(soft music)
- I'm Werner Vogels, the Chief Technology Officer
of Amazon.com.
I'm joined today by Eric Brandwine, VP
and Distinguished Engineer with AWS security.
Eric has been with AWS for over 13 years
and I'm looking forward to talking about how security
is job zero at AWS.
From a customer's perspective,
how are, how are they thinking about security?
How do we enforce our customers
to take this more seriously?
- In security there are constantly challenging trade-offs
and so the path that we've taken in AWS
is that our services are usable, but secure by default.
So, for example, in S3, when you create a new bucket
that bucket is only accessible by the account owner
and only the authenticated and authorized API calls.
However, lots of our customers like to use their buckets
for serving web assets or things like that.
And so we give our customers the tools to configure them
as they want.
Now, once the customers have configured them
we have another set of controls,
things like block public access
and warnings in the console,
so that customers can quickly
and easily understand the configuration
of their AWS resources
and make sure that it's in accordance
with their expectations.
- If you think about sort of the,
the challenges and the risks that our customers are facing,
how are they evolving?
And how do we as AWS help our customers protect themselves?
- I think that the most important change that's going on
for our customers is with each of our
individual customers.
Every day, that we have a customer that becomes
a sophisticated customer that's adopting
many of our services
and very finely controlling their use of encryption,
we have another customer that's just starting
out on their AWS journey.
And so it's very important that we grow
with these customers as they progress.
And so our controls, our security controls,
our encryption controls, our auditing controls
are designed to be easy to turn on at first,
but then to grow in richness
and complexity as the needs of our customers evolve
over time.
- If you think about GuardDuty or you think about Macie,
in essence they are creating unique services
for each of those customers based on
their access patterns.
So, the role of machine learning
is crucial there.
- Absolutely, I think that security
in the cloud is a magical recipe.
Security has fundamentally become a big data problem,
any non-trivial system,
regardless of where it's hosted is going to generate
a ton of logs, a ton of telemetry data coming out of it
and the cloud and AWS in particular,
are ideally suited to hosting
and processing and extracting useful value out of that.
And so we have all the telemetry,
all of the cloud trail logs, all of the VPC flow logs
that our customers are generating
and we use those to train models
so that we can be on the cutting edge of security detection
and we can be alerting them to anomalous behavior
or unexpected configurations before any other tools can.
- Well, one of the things that I see
when talking to our customers
is that more and more security
is becoming the number one reason for them
moving over to AWS is that something you see as well?
- It is indeed something that I've seen
and it's very satisfying to me professionally
because when I started at AWS, most of the conversations
I had with people about Amazon Web Services
started with explaining that I didn't work
for the bookstore, that we actually had a cloud
at Amazon.
And we were having a lot of trouble convincing
real production enterprise workloads that our infrastructure
was suitable for their needs.
There were a lot of questions about security.
There was a lot of customer uncertainty
and over the past 13 years,
that conversation has completely flipped.
The amount of customer trust that we've earned
is truly humbling
and yes, I have seen customers going to AWS specifically
because of the security that we offer them.
- Originally, what are the kinds of things
that we did right, such that we can evolve this
over time into where we are now?
- One of the things that AWS I believe
has always gotten right,
in security circles, people talk about CIA,
confidentiality, integrity and availability.
And from the very beginning,
AWS added a D to the end of that, durability.
We've always had an incredible focus on the durability
of the data that customers entrust to us,
making sure that it's still there when they ask for it back.
And I think that that has served us incredibly well,
even before there was a security team,
the S3 team took durability incredibly seriously
and they've maintained that through the years.
- So can you talk a bit about sort of
the continuous evolution of security
against bad actors that are equally smart and evolving?
- Absolutely, one of the nice things about the AWS
that we have today is the absolute wealth
of data that we have, the telemetry that we're taking
from our systems.
And that allows us to build very precise models
of what normal looks like and what abnormal looks like.
And that's enabled us to respond to these adversaries.
We may not know what techniques they're using,
we may not know who these adversaries are,
but the fact that they've deviated from prior behavior,
the fact that they are acting unlike our regular customers
allows us to very quickly zero in.
And that hint is all we need.
Once we've identified the bad actor,
once we've spotted the anomalous behavior,
our investigators can go really deep, really quickly.
- Am I right in assuming that,
what bad actors are looking for is more data than compute?
So S3 is really the,
the trove of unique
gold that they're going after?
- There's all sorts of bad actors out on the internet,
but if you look at any computer system,
if your database has a problem,
you restore it from the backup.
If your laptop has a problem, you restore it from a backup.
Where do you get your backup?
Your backups are all stored in S3.
That's the bottom turtle.
That is the storage system at the bottom of the stack.
And so that's where all the data is.
And because it is so important to our customers and to us,
it is the ultimate root of durability.
We protect it with commensurate attention.
- Eric, thank you very much for talking to us.
You have helped us
and our customers be more secure
in ways that I would never have anticipated
when we started all of this.
So for 15 years of secure computing and storage,
thank you very much.
- Thank you, Werner.
It's been an amazing journey
and I look forward to the next 15.
(soft music)