Aggregator

Policy Shift Allows Military Contractors, Security Agencies Access to Its AI Model
Meta revised its policy to permit U.S. defense contractors and national security agencies to use its AI model, Llama, previously restricted from military applications, announcing that it has partnered with firms including Lockheed Martin and Palantir.

Dunnhumby CISO on Building Resilience and Tackling Transformation
Martyn Booth has found that leadership means resilience, adaptability and fostering a collaborative, diverse team. Leading transformation efforts at global customer data science firm Dunnhumby, Booth stressed the value of having a strong foundation and strategic partnerships.

充分发挥双方优势，共赢商机，蒸蒸日上。

欢迎预约直播，看金融机构如何应对电信网络诈骗？

在 GIMP 3.0 RC1 发布之后，正式版何时发布？开发者表示这取决于 RC1 需要处理的 bug/问题数量。因此 GIMP 项目没有给出正式版何时发布的日期预估，开发者只是表示正式版本将在他们认为软件足够稳定之后到来。而对于未来发布的小更新版本，开发者有一个预期时间：GIMP 3.0 正式发布一年内推出 3.2。这一时间表是旨在更快向用户提供小功能更新，不再让更新拖太久。从 GIMP 2.0 到 3.0，项目经历了超过 20 年的时间。开发者也不想到 2050 年发布下一个版本。

新闻速览 •全面升级联邦机构数字安全，美国政府将出台新版网络安全行政令 •强化云服务安全，Google &nb […]

在数字经济发展的大背景下，数据已成为企业的重要资产。一旦发生泄露，不仅会影响企业的正常经营，导致经济损失，还可 […]

Бизнесмен выделил более $119 млн на переизбрание кандидата.

近日，麒麟软件安全生态联盟2024年第三次工作会议顺利举行。麒麟软件安全生态联盟由工业和信息化部网络安全产业发 […]

Why I Only Bet On Those Who Bet On ThemselvesThis exact week, three years ago, I sat in two very di

游戏开发人员兼白帽 Sean Kahler 发现了一个影响 Electronic Arts （EA） 帐户系统的漏洞。

In our previous article, we demonstrated how sensitive information (PII/PHI) can be retrieved from

A vulnerability was found in WP Booking Calendar Plugin up to 10.6.2 on WordPress. It has been classified as problematic. This affects an unknown part of the component Setting Handler. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-10027. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in chaser324 Featured Posts Scroll Plugin up to 1.25 on WordPress and classified as problematic. Affected by this issue is some unknown functionality of the component Setting Handler. The manipulation leads to cross-site request forgery. This vulnerability is handled as CVE-2024-10922. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in Tenda O3 1.0.0.5 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Network Packet Handler. The manipulation leads to denial of service. This vulnerability is known as CVE-2024-51409. The attack can be launched remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in martinvonz jj up to 0.22.x. Affected is an unknown function of the component Git Repository Handler. The manipulation leads to path traversal. This vulnerability is traded as CVE-2024-51990. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Portabilis i-Educar 2.8.0. This issue affects the function getDocuments of the file /module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id. The manipulation of the argument instituicao_id leads to sql injection. The identification of this vulnerability is CVE-2024-48325. The attack may be initiated remotely. There is no exploit available.

A Critical Guide to Securing Large Language Models
madhav
Thu, 11/07/2024 - 06:25

Securing large language models (LLMs) presents unique challenges due to their complexity, scale, and data interactions. Before we dive into securing them, let’s touch on the basics.

• What are LLMs? LLMs are Large Language Models that are advanced artificial intelligence systems designed to understand and generate human-like text.
• How popular are LLMs? Incredibly, as they generate text, images, answer questions, and write creative content for you.
• How do businesses use LLMs? They enhance customer service, create content, summarize research, analyze large datasets, and translate languages.

Securing LLMs is critical as they are trained on massive datasets that contain sensitive information. Protecting LLMs from unauthorized access or misuse is vital.

The Thales Solution for LLM Security

• CTE agent: The CTE (CipherTrust Transparent Encryption) agent is a software component installed at the kernel level on a physical or virtual machine. It encrypts and protects data on that machine. Once installed, the CTE agent enables encryption for any number of devices or directories on the machine, ensuring that only authorized users and processes can access the encrypted data at file system level transparent to the application.
• CTE-U agent: The CTE-U (CipherTrust Transparent Encryption UserSpace) agent is a user-space level encryption solution that serves the same fundamental purpose, as the CTE agent. Unlike the CTE agent, the CTE-U agent operates at the user-space level.

What is CipherTrust Transparent Encryption?

CipherTrust Transparent Encryption (CTE), is part of the CipherTrust Data Security Platform (CDSP) which delivers data-at-rest encryption with centralized key management, privileged user access control and detailed data access audit logging. Protecting data wherever it resides, on-premises, across multiple clouds and within big data, and Kubernetes environments. The deployment is simple, scalable, and fast, with agents installed at operating, filesystem or device layer, and encryption and decryption are transparent to all applications that run above it. CipherTrust Transparent Encryption is designed to meet data security compliance and best practice requirements with minimal disruption, effort, and cost. Implementation is seamless keeping both business and operational processes working without changes even during deployment and roll out. The solution works in conjunction with the FIPS 140-2 up to Level 3 compliant CipherTrust Manager, which centralizes encryption key and policy management for CDSP.

Benefits of CipherTrust Transparent Encryption

Simplified Management: CipherTrust Manager provides a unified management console that enables you to discover and classify sensitive data and protect data using integrated Thales Data Protection Connectors across on-premises data stores and multi-cloud deployments. It offers advanced self-service licensing for improved visibility and control of licenses.

Cloud-friendly Deployment: CipherTrust Manager offers users additional hosting options, and can run as a native virtual machine on AWS, Microsoft Azure, Google Cloud, VMware, Microsoft HyperV and more. Additionally, native support for CipherTrust Cloud Key Management is available on CipherTrust Manager to streamline key management across multiple cloud infrastructures and SaaS applications.

Flexible Form Factors:

CipherTrust Manager is available in both virtual and physical form factors. Flexible deployment options can easily scale to provide key management at remote facilities or in cloud infrastructures. CipherTrust Manager supports managing keys in the FIPS 140 L3 boundary of Luna Network HSM.

Protect LLMs with Thales

To Protect LLMs, the Thales CipherTrust Data Security Platform with Transparent Encryption is used, whereas enterprises can leverage Thales’ advanced data protection features within the CipherTrust platform. Thales is a trusted brand in the LLM Security Industry. View our comprehensive White Paper for information on LLM Security. We'll continue to innovate with LLM Security and continue publishing updates in future articles.

Data Security Compliance Encryption Key Management Cloud Security

Doug Bies | Product Marketing Manager
More About This Author > Schema {
"@context": "https://schema.org",
"@type": "BlogPosting",
"headline": "A Critical Guide to Securing Large Language Models",
"description": "Explore the complexities of securing large language models (LLMs) and learn how Thales’ CipherTrust Transparent Encryption (CTE) provides advanced protection for sensitive data and compliance across cloud and on-premises environments.",
"datePublished": "2024-11-07",
"author": {
"@type": "Person",
"name": "Doug Bies",
"url": "https://cpl.thalesgroup.com/blog/author/dbies",
"sameAs": "https://www.linkedin.com/in/doug-bies-440487a/"
},
"publisher": {
"@type": "Organization",
"name": "Thales Group",
"description": "The world relies on Thales to protect and secure access to your most sensitive data and software wherever it is created, shared, or stored. Whether building an encryption strategy, licensing software, providing trusted access to the cloud, or meeting compliance mandates, you can rely on Thales to secure your digital transformation.",
"url": "https://cpl.thalesgroup.com",
"logo": "https://cpl.thalesgroup.com/sites/default/files/content/footer/thaleslogo-white.png",
"sameAs": [
"https://www.facebook.com/ThalesCloudSec",
"https://www.twitter.com/ThalesCloudSec",
"https://www.linkedin.com/company/thalescloudsec",
"https://www.youtube.com/ThalesCloudSec"
]
},
"mainEntityOfPage": "https://cpl.thalesgroup.com/blog/data-security/securing-large-language-models"
}

basic

The post A Critical Guide to Securing Large Language Models appeared first on Security Boulevard.

A vulnerability was found in HP ArcSight SmartConnectors up to 7.1.5. It has been rated as critical. Affected by this issue is some unknown functionality of the component X.509 Certificate Chain Validation. The manipulation leads to cryptographic issues. This vulnerability is handled as CVE-2015-2902. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

WebSenor InfoTech Sql Injection*********************************************************#Exploit