Launching my AI Web Security Lab — Here’s Why I’m Building It
Categories:
#ai
#cloud
#security
Tags:
#python
#fast api
Securing an AI Wrapper requires a multifaceted and hybrid approach — that can be implemented in many different ways.
This article will not be a comprehensive guide to securing your AI wrapper but rather an overview of general principles.
This project serves as the intersection between 3 areas of interest for me — scalable cloud computing, cyber security, and artificial intelligence. The goal is to implement the product and the testing methodology required to secure it.
The success of the project hinges on the completion of the following objectives:
[Front-end] HTML / JS[Back-end] Fast API[Authentication] AWS Cognito[AI Framework] Amazon Bedrock[Conversations] Amazon RDS[Files] Amazon S3[Deployment] AWS Cloud Formation[Open Source Model] Llama v3[SQL] SQLmap[Endpoints] Nikto[Web Interface] BurpSuite[Web Interface] ZAPThe front-end, and back-end of the application will feature basic components such as authentication, input fields, and file submission. The point of the exercise is not to stress test new and complex web features, but rather to expose basic and common features that are frequently exploited by attackers.
Cloud deployments can often be complex, and just like with web development there is no one-size-fits-all approach or common standard used in the industry. Instead, this project will focus on using features native to the cloud environment, such as infrastructure as code, micro services and managed products that will both streamline development and showcase built-in security features.
The choice of AI model is the least important aspect of this project, and rather the focus is on building a system where the AI model can be swapped in and out as models improve, and increasingly become a commodity.
The testing toolkit will grow over time as the project matures to include testing of the cloud infrastructure, the web component, and various aspects of MITRE ATLAS for AI model hardening.
And you don’t need to memorize how binary search works
