SecGenAI: Enhancing Security of Cloud-based Generative AI Applications within Australian Critical Technologies of National Interest

GenAI security requires a comprehensive, multi-layered approach: SecGenAI addresses functional, infrastructure, and governance requirements simultaneously, recognizing that security cannot be achieved through technology alone but must integrate policy, compliance, and organizational responsibility.

Data privacy and protection are central concerns for GenAI systems: The framework specifically targets threats like data leakage, adversarial attacks, and model inversion—highlighting that generative AI systems can expose sensitive information in ways traditional systems may not, requiring specialized protective measures aligned with Australian Privacy Principles.

Regulatory compliance and national security are interconnected: SecGenAI emphasizes alignment with Australian regulations (Privacy Principles, AI Ethics Principles, and Cyber Security Centre guidelines), demonstrating that responsible GenAI deployment in critical national technologies requires organizations to balance innovation with adherence to established governance frameworks.

Cloud-based GenAI demands clarity on shared security responsibilities: The framework emphasizes "shared responsibility models," indicating that organizations using cloud-based generative AI cannot rely solely on cloud providers for security—they must understand and actively manage their own security obligations.

Retrieval-Augmented Generation (RAG) systems present distinct security challenges: By focusing specifically on RAG systems, the paper signals that different GenAI architectures carry different risks, suggesting organizations need tailored security strategies rather than one-size-fits-all approaches.