# Key Threats

Overview of the Three Key Threats

<br>

<table data-header-hidden data-full-width="true"><thead><tr><th></th><th></th><th></th><th></th><th></th></tr></thead><tbody><tr><td><strong>Starting Point on the System</strong></td><td><strong>Potential Type of Attack and/or Key Threat</strong></td><td><strong>Potential Negative Impacts (Risks)</strong></td><td><strong>Risk Rating</strong></td><td><strong>Appropriate Defenses/Security Controls</strong></td></tr><tr><td>Architecture - PropScreen in relation to all other systems</td><td>Tampering, Info Disclosure, Denial of Service from Insecure Software in PropScreen</td><td><p>Unauthorized data disclosure </p><p>Privacy policy violation</p><p>PropScreen Failing Open</p><p><br></p></td><td>Critical</td><td>Develop software in accordance with the OWASP Developer Guide (focus on section 5, especially input sanitization and supply chain management)</td></tr><tr><td>Asset - LLM </td><td>Denial of Service, Cost Running Attacks</td><td><p>Service degraded or failing for other users</p><p>Organization incurs unnecessary and wasteful cloud computing costs</p><p><br></p></td><td>High/Medium-High</td><td><p>Implement rate a limiting module for the requests made to PropScreen</p><p><br></p><p>Implement a size limiter on the maximum response size allowed by the model (covered by AWS)</p></td></tr><tr><td>Asset - Client LLM Application</td><td>Spoofing, Tampering, Info Disclosure, Elevation of Priv, leading to unauthorized access</td><td><p>Unauthorized data disclosure or data theft</p><p>Privacy policy violation</p></td><td>High</td><td>Implement a User Authentication Module before a user has the ability to interact with PropScreen</td></tr></tbody></table>
