AWS wellarchitected documentation change
Summary
Added comprehensive security guidance for generative AI adoption in financial services, covering risks like prompt injection and data poisoning, plus new controls for AI governance, agent security, and model protection.
Security assessment
The changes proactively document security best practices for emerging generative AI technologies rather than addressing a specific vulnerability. New content covers threat prevention (prompt injection, data poisoning), AI-specific controls (agent authentication, action boundaries), and regulatory compliance for AI systems, enhancing security guidance without evidence of patching existing flaws.
Diff
diff --git a/wellarchitected/latest/financial-services-industry-lens/security.md b/wellarchitected/latest/financial-services-industry-lens/security.md index 037d1d63a..d5864ae01 100644 --- a//wellarchitected/latest/financial-services-industry-lens/security.md +++ b//wellarchitected/latest/financial-services-industry-lens/security.md @@ -10,0 +11,2 @@ The security pillar focuses on the ability to protect information, systems, and +With the adoption of generative AI technologies, financial institutions face additional security challenges in protecting sensitive financial data, preventing unauthorized model access, and ensuring AI system outputs comply with regulatory requirements. FIs must implement comprehensive security controls across AI components including models, data stores, and endpoints while preventing potential risks such as prompt injection, data poisoning, or harmful model responses that could impact customer data or financial operations. + @@ -15 +17,3 @@ In addition to the [design principles](https://docs.aws.amazon.com/wellarchitect - * **Security by design** : Financial services institutions must consider a Security by Design (SbD) approach to implement architectures that are pre-tested from a security perspective. SbD helps implement the control objectives, security baselines, security configurations, and audit capabilities for applications running on AWS. Standardized, automated, prescriptive, and repeatable design templates help accelerate the deployment of common use cases as well as help align with security standards across multiple workloads. For example, to protect customer data and mitigate the risk of data disclosure or alteration of sensitive information by unauthorized parties, financial institutions need to employ encryption and carefully manage access to encryption keys. SbD allows you to turn on encryption for data at rest, in transit, and if necessary, at the application level by default. + * **Security by design:** Financial services institutions must consider a Security by Design (SbD) approach to implement architectures that are pre-tested from a security perspective. SbD helps implement the control objectives, security baselines, security configurations, and audit capabilities for applications running on AWS. Standardized, automated, prescriptive, and repeatable design templates help accelerate the deployment of common use cases as well as help align with security standards across multiple workloads. For example, to protect + + @@ -17 +20,0 @@ In addition to the [design principles](https://docs.aws.amazon.com/wellarchitect - * **Identify regulatory requirements to be implemented** : Regulators expect financial services institutions to define security objectives for workloads, and implement policies that help achieve those objectives. Regulators may also impose their own external requirements on specific workloads and expect institutions to monitor and report on their compliance with these requirements, with penalties for breaching them. Those requirements must be translated into security control objectives that are sustainable over time but flexible to adapt as regulations evolve. @@ -19 +22 @@ In addition to the [design principles](https://docs.aws.amazon.com/wellarchitect - * **Automated infrastructure and application deployment:** Automation helps companies to perform and innovate quickly and scale security, compliance, and governance activities across their cloud environments. Financial services institutions that invest in automated infrastructure and application deployment are able to accelerate the rate of deployments and embed security and governance best practices into their software development lifecycle. +customer data and mitigate the risk of data disclosure or alteration of sensitive information by unauthorized parties, financial institutions need to employ encryption and carefully manage access to encryption keys. SbD allows you to turn on encryption for data at rest, in transit, and if necessary, at the application level by default. For generative AI workloads, SbD must include implementing comprehensive access controls across AI components, securing data and communication flows, and establishing guardrails to govern how AI systems interact with data and execute workflows. @@ -21 +24,5 @@ In addition to the [design principles](https://docs.aws.amazon.com/wellarchitect - * **Automated Governance:** Manual governance processes that rely on runbooks and checklists often lead to delays and inaccurate results. Automated governance provides a fast, definitive governance check for application deployments at scale. Governance at scale typically addresses the following components: + * **Identify regulatory requirements to be implemented:** Regulators expect financial services institutions to define security objectives for workloads and implement policies that help achieve those objectives. Regulators may also impose their own external requirements on specific workloads and expect institutions to monitor and report on their compliance with these requirements, with penalties for breaching them. Those requirements must be translated into security control objectives that are sustainable over time but flexible to adapt as regulations evolve. With generative AI adoption, financial institutions must consider additional regulatory requirements around model governance, data protection, and AI system outputs. This includes implementing controls to prevent harmful or biased responses, verifying the explainability and auditability of decisions, and protecting sensitive financial data used in AI training and inference. + + * **Automated infrastructure and application deployment:** Automation helps companies to perform and innovate quickly and scale security, compliance, and governance activities across their cloud environments. Financial services institutions that invest in automated infrastructure and application deployment can accelerate the rate of deployments and embed security and governance best practices into their software development lifecycle. For generative AI systems, automation should extend to response validation, prompt security, and model access controls to ensure consistent security across AI workloads. + + * **Automated governance:** Manual governance processes that rely on runbooks and checklists often lead to delays and inaccurate results. Automated governance provides a fast, definitive governance check for application deployments at scale. Governance at scale typically addresses the following components: @@ -28,0 +36,12 @@ In addition to the [design principles](https://docs.aws.amazon.com/wellarchitect + * **AI system governance:** Implement automated guardrails and monitoring for model responses, data access patterns, and prompt security to maintain control over AI system behaviors while enabling innovation. + + * **Agent authentication and authorization:** Implement fine-grained permission models for agent actions with principle of least privilege. + + * **Agent action boundaries:** Define clear security boundaries for what actions agents can perform. + + * **Agent chain-of-thought security:** Implement security controls for agent reasoning processes. + + * **Tool access controls:** Establish governance for which tools agents can access and under what conditions. + + * **Agent prompt injection protection:** Implement safeguards against manipulation of agent instructions or goals. +