📚 Main Topics

1. Introduction to AWS Application Development

   • Overview of the session and speakers.
   • Importance of building secure applications on AWS.

2. AWS Well-Architected Framework

   • Introduction to the six pillars of the framework.
   • Focus on the security pillar and its guidelines for securing data and assets.

3. Application Security Strategies

   • Importance of integrating application security (AppSec) into the development lifecycle.
   • The concept of "shifting left" to incorporate security early in the software development lifecycle (SDLC).

4. Threat Modeling and Risk Management

   • The role of threat modeling in identifying risks during the design phase.
   • Tools like AWS Threat Composer for risk assessment and mitigation.

5. Development Tools and Services

   • Overview of AWS services that aid in secure application development:
     • Amazon CodeWhispererCode generation and quality improvement.
     • AWS SignerCode signing for integrity and trust.
     • AWS CodeArtifactManaging third-party code and dependencies.
     • Amazon InspectorAutomated vulnerability management.

6. CI/CD Pipeline and Governance

   • Importance of a secure CI/CD pipeline for application deployment.
   • Use of AWS Service Catalog for self-service capabilities and governance.

7. Security Champions Program at Zillow

   • Introduction to Zillow's approach to enhancing security through a Security Champions program.
   • Emphasis on empathy, collaboration, and continuous learning in security practices.

8. Lessons Learned and Best Practices

   • Key takeaways from implementing security measures and the importance of a blameless culture.
   • Encouragement to engage with AWS resources and support for building AppSec programs.

✨ Key Takeaways

• Build Security InIntegrate security practices early in the development process to reduce risks and improve software quality.
• Utilize AWS ToolsLeverage AWS services to automate security checks and manage vulnerabilities effectively.
• Foster CollaborationEncourage a culture of collaboration between security teams and developers to enhance security awareness and practices.
• Continuous ImprovementRegularly assess and update security measures based on evolving threats and organizational needs.

🧠 Lessons

• Empathy in SecurityUnderstand the challenges faced by development teams and provide support rather than act as a gatekeeper.
• Documentation and TrainingMaintain thorough documentation of security practices and provide training to enhance team capabilities.
• AdaptabilityBe willing to adjust security measures based on the specific context and needs of different teams and projects.

🏁 Conclusion

The session emphasized the importance of building secure applications on AWS by integrating security into every phase of the development lifecycle. By leveraging AWS tools and fostering a collaborative culture, organizations can enhance their security posture and deliver high-quality software efficiently.