuring AI by design
12mSecuring AI-Driven Finance