Security and Other Risks Related to LLM-Based Software Development

Generative Artificial Intelligence (GAI) is a new technology, and even though its capabilities are thoroughly being in- spected and applied in different industries, it continues to develop intensively bringing in new types of risks in the soft- ware development domain. The variety of large language models (LLMs) emergency has led to changes at all stages of the Software Development Life Cycle (SDLC). Thus, the main objectives of the article are to identify and understand the po- tential risks associated with LLM-based software development and to identify the best approaches to mitigate the risks. The paper presents observations of common software architectures based on LLM, risks and their impact on traditional SDLCs, approaches to testing and software quality assessment, and an analysis of how LLM has changed the software de- velopment industry. The widespread LLM-based application architectures already have a traditional set of components like a chatbot channel for interaction with users, a knowledge base for providing the appropriate context to LLM, the com- ponents required for authentication and providing secure knowledge processing during the session and prompt accessibil- ity, retrieval-augmented generation system (RAG) and evaluation modules. It is shown that integrating LLM into software generates unique risks that require changes to the already established SDLC at the level of architectural modifications, the evaluation system, and best practices for risk mitigation. Each component of the LLM-based system can generate specific risks in each SDLC stage. To more effectively identify and delineate risks, risk naming and its description were consid- ered, and the traditional risk taxonomy was updated with an LLM-based software taxonomy. It is worth noting that anoth- er stage has been added to the conventional SDLC, which is related to the selection and management of personnel. This is because GAI is now a new technology and requires changes to the traditional composition of specialists. The risk exam- ples, shown in the paper, are presented with risk identifiers that help identify the risk in a specific SDLC and connections to other related risks. It is an assumption that one risk has a minimum of 8 risk identifiers, what is equal to 8 SDLC stages. It explained how the risk manifests in different SDLC stages, which were defined by subject matter experts (SMEs) from IT companies. Finally, some sets and concepts were formalized for future calculations and research of the identified risks.