[ISM] LLM risk mitigation (OWASP top 10):

[OWASP] Maintain up-to-date LLM inventories (SSS-02-05-06)

Maintain an up-to-date inventory of all LLM-related components, including libraries, frameworks, and dependencies. Regularly scan for vulnerabilities, subscribe to security alerts, and apply patches promptly. Ensure that any third-party components used in the LLM are compatible with secure versions and tested for security compliance.

[OWASP] Establish comprehensive patch and dependency management (SSS-02-05-06-01)

Develop and maintain a robust patch management process to address vulnerabilities and ensure component security. Remove unused dependencies, components, and documentation to minimize attack surfaces. Use tools like OWASP Dependency Check or software composition analysis tools to inventory and monitor both client-side and server-side components for vulnerabilities. Leverage sources like the Common Vulnerabilities and Exposures (CVE) database and the National Vulnerability Database (NVD) for updates. Only procure components from verified, secure sources, preferring signed packages to mitigate risks of tampered or malicious files. Actively monitor for unmaintained or unsupported libraries, prioritizing the replacement of outdated dependencies. If patching is not feasible, employ virtual patching mechanisms to detect, monitor, and protect against known issues. Regularly update this inventory and associated processes to maintain system integrity and security.

Operations

ID	Operation	Description	Phase	Agent
SSS-02-05-06-01-01	Inventory and monitor component versions	Continuously inventory all client-side and server-side components, including their dependencies, and monitor for vulnerabilities using tools like OWASP Dependency Check.	Development	Security team, Development teams
SSS-02-05-06-01-02	Establish a risk-based patch management process	Implement a patching process that prioritizes updates based on risk severity, ensuring timely application of patches or deployment of virtual patches for unmaintained components.	Deployment	DevOps team, Security team
SSS-02-05-06-01-03	Remove and replace unused or unmaintained components	Regularly identify and remove unused dependencies, features, or components. Replace outdated or unsupported libraries with actively maintained alternatives.	Development	Development teams, QA team
SSS-02-05-06-01-04	Automate vulnerability scanning and subscription alerts	Use tools like Dependabot for automated alerts on vulnerable dependencies and integrate updates into CI/CD pipelines.	Post-deployment	Security team, Risk management team

References

Industry framework	Academic work	Real-world case
Information Security Manual (ISM-1923) The Open Worldwide Application Security Project Top 10 (A06:2021) The Open Worldwide Application Security Project Top 10 (A06:2021)