Navigating the Culture of Security: Insights from Amazon CSO Steve Schmidt

Knowing security culture dynamics is necessary for global companies in an era in which cyber threats have evolved unusually. In this interview, Steve Schmidt, Amazon's Chief Security Officer, expounds on security intricacies, the generative AI role, and the shared responsibility model that defines cloud security to Thomas George, the Managing Editor of Dataquest, a more than four-decade-old ICT publication.

- Thomas George

A lot has been said about the culture of security. In a shared responsibility model, who is responsible for failures, and how do we differentiate and allocate roles?

Sometimes, to improve security, one must get into details of particular problems. The recent highprofile failures uncovered cultural gaps, such as the lack of multi-factor authentication exploited by nation-state actors. It should be noted that the division of labour makes it clear that there are divided responsibilities in terms of security. All people should feel responsible for the entire system’s safety. While Amazon S3 defaults to non-public access, customers can choose to make data public if they decide to do so. It is essential to lay a strong foundation, educate customers and maintain communication across all channels for alignment.

How has the attack landscape evolved, especially with the emergence of aI, and what kind of damage can it cause?