AWS Cloud Enterprise Strategy Blog
Category: Security, Identity, & Compliance
CxO Insight: Reporting Cybersecurity to the Board
by Clarke Rodgers, Enterprise Strategist, AWS Enterprise Strategy Over the last several months, one of the most common discussions I have had with members of the C-Suite is around how to effectively report and/or discuss cybersecurity with the organization’s Board of Directors (BoD) and/or Senior Leadership Team (SLT). Background Before I get into the details, […]
Read MoreThe CISO Perspective: How Chief Information Security Officers “Cross the River” to Cloud Adoption
In this guest post, Mignona Cote, the AWS Global Security Advisory lead, reports on her conversation with Jim Routh, Head of Enterprise Cybersecurity at MassMutual. Their discussion covers the challenges for CISOs who straddle the worlds of traditional information security and newer, digital. DevSecOps and cloud-based security paradigms. Ultimately, Routh says, CISOs must learn to […]
Read MoreBuilding an Effective Security Team: It’s More Than Just Technical Skills
As part of a new video series of discussions with security leaders, Verified: Presented by AWS re:Inforce, AWS CISO Steve Schmidt sat down with Emma Smith, Global Cyber Security Director at Vodafone, for a discussion on the importance of diversity, equity, and inclusion in security teams. Watch the full video on YouTube. Emma, a Diversity […]
Read MoreThe CISOs of Netflix and AWS Discuss Remote Work, Security Culture, and Cats as a Threat Model
As part of Verified: Presented by AWS re:Inforce, a new video series of discussions with security leaders, AWS CISO Steve Schmidt sat down with Jason Chan, VP of Information Security at Netflix, for a broad-ranging interview. Even though we couldn’t be together this year at AWS re:Inforce, we still wanted to create a platform for […]
Read MoreEvolving GRC to Maximize Your Business Benefits from the Cloud
Introduction by Mark Schwartz This post continues our series on governance in the cloud. In earlier posts we discussed new strategies for governance, the governance that requires standardization and rules, and governance that oversees projects and investments. In another post John Thorp of AWS Professional Services wrote about AWS’s frameworks for evolving your Governance, Risk, […]
Read MoreTransform Your GRC Strategy to Get the Most Out of the Cloud
Introduction by Mark Schwartz In several earlier posts I discussed new strategies for governance in the cloud and the digital world in general. In the first, I talked about the kind of governance that requires standardization and rules. In the second, I wrote about governing projects and investments. The underlying point of these posts was […]
Read MoreData Protection in AWS
One of the most common areas of interest from customer executives regarding their move to AWS is data protection. Data protection can take many forms (e.g., backups, high availability, long-term storage), but the focus for this blog post will be encryption. This post has been co-written with Scott Conklin, an encryption expert from our AWS Professional […]
Read MoreSecurity at AWS
When meeting with security, risk, and compliance executives who have yet to start their cloud transformation or who already have multiple cloud workloads in AWS, I am often asked a version of the following question: “While we agree that the cloud is the new normal, it is different than running security on premise in the […]
Read More5 Steps to Building a Culture of Security
(image www.bluecoat.com) In an earlier blog post, I discussed the importance of building a culture of security rather than thinking of security as just the job of the CISO’s team. In this post, I’d like to discuss some ideas on how to build such a culture, drawing on my experiences at USCIS. As CIO, I […]
Read MoreBuilding a Culture of Security
It is no longer sufficient to leave security to a team of specialists who watch over the enterprise’s risk posture and control it through a set of constraining policies. It is not enough to guard the boundaries of the enterprise’s network with firewalls, or to simply implement sets of controls specified in a compliance framework. […]
Read More