Building a culture of security with AWS and CBA
summary
Claims a distributed ownership mechanism called Security Guardians or a Security Champions program speeds delivery and reduces defects: AWS reports teams with guardians get 20% faster reviews and 22% fewer findings; CBA shows ~4x faster reviews, 2x more tech changes and 2.5x fewer incidents, with ~70% of upfront reviews done by champions. Program components are a dedicated team, an internal security academy tied to HR learning, measurement/inspection loops, and pilots using generative AI to augment assessments.
AI-written summary · about
chapters (18)
- 0:00Introduction and welcome
- 1:09Security bottleneck challenges
- 3:57Three ingredients for security culture
- 6:49Mechanisms for distributed ownership
- 7:30AWS Security Guardians program
- 10:40CBA's security champions approach
- 11:22CBA's challenges and solutions
- 13:07Impact on CBA's culture
- 13:48Scaling the champions program
- 14:52Improving customer experience
- 15:55Measuring program success
- 16:59Employee experience and feedback
- 18:02Lessons learned and key insights
- 19:26What worked and what didn't
- 21:10Tips for starting a program
- 22:34Advice for security leaders
- 23:38Future with generative AI
- 24:42Recap and closing
related talks
20mSecurity Culture & Scaling Your Security Humans
38mBuilding Security at Speed
42mHow AWS and MongoDB raise the security bar with distributed ownership
27mSecurity Champions LeaderBoard - Building and Gamifying the Security Culture at Your...
20mBuilding security culture on infrastructure teams
51mBuilding Security Champions
53mAchieving End-to-end Security on AWS
43mAppSec tooling & culture tips from AWS & Toyota Motor North America