This article is based on reporting originally published by ITPro Today from AWS re:Inforce 2019, held in Boston.
Security Moves from Afterthought to Boardroom Priority
AWS re:Inforce, Amazon Web Services’ inaugural security-focused conference, brought together practitioners, executives, and vendors to discuss the rapidly evolving challenge of securing public and multi-cloud environments. A recurring theme: security is no longer an afterthought bolted on at the end of a product launch cycle — it is now a first-class concern at the C-suite and board level.
Brian Riley, Senior Director of Global Cyber Risk Management at Liberty Mutual, illustrated how dramatically the conversation has shifted. “As soon as security would come up, out came the BlackBerrys,” he recalled of executive presentations from seven or eight years ago. “The last couple of years there’s been a drumbeat in the press of security issues that have affected various organizations, and there’s much greater focus [on security] at the executive management level and at a board level.”
That cultural shift was on full display at re:Inforce. Alongside deep-dive technical sessions on specific AWS security features and services, the conference dedicated significant time to broader organizational topics: breaking down the silos between security professionals and development teams, and embedding security thinking earlier in the software delivery lifecycle.
Security Teams Must Move at Development Speed
Bill Shinn, Senior Principal Engineer in the Office of the CISO at AWS, emphasized that the shift from large capital expenditure data center investments to pay-as-you-go cloud consumption has fundamentally changed the pace at which security teams must operate.
“I think security teams have to go faster. And they have to be the fastest thing in the organization,” Shinn said. He cautioned that organizations carrying over a data center mindset when architecting security in the cloud will be left behind.
Riley echoed this point from an enterprise perspective: “We can actually implement those security controls more effectively if we partner with the teams that are building those pipelines and build those controls through automation, so that we can execute them at a scale that we’re simply not going to be able to [with] staff in a security organization.”
How AWS Builds Security Into Its Own Development Process
Shinn described how AWS approaches security internally across its service teams. Every service undergoes a rigorous application security review before launch, encompassing:
- Threat modeling — service teams closest to the architecture develop their own threat models, with support from the security team where needed.
- Static and dynamic analysis — automated code and runtime analysis as part of the review pipeline.
- Canary deployments — new features are released to a limited subset of users or systems to validate security posture before broad rollout.
“Once you state the security intent of how something should or shouldn’t exist in production, we have a set of canaries around making sure that state doesn’t change,” Shinn explained.
A cultural emphasis on ownership is central to this model. Service teams are expected to understand and own the security of what they build, with the central security team serving as an accelerator rather than a gatekeeper. “The service teams just know culturally that it’s their job. And we’re there to help them do it faster.”
To reduce friction further, AWS runs an affinity program that pairs service teams with consistent security engineers across significant feature changes. This eliminates repeated context-setting while still allowing fresh engineers to be brought in for new perspectives when warranted. Customer satisfaction (CSAT) scores are used to measure whether security engagements were frictionless, cost-effective, and resulted in teams shipping secure code.
Multi-Cloud Environments Introduce Unique Security Complexity
One of the most substantive themes at re:Inforce was the security complexity introduced by multi-cloud architectures. Riley noted that AWS and Microsoft Azure, for example, have made fundamentally different architectural decisions — each logical and well-suited to their respective platforms — but this creates a meaningful challenge for enterprises trying to maintain consistent security postures across providers.
“Being in a multi-cloud environment makes some security processes more challenging because Amazon has made very different architectural decisions than Microsoft made, for extremely good reasons that make great sense with their platforms,” Riley said. “That means from an enterprise perspective that we really need to take each cloud provider on their own terms.”
He also raised a practical concern about vendor tools that promise security consistency across cloud providers: in practice, pursuing that consistency can mean foregoing the native capabilities that make each platform distinctive and powerful.
The key questions organizations must answer include:
- Where should the enterprise invest in platform-specific security expertise versus cross-cloud tooling?
- How do you ensure the right people are deployed in environments they deeply understand?
- How do you govern policy consistently while still leveraging platform-native capabilities?
The Cybersecurity Talent Gap Remains a Critical Challenge
Beyond technology, both Riley and Shinn pointed to the talent shortage as one of the most pressing issues facing security organizations today.
“There’s demand for talent in this space that far outstrips supply,” Riley said. Liberty Mutual’s approach has been to recruit globally, accepting that the competition for skilled security professionals requires casting a wide net. Organizations that can leverage global scale in hiring have a meaningful structural advantage in building out security teams.
The talent gap also reinforces the case for automation: when qualified security engineers are scarce, embedding security controls into automated pipelines becomes a force multiplier for whatever security staff an organization does have.
New Services Launched at re:Inforce: Control Tower and Security Hub
AWS re:Inforce 2019 served as the launch platform for two new AWS services aimed at helping customers manage governance and security at scale.
AWS Control Tower
AWS Control Tower provides customers with a pre-configured multi-account AWS environment and a pre-packaged set of guardrails to support ongoing governance and compliance. It is designed to answer demand for out-of-the-box governance without requiring organizations to build their own frameworks from scratch.
“Control Tower is an answer to what customers are really asking for in terms of governance and guardrails out of the box,” Shinn said. “Control Tower is launching with very prescriptive guardrails. And we also still have the Landing Zone solution available for customers that want a higher degree of configuration or customization.”
In practice, Control Tower is suited to organizations that want a fast, opinionated path to a governed multi-account environment, while Landing Zone caters to teams that need deeper customization.
AWS Security Hub
AWS Security Hub provides a centralized view of security and compliance findings across an AWS environment. It aggregates findings from native AWS services and integrated third-party partner solutions, normalizes them, and surfaces high-signal, actionable findings in a single console.
“Security Hub is really about meeting customers where they’re at in terms of integrations and event flows. Taking findings and high signal findings and making them actionable is something that Security Hub has done well within the public preview,” Shinn said.
Security Hub can integrate with Amazon CloudWatch and AWS Lambda, enabling automated remediation workflows triggered by specific findings — a key capability for security teams that need to operate at cloud scale without proportional headcount increases.
Key Takeaways for Security and DevOps Teams
- Shift security left: Embedding security reviews, threat modeling, and automated analysis into CI/CD pipelines is more effective and scalable than end-of-cycle security gates.
- Treat security as an enabler: Security teams that act as partners to development teams — rather than blockers — produce better outcomes and ship secure code faster.
- Respect cloud-native architectures: In multi-cloud environments, platform-native security controls often outperform generic cross-cloud solutions. Invest in cloud-specific expertise.
- Automate to compensate for talent scarcity: Given the persistent talent gap, automation and policy-as-code approaches are essential for scaling security programs.
- Use centralized visibility tools: Services like AWS Security Hub reduce the overhead of correlating findings from disparate tools and enable faster, automated response.