Amazon Chief Security Officer Stephen Schmidt. Photo credit: AWS

Amazon Web Services (AWS) secures its users “behind the scenes” by widely sharing its findings and learnings, having security baked into its services from the start, and working with partners and customers together to make sure they have multiple layers of defense, its executives claim.

“We're stronger together, I think it's very, very true,” Amazon Chief Security Officer Stephen Schmidt said during his keynote address at the AWS re:Inforce event today. 

As a public cloud giant, AWS encounters and handles novel threats, outlier scenarios, and rare events more often than most organizations, Schmidt pointed out. “Given the scale, we see things that an individual business would not see in generations of operations.” 

He noted that AWS handles billions of distinct customer activities every day and tracks quadrillions of events every single month. “Given the number of tickets and feature requests that we get every day, it's entirely likely that we've handled 50 things for you this month that just happened and you had no idea that we were protecting you behind the scenes.”

This means the cloud service provider can use the findings and learnings to help all of its customers. “Because we learn from the totality of what our customers are doing, that novel threat on Monday morning becomes a known quantity minutes or hours later,” Schmidt said. “And both AWS and our partners are operating with our customers to make sure that those learnings get wide distribution.”

On the other hand, AWS internally embeds security into its products from the beginning, Schmidt claims. It has a group of software development engineers, called security guardians, who are responsible to make sure products or services won’t be shipped without a security review.

“This is a best practice that we recommend to customers as well — weave security into your development lifecycle and your operations,” he added.

Prior to his current role, Schmidt was AWS’s CISO for 12 years. What lessons did he learn? First of all, the need to strictly enforce access control.

“One of the most important questions you can ask is who has access to what and why,” he said. “An overly permissive environment guarantees you headaches.”

Secondly, use multiple layers of security throughout your environment including intrusion detection, active logging, a least-privilege scheme, and a robust encryption program. “Do not let one line of defense be the entire equation. Security tools are always stronger when used as part of a holistic strategy,” Schmidt noted.

Plus, “this stronger together is also about not siloing your security team as the other group, operating in a vacuum. They should be an intimate partner with your development organizations,” he added. 

To build a stronger security posture, customers should take advantage of all the resources available from AWS, its partners, and the marketplace, Schmidt suggests.