How AWS sustains a strong culture of security

At AWS, security is deeply ingrained into our organizational structure and decision-making. Our security teams report directly to the CEO while also being deeply embedded in our respective business units. Weekly meetings with executive leadership examines security metrics, connect data to business outcomes, and ensure alignment on strategic security issues. This top-down commitment reinforces that security accelerates business objectives and enhances customer experiences.

• The CEO’s role in security leadership
• How the unique culture of security at AWS makes a difference
• 6 questions every board should ask their CISO

 

AWS operates with a strong ownership model built around our culture of security. Everyone, from executives to engineers, embraces a security-first mindset. Service teams are fully responsible for the security of the service that they deliver. Security is ingrained into every product roadmap, engineering plan, and weekly stand-up, just as much as capabilities, performance, and cost. We encourage teams to raise their hand and ask for help when there’s even a hint of a security issue.

• Security ownership and responsibility at AWS
• Explore the building blocks of a culture of security

AWS Security provides critical capabilities and services that enable our engineering and service teams to fulfill their security responsibilities effectively. This includes training, threat modeling tools, code scanning frameworks, design reviews, penetration testing, and security reviews of new services and features. Security teams are empowered to make a go or no-go decision with respect to each and every release, and always err on the side of maintaining the high security bar our customers expect from AWS.

• How AWS distributes security ownership with Security Guardians
• How to build your own Security Guardians program

At AWS, people are our biggest asset, driving us to build security innovations that improve their work experience, remove barriers, and enable sound security decisions. We use artificial intelligence (AI) to accelerate secure software development and complement human expertise. We use security automation to reduce mundane tasks, reduce human error, and scale security best practices. And, we use automated reasoning to detect misconfigurations and prove that our security controls are effective.

• Build a diverse and empowered security organization
• Learn more about provable security