AWS wellarchitected medium security documentation change
Summary
Added separation of duties requirements for generative AI workloads, including distinct roles for prompt engineering/model governance and approval workflows for AI systems.
Security assessment
The change introduces security controls specifically for AI systems by enforcing separation of duties across AI development/production environments and implementing approval workflows. This prevents unauthorized AI system modifications and reduces insider threat risks.
Diff
diff --git a/wellarchitected/latest/financial-services-industry-lens/fsisec04.md b/wellarchitected/latest/financial-services-industry-lens/fsisec04.md index 6d3751110..735b092a6 100644 --- a//wellarchitected/latest/financial-services-industry-lens/fsisec04.md +++ b//wellarchitected/latest/financial-services-industry-lens/fsisec04.md @@ -11 +11,5 @@ FSISEC04-BP01 Implement the principle of separation of dutiesFSISEC04-BP02 Use A -Separation of duties, as it relates to security, has two primary objectives. The first objective is the prevention of conflict of interest, abuse, and errors. The second objective is the detection of control failures that include security breaches, information theft, and circumvention of security controls. While robust automation of infrastructure and application deployments helps reduce the need for human access, there can be instances where individuals need to complete key functions. For users with increased privileges, it is important to distribute system administration activities, so no one administrator can hide their activities or control an entire system. Separation of duties can help mitigate risk on critical tasks by ensuring different people are required to perform a task where the requestor and the approver can't be the same person. A common example is the use of an approver during the [running of an automation on AWS Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/running-automations-require-approvals.html). This principle can be used to implement numerous tasks including controlling access to your cloud resources. +Separation of duties, as it relates to security, has two primary objectives. The first objective is the prevention of conflict of interest, abuse, and errors. The second objective is the detection of control failures that include security breaches, information theft, and circumvention of security controls. + +While robust automation of infrastructure and application deployments helps reduce the need for human access, there can be instances where individuals need to complete key functions. For users with increased privileges, it is important to distribute system administration activities, so no one administrator can hide their activities or control an entire system. Separation of duties can help mitigate risk on critical tasks by ensuring different people are required to perform a task where the requestor and the approver can't be the same person. A common example is the use of an approver during the [running of an automation on AWS Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/running-automations-require-approvals.html). This principle can be used to implement numerous tasks including controlling access to your cloud resources. + +For generative AI workloads, implement clear separation of duties by creating distinct roles for prompt engineering, security administration, and model governance, while maintaining separate permissions for model access, management and deployment as well as establishing dedicated approval workflows for AI system changes, and enforcing strict boundaries between development and production AI environments.