-: Hey there, Ethan here.
And this section is going to be dedicated to security
and specifically GenAI application security.
And I want to talk about the security aspects
of developing LLM applications.
So they can be agents,
they can be RAG applications, they can be both.
But there is a critical security concern which we need
to address while we develop our LLM applications.
So LLM applications are still applications
and everything we know from the application security world
is going to transfer to our LLM based applications.
However, with LLM based applications, we have a new object
that we're going to be working with,
the large language model.
Now, this new object, this large language model,
is going to receive an input text,
usually maybe some other modalities like waveforms,
like pictures, like movies,
and it's going to output us the same text,
maybe pictures, maybe movies.
And just by introducing this large language model,
we introduced a new a attack surface.
Now this attack surface is basically what's going
to be inviting the malicious actor to hack
and to do things to our system,
which is an LLM based applications.
So in this section we are going to go deep into the security
of LLM based applications.
Now, when we talk about LLM based applications,
we have two types of applications.
The first one is going to be an agentic application,
an AI agent.
And this is an LLM application where we're going
to have an LLM, which is going to function
as the decision maker, as the reasoning agent deciding
what is going to be executing later.
There are many types of agents.
We have agents that are fully autonomous, like Claude Code
for example, and there are more limited types of agents.
Usually I like to call them agentic applications,
where we as user define the flow.
But the LLM has the freedom to choose
where to go in that flow.
And in this section I'm going to discuss the new types
of vulnerabilities we have like prompt injection,
indirect prompt injection, tool hijacking,
and many more vulnerabilities which affect
LLM based applications.
And I'm going to show you the best practices of how
to develop a secure application.
So keeping this application security hygiene,
which is a strict set of rules
and architectures, which is going
to make our LLM based application secure by default.
Now I come from a cybersecurity background.
So most of my career I've been working
as a software engineer for cybersecurity companies,
specifically cloud security.
So the security world is something which is embedded in me
by nature, but I know this is not the case
for most engineers.
In fact, for most engineers, security is going
to be the last thing they want to worry about.
We are too busy trying to ship our application to production
and to ship features fast.
So the entire goal of this section is first
to show you the vulnerabilities
and what can happen when we do not develop a safe
LLM based application.
And second, I want to show you what are the best practices
and what we need to do when we develop those kinds
of applications to keep our blast radius minimum.
And for those of you who do not know,
the blast radius is when an attacker
infiltrates our system, what can they do?
Can they access our users' files?
Can they go and run malicious code?
There are a wide range of things they can do.
And our goal when we develop an application to make sure
that this blast radius is going to be as minimal
as possible, and this is what we're going
to be doing in this section.
Now I know there are going to be many new terminologies when
it comes to the security world, so I am going
to cover them as well.
And the overall goal of these sections is when you go
and develop your LLM based application, you'd go
and do it securely.