AI-SPM (Security Posture Management) Flashcards
What are the challenges of quickly building and deploying AI-powered applications?
- Development is far outpacing security
- Black box systems
- New attack vectors
- Evolving compliance risk
Why AI model being a black box system represent a potential security challenge?
- inner workings of large AI models are often opaque, even to their creators, making it difficult to anticipate potential security and compliance issues
- difficult to anticipate potential security and compliance issues
- models may exhibit unexpected behaviors or vulnerabilities that are not easily detectable through traditional testing methods
What are the new attack vectors associated with AI?
-
Data Poisoning
- attackers introduce malicious data during the training phase of a machine learning model to corrupt its output
-
Model Inversion
- attackers use the outputs of a model to reverse-engineer and reveal sensitive information from the training data
-
Adversarial Attacks
- attackers make subtle manipulations to input data that can cause the AI model to make incorrect predictions or classifications
What is Prisma Cloud AI-SPM?
a set of capabilities designed to protect organizations against the unique
risks associated with AI, machine learning (ML), and Generative AI (GenAI) models, including data
exposure, misuse, and model vulnerabilities
What is the evolving compliance risk in the EU?
the EU AI Act imposes new requirements around data privacy, algorithmic bias, and explainable AI and raises the stakes for non-compliance, with penalties nearly double those of GDPR
How is Prisma Cloud AI-SPM integrated into Prisma Cloud?
as part of the broader Code-to-Cloud approach Palo Alto integrated AI-SPM capabilities with the Prisma Cloud security platform, while
building on existing data security posture management (DSPM), cloud security posture management
(CSPM), and cloud-native application protection (CNAPP) capabilities
What are the features and benefits of Prisma Cloud AI-SPM in terms of AI model discovery and inventory?
- Control model sprawl and shadow AI
- Prevent model misuse
- Improve governance
How does Prisma Cloud AI-SPM help in terms of controlling model sprawl and shadow AI?
it sees an inventory
of model APIs, open source models, and models deployed
on virtual machines
How does Prisma Cloud AI-SPM help in terms of preventing model misuse?
identifies who is using which model
to prevent unsanctioned model use and unauthorized use
cases
How does Prisma Cloud AI-SPM help in terms of improving governance?
it receives alerts for new model
deployments to ensure that appropriate controls are in
place
AI models are trained on vast amounts of data that may
contain sensitive or regulated data such as personally
identifiable information (PII) or trade secrets. In addition,
they can be exposed inadvertently or via adversarial
attacks. How does Prisma Cloud AI-SPM help in this case?
it helps to understand what
internal data is accessible through each deployed model
What are the features and benefits of Prisma Cloud AI-SPM in terms of data exposure prevention?
- Discover and classify training datasets
- Carry out retrieval-augmented generation (RAG) and
inference data monitoring - Analyze model interactions
How does Prisma Cloud AI-SPM help in terms of discovering and classifying training datasets?
it prevents data
poisoning and finds out if models are being trained or finetuned on sensitive data – before they are deployed
What is Retrieval-Augmented Generation (RAG)?
- an AI technique that combines retrieval of relevant information from a database or dataset with the generation of responses or outputs
- RAG systems first search through a vast amount of data to find the most relevant information and then use that information to generate more accurate and contextually appropriate outputs, such as answers to questions or content creation.
Why is RAG important?
in AI applications, especially those involving large language models, RAG improves the quality of the generated content by grounding it in actual, factual data.
