All news with #data security tag

🔍 Bank of America disclosed significant IT spending after an AI security audit and regulatory scrutiny found weaknesses in its anti-money-laundering controls. CEO Brian Moynihan said the bank has invested billions in technology and thousands of staff to fight financial crime, with several hundred million in Q3 spent on AML remediation. The bank also hired around 1,000 consultants to fix software vulnerabilities identified following an early release of Claude Mythos Preview.

🚀 This post describes how Google Cloud’s borderless Lakehouse uses the Apache Iceberg REST catalog to federate metadata from Databricks, Snowflake, and AWS Glue so BigQuery can query data in place without migrating it. It outlines configuration steps for Unity Catalog, federated catalog creation, permission grants, and running a single SQL query that joins tables across three clouds. The article also shows how to expose the federated join as a view for conversational analytics and discusses caching, residency, and encryption considerations.

🔍 Amazon EMR now performs native data quality validation inside Apache Spark jobs, letting teams detect and act on bad data inline without separate validation infrastructure. Powered by AWS Glue, Amazon EMR Data Quality uses the same declarative Data Quality Definition Language and APIs as Glue, supports Apache Iceberg, Hudi, and Delta Lake, and runs across EC2, EKS, and Serverless modes. It offers 30+ rule types, dynamic historical comparisons, and ML-based anomaly detection, with actions like failing pipelines, filtering, or quarantining records. Results are produced at dataset, rule, and row level, and the feature is available on emr-spark-8.1.0 in all AWS Commercial and GovCloud regions where EMR is offered.

🔍 Amazon DynamoDB now supports filtered export to Amazon S3, letting you export only the items and attributes you specify. Using a key condition expression, filter expression, and projection expression, you can produce datasets tailored for granular recovery, cross-account transfers, analytics, or compliance. Filtered export works with both full and incremental exports and is available in all AWS Regions except AWS GovCloud (US). See the DynamoDB developer guide to get started.

🔒 Amazon S3 Object Lock variable retention with event holds is now available in AWS GovCloud (US-East) and AWS GovCloud (US-West). This feature lets you place an event hold with a retention duration so objects receive WORM protection starting from a future event, such as a contract close or audit completion. Unlike legal holds, event holds enforce retention for the specified period after release, helping meet event-based regulatory requirements without over-retention. Cohasset Associates has assessed this capability for SEC, FINRA, and CFTC compliance contexts.

🛠️ Today Cloudflare announces Basin, the generally available name for its serverless data analytics platform built on Apache Iceberg and R2 Object Storage. Basin includes Pipelines for ingestion, Catalog for managed Iceberg tables, and SQL for distributed querying, all designed for speed, openness, and cost efficiency. The platform supports Iceberg-compatible tools, provides free egress, usage-based billing, and a developer-friendly workflow with integrations across Cloudflare services.

🔍 AWS CloudTrail has launched Event Coverage, a console feature that displays data plane event logging coverage across accounts and organizations. It highlights which services and resource types have data event logging enabled and which do not, helping teams identify logging gaps without manual scans. The dashboard consolidates supported data event sources and lets users subscribe to data events directly to close coverage gaps quickly.

🆕 Amazon S3 Tables now support the Apache Iceberg Version 3 data types including geometry, geography, unknown, and nanosecond-precision timestamps, plus column default values. These additions let you store geospatial coordinates and nanosecond event times natively, reducing the need to encode values as strings or integers and improving efficiency and query performance. S3 Tables continue to provide automatic maintenance and compaction for Iceberg tables and are available in all Regions where S3 Tables are offered.

🛡️Signal released version 8.30, finishing the rollout of its encrypted backups across Android, iOS, Linux, macOS, and Windows. The update introduces on-device local backups for iOS and desktop and harmonizes Android backups to a single cross-platform format. Hosted and local backups remain end-to-end encrypted and require recovery keys, while hosted backups include a rotating supplemental key for added protection.

🔒 AWS Elemental MediaLive now supports A/B forensic watermarking, allowing content owners to trace unauthorized redistribution of live video by producing two synchronized output variants with distinct transparent watermarks. These marks persist through re-encoding and screen capture and are assembled downstream into per-session sequences that identify the leak source. The feature follows the DASH-IF A/B watermarking spec (ETSI TS 104 002) and can be configured on CMAF Ingest output groups via the MediaLive API or console.

🔒 Amazon Elastic Block Store (Amazon EBS) Volume Clones now supports copying volumes across AWS accounts with re‑encryption using AWS Key Management Service (AWS KMS) keys in the target account. This lets organizations segregate production and development accounts while sharing data safely. The feature supports all volume types, including unencrypted and customer‑managed KMS‑encrypted volumes, and is available via the Console, CLI, and SDKs in supported Regions.

🔔 Amazon Connect Customer Profiles now emits segment membership events to notify when customer profiles enter or exit segments such as high-value or low-satisfaction cohorts. This removes the prior need to export full segments and run differential scripts, which caused delays and errors. Events stream to Amazon Kinesis Data Streams and include profile ID, segment name, operation type, and whether the change was real-time or from a scheduled snapshot. Real-time detection applies to standard-condition segments, while enhanced segments (Spark SQL) use configurable periodic snapshots.

🔧 Amazon SageMaker Feature Store now supports feature-level writes, enabling updates to individual features within a record without rewriting the entire record. This reduces write latency and cost by allowing pipelines to replace read-modify-write patterns with single update calls. Multiple pipelines can independently update different features in the same feature group, simplifying ingestion logic for streaming and batch jobs. The feature is available in all Regions where SageMaker Feature Store is offered.

🔒 Over years of building large-scale personalization and commerce systems, the author argues that compliance alone does not create customer trust. Real trust comes from ensuring customer intent is respected across distributed services, caches, pipelines and AI systems. The piece highlights five priorities: consistent customer intent, privacy as a distributed-systems problem, data minimization, designing for failure, and understanding AI's expanding trust boundary. Security leaders are urged to treat trust as an architectural and operational priority, with observability and metadata-driven controls.

🛡️ This recap highlights AWS Security blog posts, new capabilities, code samples, and guidance published in July 2026. Topics include AI agent security, data protection, network and infrastructure protections, threat detection enhancements, compliance guidance, and 21 security bulletins addressing vulnerabilities. Vendors and practitioners can use the code samples and workshops to implement recommended controls and apply patches promptly.

🔒 AWS Clean Rooms now supports minimum aggregation thresholds for the Custom analysis rule type, preventing queries from returning results about individuals or small groups. Data providers can enforce a minimum identity count (for example, user IDs) per output row and set higher thresholds for specific columns. The update removes the need for pre-approved templates and manual code reviews, allowing ad-hoc custom SQL while specifying which columns may be filtered or joined to protect privacy.

🔒 Amazon Web Services announces it has completed the 2025-26 NHS Data Security and Protection Toolkit (DSPT) assessment, achieving a status of Standards Exceeded. The DSPT measures performance against the National Data Guardian’s 10 data security standards for organizations accessing NHS patient data. AWS’s assessment status is valid until June 30, 2027, and the compliance certificate is available via the NHS England website and AWS Artifact. AWS reiterates that security and compliance are a shared responsibility between the provider and the customer.

📥 AWS Clean Rooms now supports exporting privacy-enhanced analysis logs for SQL analyses to an S3 bucket, giving customers improved optimization and troubleshooting capabilities. Collaboration owners can grant members permission to export logs when creating a collaboration or via change requests for existing collaborations. After a query runs, privacy-enhanced Spark execution details can be exported to a chosen S3 path to help identify issues like data skew and reduce resolution time and costs.

🔔 The next generation of Amazon OpenSearch Serverless now supports up to 10,000 collections within a single collection group, increased from the previous limit of 1,500. Collection groups let multiple collections share OpenSearch Compute Units (OCUs) even when encrypted with different AWS KMS keys. This change enables greater consolidation, improved compute utilization, and reduced per-collection costs for multi-tenant workloads. The higher limit applies automatically to new and existing nextgen collection groups in all available AWS Regions.

🔒 This new guidance helps covered entities and business associates implement and evidence compliance with the HIPAA Security Rule Technical Safeguards (45 CFR §164.312) when building healthcare workloads on AWS. It explains the five standards and nine implementation specifications for access control, audit controls, integrity, authentication, and transmission security. The document also addresses proposed 2025 NPRM changes—such as mandatory encryption, MFA, and new network and configuration controls—and recommends treating all specifications as required for new workloads.