Welcome to today's session. We will explore the detection protect feature of Cisco AI defense. This session will focus on the runtime pillar that forms part of the protect strategy. Our goal is to provide a detailed understanding of how Cisco's AI defense mechanism operates to save.00:04Guard applications from potential threats during runtime.00:20Let's get started. Let's begin by outlining today's agenda, which includes three key components. 1st, an explanation of what is runtime, where we will delve into its function as a SaaS service. It acts as an intermediary layer of protection for generative AI applications sitting between the user and the AI model.00:22Next, we will go through the process of setting up a runtime environment, emphasizing its enforcement modes, inspection API and application gateway. Finally, we'll discuss where to see results, illustrating how to monitor policy violations efficiently. Our focus will be on understanding and implementing guardrail policies through Cisco AI defense.00:42To start setting up the runtime, we need to access the Cisco Security Cloud control, a unified platform that provides centralized management for Cisco security solutions. This platform offers a consolidated view and simplified operations. Open your browser and type the URL.01:02HTTPS colon/slash security.cisco.com. Once you're on the platform, select your organization and region. This foundational step allows you to manage all subsequent security configurations effectively. Let's proceed by selecting the organization. Now that we're logged into the Cisco Security Cloud control.01:17The next step is to navigate to AI defects, which can be found under the products category in the left pane. This section will house all the AI defensive measures we're going to put in place. The focus here is on establishing a robust security framework using the sophisticated tools provided by Cisco.01:37Please ensure you click on AI defense to continue. In this step, click on applications from the left pane of the AI defense section. This will lead us to the dashboard where we can manage all associated applications and connections. It's crucial to understand this framework as it presents a comprehensive view of protection status.01:53Indicating which applications are safeguarded and which are pending protections. Let's explore the applications tab to solidify our setup. On this screen, you'll notice two main tabs, applications and connections. This is where you can track the status of your applications, whether they are active, pending or disconnected.02:11It's important for managing the flow of data and identifying potential issues quickly. Take a moment to familiarize yourself with these tabs as they provide vital diagnostic information. Next, we're going to add an application. Locate and click the plus add application button on the upper right side.02:30This functionality allows you to integrate and secure new applications using the AI defense runtime. By doing so, you ensure that every application has the necessary protections consistent with your established policies. Let's proceed to add an application.02:48In the add application pop up, enter the name of your application. E.g., Domo. Here, you will also determine the connection type, which can be either API or gateway. Choosing API indicates that your application will be responsible for processing AI defense responses and making decisions on traffic.03:04Click continue to advance to the next step, where we detail connection specifics. You are now on the API connections page. To proceed, click add connection in the upper right corner. You will configure the data plane, which could be either the Cisco AI defense SaaS or a private connector.03:20This setup is integral, as it dictates how your traffic is monitored and controlled for compliance with security policies. Let's go ahead and add a connection. Here, finalize your connection setup by naming the connection such as Domo and selecting the appropriate data plane.03:37After filling in these fields, click add connection to establish the link. This step ensures that your application is securely integrated with the AI defense infrastructure, allowing you to enforce security measures effectively. In this step, you will create an API key necessary for your application. Start by assigning a name to the API key.03:53You can also set an expiration date of desired, though choosing never expires is an option here. Click on generate API key to proceed. Once generated, ensure you copy the API key immediately and follow your company's best practices for API management as you won't be able to view or recover it later.04:13If the key is lost, you'll have the option to edit the connection and regenerate it. Click done to complete this step, focusing on security and proper handling of the API key. Now, let's explore the gateway deployed AI defense, which serves as a proxy between users and your AI application.04:29This setup monitors all traffic and logs in an event every time a policy is triggered. You can enforce custom rules to block or allow specific prompts and responses ensuring secure interactions. This process is similar to the API method except here, you select gateway under the connection type.04:47Remember to click continue once you've made your selection. Here, you will set up a new connection by naming it, selecting the appropriate data plane and choosing an endpoint. Once you've input these details, click add connection to establish the secure link.05:03This step is crucial for ensuring that your application communication is both secure and monitored according to your established security parameters. In this stage, click add endpoint to proceed with the setup. You need to select your model provider, e.g., an external model.05:18And input the specific AI model URL used by your AI application. This setup is essential for integrating your application with the necessary external models enabling effective monitoring and control. Upon adding connections, check the status displayed on the dashboard.05:35Initially, you'll see a purple status labeled pending. This status indicates that the connections need an initial inspection. Once this inspection is complete, the status will turn blue, reading connected, signifying successful integration and monitoring setup. Let's move forward by discussing how AI defense runtime utilizes.05:52Internal language classification models.06:12These models analyze both incoming and outgoing text related to the protected large language models. They are designed to detect potential security risks such as prompt injection attempts and toxic content. To implement this, navigate to secure on the menu and then select runtime policies to continue reinforcing the security measures in place.06:14To begin creating a new policy, click on create policy as displayed on the dashboard. AI defense runtime's language classification models will use this policy to scrutinize text and identify potential security threats like prompt injection or inappropriate content enhancing protection for your applications.06:34Once more, initiate the creation of a policy by selecting create policy at the top right of the screen. This step is critical for setting up rules that AI defense runtime will follow to analyze textual data, ensuring the integrity and security of interactions with llmiss.06:53Now, you will define your policy by providing a name and optionally a description. Once you've entered these details, click next to proceed. This step allows you to configure language rules that align with your organizational requirements ensuring you apply suitable guardrails to your AI interactions.07:10Here, you will define security guardrails. These include rules for preventing prompt injection, detecting malicious code, blocking dangerous URLs, and preventing tool exploitation. Each of these rules is crucial for protecting against unauthorized access and maintaining model integrity.07:28You have the option to enable advanced configurations to set specific threat levels and content categories for URLs. Once you have configured the rule settings as needed, proceed by clicking next to finalize your security policy. In this slide.07:43We will discuss the privacy rules embedded within Cisco AI defense, which utilize predefined regular expressions or regexs to identify private information at the application endpoint. These rules are crucial for detecting sensitive information, which can be categorized into three main areas.07:58Firstly, personally identifiable information or PII, which includes identifiers like names, addresses, and phone numbers. Secondly, protected health information often referred to as PHI, which pertains to data identifying an individual's health conditions or healthcare payments. Lastly.08:14There's payment card industry or PCI data involving payment card numbers and related financial details. These privacy rules are essential to prevent unauthorized disclosure and leakage of sensitive data in both AI and cloud environments. You can enable or disable these privacy rules using the toggles on the right.08:31Allowing for flexible configuration according to your needs. Now, let's talk about the safety guardrails provided through Cisco AI defense, which utilize language classification models. These models predict potential safety rule violations from user inputs or model responses designed to prevent harmful language and content.08:48These guardrails cover categories such as toxic content, hate speech, harassment, and other types of unsafe interactions that can cause reputational, societal or financial harm. Additional categories include profanity, sexual content, and exploitation, and messages promoting social division or violence. You have the option to enable or disable these rules for.09:07Via toggles. Furthermore, you can select the direction of the enforcement, whether it applies to prompts, responses or both, and determine the action taken such as blocking or monitoring. In this slide, we're focusing on data loss prevention or DLP.09:27This feature allows you to create custom DLP profiles tailored to your business needs by defining rules based on dictionary terms or regex patterns. For instance, you might create rules to detect HIPAA compliant patient IDs, educational institution student ID patterns or rules to avoid discussing competitors products and client interactions. Additionally.09:43You can guard against the sharing of intellectual property. To set up DLP policies, navigate to the secure section on the left, select DLP policies, and thereafter enter the rule specifications. Specify the rules name and provide relevant information before clicking add to implement these protective measures.10:03Finally, to review responses from AI defense, navigate to the events log tab. Here, you'll be able to filter events based on your applications and the direction of rules such as prompt or response. Review these events to ensure that your set rules are being properly enforced and examine any instances where rules were triggered.10:21This section provides a comprehensive view of how your safety and privacy protocols are functioning in real time, offering insights into their effectiveness. Thank you for your attention today as we explore these vital security features.10:38
