3010 - Securing the Future - Akamai Noname Security and IBM Join Forces.pdf

《3010 - Securing the Future - Akamai Noname Security and IBM Join Forces.pdf》由會員分享，可在線閱讀，更多相關《3010 - Securing the Future - Akamai Noname Security and IBM Join Forces.pdf（31頁珍藏版）》請在三個皮匠報告上搜索。

1、 2024 Akamai|Confidential1Securing the Future:A Secure GenAI Enterprise ExperienceLuke LangfordAkamai Global Leader for IBM Advanced API Security 2024 Akamai|Confidential2“Software is eating the world.”Marc Andreessen co-author of Mosaic;co-founder of Netscape;and co-founder and general partner of A

2、ndreessen Horowitz.2024 Akamai|Confidential3OrderCoffeeOrder a CarCheck the WeatherCheck in fora flightUseMapsLog in to Social MediaMassiveAttackSurface31%of all traffic protected by Akamai is API traffic“APIs are eating the world”2024 Akamai|Confidential4APIs are Everywhere 2024 Akamai|Confidential

3、5Example BreachCompany:OptusIndustry:TelcoImpact:140M USDVulnerability:Unauthenticated,publicly exposed API EndpointExcessive Data ExposureIncrementing Customer Identifiers 2024 Akamai|Confidential6Everything is Connected 2024 Akamai|Confidential7https:/ Noname Security.All rights reserved.8Which AP

4、Is across your environments have processed PII in the past 30 days?2024 Akamai|Confidential10The Akamai API Security SolutionAPI asset inventory,change detection,network mapping,reconnaissance.DiscoveryConfiguration control,vulnerability management,remediation prioritization.Posture ManagementDetect

5、ion and prevention of attackers and suspicious behavior in real time.Runtime ProtectionSecure APIs in dev to stop vulnerabilities before production.Testing 2024 Akamai|Confidential12IBM&Akamai API SecurityNoname Security Extends the capabilities of the IBM DataPower and API Connect solutions to enab

6、le organizations to provide advanced security of APIs throughout their lifecycle.This joint solution provides comprehensive automated discovery and analysis capabilities that drive alignment with best practices and guide the remediation of API vulnerabilities.In addition,this solution enables the re

7、al-time detection and blocking of abnormal API traffic to prevent malicious behavior 2024 Akamai|Confidential13IBM&Akamai API SecurityAutomatically discover APIs,provide insights into API behavior,and ensure compliance with best practices and policies.Market-leading API Management Enterprise-grade A

8、PI runtime protectionAPI ConnectDiscoveryPostureManagementBehavioralThreat Detection Analyze,Detect,Notify&Remediate Threats with AI Discover the unmanaged APIs across your landscape Inventory&report API security postureDataPowerAkamai API Security 2024 Akamai|Confidential14IBM&Akamai API SecurityAk

9、amai API Security for IBMDataPowerAPI ConnectDiscoveryUnmanaged APIsManaged APIsComplianceTrack VulnerabilitiesRemediate Misconfigurations/VulnerabilitiesBlock attacksIdentify Configuration IssuesProtect Against Common Attacks(SQLi,XSS,CSRF,etc.)Data Protection,Rate Limiting,Authentication,Authoriza

10、tionFirewall-like Network ControlEnforce data types,rate limits,WAF rulesEnforce AuthenticationCatalogue API for reuseAPI LifecycleFunctional&Security TestsDevelopIdentify Anomalous BehaviorPosture ManagementLearn Business Logic of APIsDesign timeManagement&RuntimeAnalysis 2024 Akamai|Confidential15

11、IBM&Akamai API SecurityAutomatically discover APIs,provide insights into API behavior,and ensure compliance with best practices and policies.Securing the IBM API EcosystemFrom Discovery to ResponseInventoryUp-to-date repository of all APIs,documenting their specifications,versions,and changes over t

12、ime for better governance and controlComplianceAssessment of APIs against industry standards and regulatory requirements,providing detailed reports on compliance status and recommendations for remediationDetectionContinuously monitoring of API traffic in real-time,using advanced analytics and machin

13、e learning to detect anomalies,breaches,and potential security threatsIntegrated TestingThorough security assessments and penetration testing to identify vulnerabilities and security flaws in APIs before they can be exploitedResponseUpon detection of a security incident,automated responses triggers,

14、including alerts and intelligent mitigation actions,to quickly contain and neutralize threats.DiscoveryAutomated identification and cataloging of all APIs across the environment,including those that are undocumented or shadow APIs,to ensure comprehensive visibility213645 2024 Akamai|Confidential16IB

15、M&Akamai API SecurityCore Building BlocksSecure API Infrastructure By DesignStrong integration between Akamai API Security and IBM DataPower,API Connect and WebMethods,that embeds API security across the API lifecycle.This charter includes(1)a comprehensive DevSecOps strategy,enabling real-time API

16、testing within the SDLC to ensure secure and efficient application delivery and(2)real-time detection and prevention of any API attack.Autonomous Security OperationsThis chapter focuses on a bi-directional integration between IBM Security Services such which is enhanced with the API security insight

17、s from Akamai whereby the focus lies on security orchestration.This enables organizations to proactively manage and mitigate risks with minimal human intervention,ensuring a more resilient security postureAccelerated Adoption of Enterprise AIBy combining Watsonx,Stepzen and Akamai API Security,we ar

18、e uniquely positioned to streamline the deployment of secure GenAI and machine learning models.This is particularly impactful in the rapidly growing field of GenAI(eg.LLM).The combined strengths of IBM and Akamai in this area is to significantly reduce the time-to-market for these cutting-edge appli

19、cations,giving enterprises the edge they need in a competitive landscape.Leverage API Connect Analytics Offload or a DataPower policyDataPowerFirewall/Load BalancerAPI GatewayML Policy Decision PointPOST Protection Rules to Akamai prevention pluginfor DataPower gateways not yet managed by IBM API Co

20、nnect API Definitions and App DetailsAPI Connect:API ManagerAPI Connect AnalyticsAnalytics Records&GET protection rulesAkamai Advanced API Security Integration ProfileAkamai Advanced API Security PolicyConsumerSOAP APIsREST APIsAPI Connect EssentialsPOST protection rules to DataPower gatewaysmanaged

21、 by IBM API Connectpost threat intelligence 2024 Akamai|Confidential19Generative AI There is no AI without APIsHow might AI impact cyber security?-Lowers barriers for bad actors-More sophisticated and personal-Malicious imposters and deepfakes-Attacks on the systems themselvesThe Bad News:2024 Akama

22、i InputsMachineLearningDeepLearningFoundationModel(LLM)OutputsSimpleSimpleInputsOutputsComplexComplexInputsOutputsComplexComplexAll AI is powered by ML Models 2024 Akamai APIs are at the heart of every step in the LLM lifecycleData Preparation and PreprocessingThe foundation of an effective LLM lies

23、 in the careful preparation of its training data.This initial phase ensures that the model has access to a diverse and high-quality dataset,setting the stage for its ability to understand and generate nuanced,contextually relevant text.APIs significantly streamline this process by enabling the autom

24、ated collection and integration of several data sources,ensuring a rich and comprehensive dataset.Training and Model DevelopmentThrough advanced algorithms and transformer architectures,LLMs learn from their training data,acquiring a deep understanding of language patterns and contexts.This phase is

25、 both computationally intensive and critical,as it determines the models baseline capabilities.GraphQL,with its efficient data querying capabilities,enhances this process,particularly during the learning phase of LLMs.By facilitating precise and flexible data retrieval,GraphQL ensures that LLMs can

26、be trained and fine-tuned with optimal efficiency,streamlining the data handling process and accelerating model development.Fine-Tuning for Specific TasksPost-training,LLMs undergo a fine-tuning process,where they are further trained on specialized datasets to excel in specific tasks or industries.T

27、his customization allows LLMs to provide tailored solutions,enhancing their applicability andperformance in niche domains.APIs play a key role in this phase by facilitating the integration of custom datasets and enabling dynamic adjustments to the process,allowing for efficient customization of mode

28、ls to meet specific needs.DeploymentThe deployment of LLMs occur typically through APIs since this simplifies their integration into existing systems,allowing businesses to leverage their capabilities without extensive expertise in machine learning.APIs serve as a bridge,making the power of LLMs acc

29、essible for a wide array of applications.SLIDE NEEDS TO BE UPDATED WITH DIAGRAM 2024 Akamai The Integral Role of APIs in LLMsThe LLM LifecycleData Preparation and PreprocessingEffective LLMs require carefully prepared,diverse training data,which APIs help streamline.Training and Model DevelopmentLLM

30、s learn language patterns from training data,aided by GraphQL for efficient data retrieval.Fine-Tuning for Specific TasksPost-training,LLMs are fine-tuned on specialized datasets,with APIs aiding customization.DeploymentLLMs are typically deployed via APIs for easy integration and accessibility.2024

31、 Akamai|Confidential24The Rise of AI Top security risks when using GenAI based applicationsExternal GenAIAPI attacks are a great concern for GenAI such as LLMs.Organizations without the resources or expertise to build their own large language models(LLMs)rely on APIs to consume the capabilities of p

32、repackaged,pretrained models.Attackers recognize this will be a major consumption model for LLMs and will look to target the API interfaces to access and exploit data being transported across the APIs.Data PrivacyAPIs are the primary channel through which data is exchanged between the enterprise sys

33、tems and the AI services.If not properly secured,these APIs can become a point of leakage for sensitive data.This includes personal identifiable information(PII),proprietary business information,and other confidential data.AI Model IntegrityData models can be manipulated or poisoned by feeding them

34、incorrect or biased data,leading to flawed outputs.If an API allows unfiltered data to be fed into the model,it can compromise the integrity of the models responses.2024 Akamai|Confidential26API Security is a foundational pillar of Enterprise GenAIAkamai API Security-Continuous API Security Detectio

35、n&PreventionGraphQL Specific Security ControlsAutomated Data Flow DiscoveryZero Touch BlockingSecure InfrastructurePrompt InjectionCrafty inputs can manipulate a Large Language Model,causing unintended actions.Direct injections overwrite system prompts,while indirect ones manipulate inputs from exte

36、rnal sourcesLLM01LLM02LLM03LLM04LLM05Insecure Output HandlingTraining Data PoisoningModel Denial of ServiceSupply Chain VulnerabilitiesThis vulnerability occurs when an LLM output is accepted without scrutiny,exposing backend systems.Misuse may lead to severe consequences like XSS,CSRF,SSRF,privileg

37、e escalation,or remote code executionThis occurs when LLM training data is tampered,introducing vulnerabilities or biases that compromise security,effectiveness,or ethical behavior.Sources include Common Crawl,WebText,Open WebText,&booksAttackers cause resource-heavy operations on Large Language Mod

38、els leading to service degradation or high costs.The vulnerability is magnified due to the resource-intensive nature of LLMs and unpredictability of user inputsLLM application lifecycle can be compromised by vulnerablecomponents or services,leading to security attacks.Using third-party datasets,pre-

39、trained models,and plugins can add vulnerabilitiesAnomalous Behavior DetectionPrevent Releasing Unsecure CodeAPI Specific Threat ModelingAutomated API PenTesting111243553 2024 Akamai|Confidential27API Security is a foundational pillar of Enterprise GenAISensitive Information DisclosureLLMs may revea

40、l confidential data in its responses,leading to unauthorized data access,privacy violations,and security breaches.LLM06LLM07LLM08LLM09LLM10Insecure Plugin DesignExcessive AgencyOverrelianceModel TheftLLM plugins can have insecure inputs and insufficient access control.This lack of application contro

41、l makes them easier to exploit and can result in consequences like remote code executionLLM-based systems may undertake actions leading to unintendedconsequences.The issue arises from excessive functionality,permissions,orautonomy granted to the LLM-based systemsSystems or people overly dependent on

42、LLMs without oversight may face misinformation,miscommunication,legal issues,and security vulnerabilities due to incorrect or inappropriatecontent generated by LLMsThis involves unauthorized access,copying,or exfiltration of proprietary LLM models.The impact includes economic losses,compromised comp

43、etitive advantage,and potential access to sensitive informationAkamai API Security-Continuous API Security Detection&PreventionGraphQL Specific Security ControlsAutomated Data Flow DiscoveryZero Touch BlockingSecure InfrastructureAnomalous Behavior DetectionPrevent Releasing Unsecure CodeAPI Specifi

44、c Threat ModelingAutomated API PenTesting76108976 2024 Akamai|Confidential28Secure Enterprise AIProblem Statement#1An enterprise uses a Watsonx based application.The compliance and security team has no visibility into the processed data that is being shared with an external party(eg.IBM)SolutionInte

45、grate Akamai API Security to monitor the data flowing in and out of WatsonxDemo SetupPostman interacting with Watsonx Assistant powered applicationAkamai API Security Attack Surface Management Catalog identifying data objectsAkamai API Security Detection&Response identifies forbidden objects,reports

46、 and blocks the user 2024 Akamai|Confidential29Secure Enterprise AIProblem Statement 2IBM Cloud can be at risk for a supply chain attack due to lack of security controls by the organisation interacting with Watsonx.(eg.Prompt Injection)SolutionIntegrate Akamai API Security into Watsonx for proper de

47、tection and responseDemo SetupPostman interacting with Watsonx Assistant powered applicationMalicious payloads are planted in Watsonx 2024 Akamai|Confidential30Akamai API SecurityExponential value to our customersProtect APIs across all environmentsStop API vulnerabilities before they reach producti

48、onAccelerate API threat remediation 2024 Akamai|Confidential31Customer Success Stories|What can you expect with Akamai API security?One of the worlds leading manufacturers of cars,trucks,buses,and construction equipment deployed Akamai API Security(Noname)to automate the discovery and security asses

49、sment of their APIs and recognized a reduction in overall costs thanks to the elimination of security point tools and development overhead.Automotive ConglomerateA convenience store chain with over 84,000 stores in 19 countries used Akamai API Security(Noname)to identify and document the movement of

50、 sensitive data,remediated API misconfigurations and vulnerabilities,and deployed API testing as part of the broader software development lifecycle to eliminate vulnerabilities in the production environment.Retail Store ChainOne of the worlds largest telecommunications companies used Akamai API Secu

51、rity(Noname)to discover over 100,000 APIs over three cloud environments,reduced the attack surface by removing hidden vulnerabilities,and protected APIs handling sensitive information.Mobile Network Operator 2024 Akamai|Confidential32Ask yourself truthful questions1.How well do you know your APIs an

52、d their behavior?2.Can you spot a malicious behavior in your APIs and automatically prevent it?3.During CI/CD,are API security tests performed?4.Can you detect and prevent against the top 10 OWASP API vulnerabilities?2024 Akamai|Confidential33Protect your APIs in minutesGet Akamai API Security deployed in minutes,today!https:/ Discover all APIs,domains,and related issues for these API types Automatically stop API attacks in real time Fully integrate with existing CI/CD pipelines 2024 Akamai|Confidential34Thank you 2024 Akamai|Confidential35