AWS re:Inforce 2024 Keynote Recap—A Commitment to Security and Innovation

Moore’s law states that the number of transistors on integrated circuits (or microchips) will double every two years.

Moore’s law was first described by Gordon E. Moore, a co-founder of Intel, in 1965. It has held largely true for about 46 years now, even though he only predicted it to hold up for about ten years. Currently, there are 4.95 billion internet users around the world, and an average of 600,000 are being added to that number every day.

Technology feels as if it sometimes faster than our imaginations can keep up with.  We’re early in the AI journey and it feels like we’re already moving at warp speed. 

In exciting times like these in tech, it’s easy to get caught up in the frenzy. It’s important to step back and review the fundamentals.  AWS CISO Chris Betz did just that during his keynote this Tuesday at Amazon Web Services (AWS) re:Inforce 2024.  He talked about security being an integral part of the culture and a differentiator for customers.  Betz highlighted the fact that a security culture takes time to mature and nurture.  It’s an investment. 

Betz shared that having a foundation of good security is paramount to experimenting with new technologies, including generative AI.  Betz sees security as a business enabler, particularly with generative AI.  He advocates for a collaborative approach between customer security teams and the organization’s employees to work together to innovate but in a secure fashion.

Security is part of every employee’s job description according to Betz.  At AWS, the choice was intentional for the security team to report directly to the CEO.  The goal was to build security into the structural fabric of AWS.  The thinking is that security starts at the top, but responsibility is bidirectional. Security is a distributed responsibility. The cultural belief translates to product as well.  Security is built into every product road map, engineering plan, and weekly stand up meeting instead of being bolted on. 

As customers adopt generative AI, one of the main concerns seems to be about protection of their own data as well as their client’s data.  AWS Nitro System provides specialized hardware and firmware that enforces restrictions so that bad actors can’t gain logical access to underlying infrastructure, workloads or data running on customer’s EC2 servers. During re:Inforce there was an announcement of an  enhancement to Nitro System's end-to-end encryption and Enclaves, which are isolated compute environments

Amazon Bedrock steps in when it comes to securely building generative AI applications.  Bedrock services give customers full control over the data they use to customize the foundation models behind the applications.  Data is encrypted in transit and at rest.  This ensures that data remains private.

Betz noted that generative AI has also become an indispensable tool to IT and security administrators to help them identify and resolve issues more effectively.  Two more generative AI-powered security features were announced at re:Inforce.

The first was a new natural language query generation capability which enables security administrators to easily and quickly analyze activity events in AWS CloudTrail Lake, a service that lets organizations store and query events for security investigations. A security administrator asks a question and CloudTrail will generate a query.  The second is AWS Audit Manager. Audit Manager is a prebuilt framework to understand how their generative AI implementation on Amazon SageMaker matches AWS recommended best practices. SageMaker customers can now start auditing their generative AI usage and automating evidence collection.  This provides a consistent approach for tracking AI model usage and permission, flagging sensitive data and alerting issues.

Betz believes that the best security defense is a good offense.  Part of that good defense in practice is the use of internal tools like Sonaris, used to analyze network traffic to identify and stop malicious attempts to connect to a large number of customer accounts to find vulnerabilities.  Between May 2023 and April 2024, Sonaris denied over 24 billion attempts to scan customer data stored in Amazon Simple Storage (S3) and prevented nearly 2.6 billion attempts to discover vulnerable services running on customers EC2 virtual servers.

As part of getting the basics right and helping customer safeguard their accounts, AWS started a new program that enforces MFA for root user accounts of AWS Organizations to further reduce the risk of account takeover by offering customer a free MFA security key.  It was announced that  AWS Identity and Access management now supports passkeys as a second authentication method. 

The message that Betz shared was clear.  Security is foundational.  It is everyone’s job and it requires constant commitment to innovate

 cc: Al Sadowski | Mary McCahon