SAN FRANCISCO – Amazon recently worked with Michael B. Jordan and Tessa Thompson for its public service announcement (PSA) campaign “Protect & Connect” to educate the public on how to stay safe. And internally, the company also uses the same approach to make security training more relatable, actionable and entertaining.

The tech giant conducts an annual company-wide security awareness training with other supplemental training, Amazon Security Director Jenny Brinkley told SDxCentral in an interview during the RSA conference 2023. Amazon also makes its training materials available for free to the public.

[ Follow SDXCentral’s complete RSA Conference 2023 coverage ]

“You got to make people care. And so you've got to find out what their personal motivators are, and how to develop that type of content that can make people care, care to click through the training and care to remember things as they're walking through an office,” Brinkley said.

Serving a diverse workforce, she noted  that Amazon tries to find an “equalizing language” for everyone across the company, “so being really inclusive and representative of everyone that works within Amazon,” which includes using multi-language to explain real-life situations and examples that employees can relate to.

Different teams in Amazon have different security needs, Brinkley said. For example, its builder community needs to have a deeper understanding of how to code securely, so the teams will develop their own specific training curriculum.

Brinkley pointed out that the term “zero trust” might give employees the wrong idea -- that “no one trusts me.”

“And there's a flip side to it,” she added. “Ultimately, you've got to look at the other side of it, thinking through how you're going to earn trust with your teams, [and] how teams are going to trust security. ”

The message should be around building a partnership for teams to understand what kind of access they need and how long they need it. “Especially to people that aren't in security. They hear zero trust [and think]: ‘so you don't trust me?’ No, no, no, that's not it. We're trying to think about the best ways to get you information and resource access, without enablement, without inhibiting you [from being to] able to do what you need to do, but also help you stay secure,” Brinkley said.

She noted zero trust has become “a ubiquitous language” now. “The way I like to think about it is earning the trust. And this is a leadership principle within Amazon, like I need to earn trust with my colleagues and my teammates.”

“So I kind of flipped the script,” Brinkley said. “So when I'm building out a training, it's really getting people to understand … the why and the how” — why they need to do the security training and how to implement and manage that guidance and recommendations.