informa
Slideshow

10 Tips for Building Compliance by Design into Cloud Architecture

A pair of experts pass along lessons learned while building out the team and processes necessary to support Starbucks' mobile app.
Put Compliance Requirements Into the Definition of 'Done'
Make Engineers Directly Responsible for Securing the Environment
Create a Close Alliance Between Cloud Engineering and Security Teams
Define Security Procedures and Requirements Before Build
Embed and Train Security Expertise into the Engineering Team
Harden Environments Automatically with Compliance as Code
Automate Guardrails
Build Compliance-Based Testing into Unit Tests
Use Cloud-Native Controls Wherever Possible
Have Engineers Take a Big Role in Gap Assessments
1/10

Among the speakers at last week's (ISC)2 Congress were a pair of security and compliance leaders who helped build out a major cloud project for Starbucks. Matt Wells and Scott Schwan, founders of compliance automation startup Shujinko, were called on by Starbucks several years back to build out the team and processes necessary to support Starbucks' mobile app with fully PCI-compliant and secure cloud architecture measured against standards established by the Center for Internet Security (CIS).

"Basically, in about nine to 12 months, with 20 engineers, we were able to build a highly automated, scalable, repeatable environment that Starbucks could use to back everything they'd want to roll out, and they used that as a foundation to then start moving other applications to the public cloud," explained Wells, who serves as CTO.

Wells and Schwan, CEO, delved into the details of their work at Starbucks to offer the crowd tips on how to bake compliance into their own cloud architecture and scale DevSecOps in the process. We offer the highlights from their insights, in their own words.

 

 
Next slide
Recommended Reading: