The rapid integration of Large Language Models (LLMs) across diverse sectors
has marked a transformative era, showcasing remarkable capabilities in text
generation and problem-solving tasks. However, this technological advancement
is accompanied by significant risks and vulnerabilities. Despite ongoing
security enhancements, attackers persistently exploit these weaknesses, casting
doubts on the overall trustworthiness of LLMs. Compounding the issue,
organisations are deploying LLM-integrated systems without understanding the
severity of potential consequences. Existing studies by OWASP and MITRE offer a
general overview of threats and vulnerabilities but lack a method for directly
and succinctly analysing the risks for security practitioners, developers, and
key decision-makers who are working with this novel technology. To address this
gap, we propose a risk assessment process using tools like the OWASP risk
rating methodology which is used for traditional systems. We conduct scenario
analysis to identify potential threat agents and map the dependent system
components against vulnerability factors. Through this analysis, we assess the
likelihood of a cyberattack. Subsequently, we conduct a thorough impact
analysis to derive a comprehensive threat matrix. We also map threats against
three key stakeholder groups: developers engaged in model fine-tuning,
application developers utilizing third-party APIs, and end users. The proposed
threat matrix provides a holistic evaluation of LLM-related risks, enabling
stakeholders to make informed decisions for effective mitigation strategies.
Our outlined process serves as an actionable and comprehensive tool for
security practitioners, offering insights for resource management and enhancing
the overall system security.

利用 OWASP 风险评估方法，通过场景分析确定潜在威胁者并将系统组成部分与漏洞因素进行映射，从而评估网络攻击的可能性，并进一步进行综合影响分析以得出威胁矩阵，以提供对 LLM 相关风险的全面评估，帮助利益相关者制定有效的缓解策略。