[ISM] LLM risk mitigation (OWASP top 10):

[OWASP] Implement strong authentication for LLM access (SSS-02-05-07)

Identification and Authentication Failures: Implement robust authentication mechanisms to verify user identities and manage sessions securely. Use multi-factor authentication (MFA) where appropriate and secure API keys for accessing LLM functionalities, ensuring only authorized users can interact with the LLM.

[OWASP] Enforce secure authentication and session management (SSS-02-05-07-01)

Integrate multi-factor authentication (MFA) to mitigate risks such as credential stuffing, brute force attacks, and credential reuse. Ensure no default credentials are deployed, especially for administrative accounts. Strengthen password security by verifying new or changed passwords against widely known weak password lists, and align password policies with NIST 800-63b guidelines for memorized secrets. Harden user registration, credential recovery, and API interactions to prevent account enumeration by using uniform response messages for all outcomes. Implement rate limiting or incremental delays for failed login attempts to counteract brute force attacks while avoiding denial-of-service risks. Log authentication failures and notify administrators of suspicious activity. Deploy a secure server-side session manager that generates high-entropy, random session IDs on login. Ensure session identifiers are stored securely, are not included in URLs, and are invalidated upon logout, timeout, or absolute expiration. These measures establish a secure foundation for user authentication and session integrity.

Operations

ID	Operation	Description	Phase	Agent
SSS-02-05-07-01-01	Implement multi-factor authentication (MFA)	Require MFA for all user accounts, particularly admin accounts, to mitigate automated attacks such as credential stuffing and brute force.	Development	Security team, Development teams
SSS-02-05-07-01-02	Enforce modern password policies	Align password complexity, length, and rotation requirements with evidence-based guidelines like NIST 800-63b, and check passwords against a known weak password list.	Development	Security team, Development teams
SSS-02-05-07-01-03	Harden authentication and recovery workflows	Prevent account enumeration attacks by standardizing error messages across registration, login, and recovery workflows, and limit failed login attempts to mitigate abuse.	Development	QA team, Security team
SSS-02-05-07-01-04	Use secure session management practices	Use server-side session management to securely handle session identifiers, invalidate them upon logout or timeout, and generate new random session IDs after login.	Deployment	DevOps team, IT operations, Security team

References

Industry framework	Academic work	Real-world case
Information Security Manual (ISM-1923) The Open Worldwide Application Security Project Top 10 (A07:2021) The Open Worldwide Application Security Project Top 10 (A07:2021)