Exciting News From Anaheim, California at re:Inforce 2023

As the dawn breaks on a new era of cybersecurity, the tech world pauses, drawing a collective breath to take in the grandeur that is re:Inforce 2023. The Amazon Web Services (AWS) event unfurls, its pulsating digital heart powered by the unprecedented duo of CJ Moses and Becky Weiss, AWS’ CISO and Senior Principal Engineer respectively. Together, they’re unveiling no less than fourteen new security innovations, an intoxicating blend of cloud security advancements, management tools, and encryption delights. This is not just about splashing around in the shallow end of the tech pool. This is about deep diving into the digital future, a future that could very well hinge on the strength and sophistication of these AWS security powerhouses.

Here are a few exciting highlights for this year’s re:Inforce:

Embracing The Future: Amazon Verified Permissions Expanded

When we think about the future of cloud computing, it’s hard to ignore the pivotal role that Amazon Verified Permissions is set to play. Now generally available, this service represents a seismic shift in how we approach fine-grained authorisation and permissions management for applications.

While previously the introduction of Amazon Verified Permissions promised a solution, today, it delivers. Built around Cedar, an open-source language explicitly created for access control, it empowers developers to define permissions as clear, easy-to-understand policies. This isn’t just about granting and denying access; it’s about making the process comprehensible, scalable, and most importantly, secure.

In the wise words of CJ, “Security is more about people and culture than it is technology.” This philosophy is evident in the very foundation of Verified Permissions. By decoupling permissions from application logic, AWS has crafted a system where developers can create safer applications faster, leveraging centralised policy stores, reusable policy templates, and policy testing.

The scope of Verified Permissions extends beyond just development. It integrates with existing identity providers, manages users and groups, and pairs seamlessly with Amazon Cognito. This partnership creates a fortified authentication and authorisation solution for applications, allowing policy validation based on Amazon Cognito attributes and authorisation of requests using Amazon Cognito tokens.

This service resonates with the core principle of zero-trust architecture – continual identity-based authorisation. A perfect ally for security and audit teams, it integrates with AWS CloudTrail, meticulously recording all access requests. In doing so, it provides a comprehensive answer to the critical question: “Who has accessed what in applications?”

Shielding the Digital Realm: AWS Cyber Insurance Partner Program Explored

At the crossroads of cyber threats and digital transformation, the AWS Cyber Insurance Partner Program is an illuminating beacon of hope, especially for small and medium businesses. When cyber threats loom over your enterprise, this programme not only lights the way but also provides a concrete path towards recovery. However, its value extends beyond mere damage control.

The programme represents a bold move in the face of an increasingly volatile threat landscape. It underscores the fact that cybersecurity is not just a defensive measure but an integral component of business operations. As regulations swiftly evolve, cyber insurance is increasingly viewed as a necessary precaution, a critical tool in the risk mitigation toolkit.

In the realm of cyber insurance, the price of coverage is not merely an arbitrary number. It is carefully derived from a meticulous risk assessment, including a comprehensive evaluation of an organisation’s security posture. Through this programme, AWS is pioneering a more refined approach to such assessments, streamlining the process to the extent that quotes for necessary coverage can be provided within two business days.

The efficiency and simplicity of the programme are enhanced by its integration with AWS Security Hub. This alliance allows AWS Cyber Insurance Partners to offer valuable insights to customers about strengthening their security posture, effectively reducing their business risk. It also creates the potential for higher coverage limits or reduced premiums, further incentivising the adoption of robust security measures.

During his session, CJ shared, “Security is a discipline that is constantly changing, new technologies… present new challenges but also new opportunities.” The AWS Cyber Insurance Partner Program personifies this sentiment. It does more than protect—it educates, encourages, and rewards commitment to best practices, fostering a proactive culture of security.

With the rate at which digital threats are evolving, insurance is no longer a luxury; it’s a necessity. This programme is not merely about covering loss; it’s about promoting safer practices, enhancing awareness, and ultimately, building a safer future. Stay tuned as we delve deeper into this topic in the days to come, shedding more light on this ground-breaking initiative.

Code-Security Crusader: Amazon CodeGuru Security Unveiled

An event as forward-thinking as re:Inforce 2023 would be incomplete without the much-anticipated Amazon CodeGuru Security. Now available in its preview stage, this Static Application Security Testing (SAST) tool is set to revolutionise the landscape of code security. It’s a digital sentinel that not only identifies vulnerabilities but also uses machine-learning to guide the process of remediation.

Consider CodeGuru Security the equivalent of a personal trainer for your codebase. Its mission is twofold: detection and correction. Its ability to execute a deep semantic analysis of application code ensures a low false positive rate, so your engineering and security teams can focus their attention where it’s most needed. This minimises wasted time and energy on phantom issues, enabling your teams to be more efficient in triaging genuine vulnerabilities.

The tool flags a wide range of issues, from log injection and hard-coded credentials to resource leaks. Its versatility is further enhanced by its seamless integration into various stages of the development workflow—be it the code repository, CI/CD pipeline, or container registry. This makes CodeGuru Security a handy companion for any development team, always vigilant and ready to swoop in with in-context code patches for certain types of vulnerabilities.

These automatic patches significantly reduce the time and effort required to fix code vulnerabilities. They’re not just solutions; they’re learning opportunities. With each patch, developers can gain insights into better coding practices and learn to spot potential pitfalls before they become problems.

The debut of Amazon CodeGuru Security signifies a momentous step forward in the realm of code security. As CJ said, “Our vision is to ensure customers’ security, no matter where they are on their cloud journey.” This tool doesn’t merely safeguard; it enlightens, guides, and ultimately empowers developers to secure their codebase. Stay tuned for future updates as this preview tool continues to evolve and redefine the landscape of code security.

A Deep Dive with CJ Moses: Human Element in Cybersecurity

As we traverse through the labyrinth of advancements and offerings, it’s CJ’s words that offer a beacon. His approach to security isn’t just about technology, but about understanding human motivations. His past with the FBI Behavioural Science Unit and his interactions with convicted cybercriminals reveal an underlying philosophy – one that emphasises the importance of the human element in cybersecurity. In this digital era, it’s refreshing to see an approach that marries technology with a deep understanding of human psychology.

Join us in the upcoming days for more exciting news from Anaheim, California re:Inforce 2023. Stay tuned!