📚 Main Topics

1. Introduction to Application Development on AWS

   • Importance of a secure environment (landing zone).
   • Overview of modern application architectures (microservices, serverless).

2. Well-Architected Framework

   • Six pillars, with a focus on the security pillar.
   • Best practices for application security, including people, process, and technology.

3. Shifting Left in Security

   • Integrating security early in the software development lifecycle (SDLC).
   • Importance of threat modeling and continuous monitoring.

4. Security Tools and Services

   • Overview of AWS services like CodeWhisperer, AWS Signer, and CodeArtifact.
   • Use of Amazon Inspector for vulnerability management.

5. CI/CD Pipeline and Governance

   • Importance of a secure CI/CD pipeline.
   • Governance strategies and the use of AWS Service Catalog.

6. People and Culture in Security

   • Introduction of the Security Champions program at Zillow.
   • Emphasis on empathy, collaboration, and continuous learning in security practices.

✨ Key Takeaways

• Building Secure ApplicationsEstablish a landing zone on AWS to create a secure environment for application development.
• Security IntegrationIncorporate security practices early in the SDLC to reduce risks and improve software quality.
• Utilizing AWS ToolsLeverage AWS services to automate security checks, manage code integrity, and monitor vulnerabilities.
• Governance and ComplianceImplement governance frameworks to ensure compliance and manage security effectively across different environments.
• Empowering TeamsFoster a culture of security awareness and collaboration through programs like Security Champions.

🧠 Lessons Learned

• Empathy in SecurityUnderstand the challenges faced by development teams and provide support rather than act as a blocker.
• Continuous ImprovementRegularly update security practices based on feedback and evolving threats.
• Documentation and TrainingEnsure that security practices are well-documented and that teams are trained to recognize and address security issues.
• Collaboration Across TeamsEncourage cross-functional collaboration to enhance security measures and share knowledge.

🏁 Next Steps

• Engage with AWS account teams for tailored support in building an AppSec program.
• Evaluate existing workloads using the Well-Architected Framework to identify security improvements.
• Plan for ongoing training and certification in security best practices.
• Attend AWS re:Inforce for further learning and networking opportunities in cloud security.