Security Culture & Scaling Your Security Humans
summary
AWS embeds security into builders by training over 2,000 software engineers as Guardians who act as local appsec proxies, uses an automated ticketing-first workflow, and ships tools like Mechanic for auditable, short‑lived troubleshooting access and Software Assurance Service to flag outdated packages. The program yields ~25% fewer medium/high findings (≈15,000 fewer in 2021), >25% faster security reviews, and saves over 200,000 total days by shifting fixes earlier and reducing handoffs.
AI-written summary · about
chapters (9)
- 0:00Security culture at AWS
- 0:48Service teams and AWS security roles
- 3:16Ship securely
- 4:59Guardians program
- 9:14Operating with automation
- 12:25Measuring security effectiveness
- 15:56Feedback and improvement
- 17:20Building a Guardians program
- 19:49Security is everyone's job
related talks
43mAppSec tooling & culture tips from AWS & Toyota Motor North America
27mBuilding a culture of security with AWS and CBA
38mBuilding Security at Speed
42mHow AWS and MongoDB raise the security bar with distributed ownership
53mAchieving End-to-end Security on AWS
36mThe Road To Being Rugged
20mBuilding security culture on infrastructure teams
25mDevSecOps: Security Automation at Scale