{"id":114030,"date":"2022-05-18T09:00:00","date_gmt":"2022-05-18T16:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=114030"},"modified":"2023-09-18T08:57:53","modified_gmt":"2023-09-18T15:57:53","slug":"so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/","title":{"rendered":"So you want to be a CISO: What you should know about data protection"},"content":{"rendered":"\n<p>Data is the lifeblood of any organization. Whether you\u2019re a Chief Information Security Officer (CISO) or aspiring to become one, protecting sensitive business data will be your main priority. But the job isn\u2019t getting any easier. In 2021, the number of data breaches climbed 68 percent to 1,862, costing an average of USD4.24 million each.<sup>1 <\/sup>The damage from a breach touches everyone, causing diminished brand equity and consumer trust, decreased shareholder confidence, failed audits, and increased scrutiny from regulatory agencies.<\/p>\n\n\n\n<p>It\u2019s easy to become so preoccupied with protecting against the next ransomware attack that you overlook risks within your own organization. Insider leaks of sensitive data, intellectual property (IP) theft, fraud, regulatory violations\u2014any of these can crash a company (and your career) as quickly as a headline-grabbing breach. Given the breadth of today\u2019s digital estate\u2014on-premises, in the cloud, and at the edge\u2014<a href=\"https:\/\/www.microsoft.com\/security\/business\/microsoft-purview\">Microsoft Purview<\/a> provides the inside-out, integrated approach that an effective CISO needs to reduce the risk of internal and external data breaches before they occur. Here are some things to consider, both when prioritizing for yourself and talking to your board of directors.<\/p>\n\n\n<figure class=\"wp-block wp-block-embed is-provider-embed-handler wp-block-embed-embed-handler wp-embed-aspect-16-9 wp-has-aspect-ratio wp-block-embed-red-tiger\">\n\t<div\n\t\tclass=\"wp-block-embed-red-tiger__wrapper\"\n\t\tstyle=\"--video-width: 840px;--video-height: 492px\"\n\t>\n\t\t<div class=\"wp-block-embed-red-tiger__iframe-wrapper\">\n\t\t\t<iframe\n\t\t\t\tclass=\"iframe--custom-width\"\n\t\t\t\theight=\"492\"\n\t\t\t\ttitle=\"Embed video from Microsoft.com\"\n\t\t\t\twidth=\"840\"\n\t\t\t\tsrc=\"https:\/\/www.microsoft.com\/en-us\/videoplayer\/embed\/RE4V8m9\"\n\t\t\t\tallow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\"\n\t\t\t\tallowfullscreen\n\t\t\t><\/iframe>\n\t\t<\/div>\n\t<\/div>\n\t<\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Mind your own house\u2014insider threats<\/h2>\n\n\n\n<p>As the \u201c<a href=\"https:\/\/www.microsoft.com\/en-us\/worklab\/preparing-for-the-turnover-crisis\">Great Resignation<\/a>\u201d or &#8220;Great Reshuffle&#8221; rolls on, organizations worldwide are dealing with large numbers of people heading for the exits\u2014and climbing aboard. Results from Microsoft\u2019s most recent <a href=\"https:\/\/www.microsoft.com\/en-us\/worklab\/work-trend-index\/great-expectations-making-hybrid-work-work\">Work Trend Index<\/a> indicate that 43 percent of employees are likely to consider changing jobs in the year ahead. This massive shift in employment status has been accompanied by the \u201cGreat Exfiltration.\u201d Many of those transitioning employees will, intentionally or not, be leaving with sensitive data stored on personal devices or accessed through a third-party cloud. During 2021, 15 percent of workers uploaded more corporate data to personal cloud apps as compared to 2020. What\u2019s more alarming, 2021 also saw 8 percent of exiting employees upload more than 100 times their usual data volume.<sup>2<\/sup><\/p>\n\n\n\n<p>As a CISO, you\u2019re responsible for data spread across multiple platforms, devices, and workloads. You\u2019ll need to consider how that technology interacts with your organization\u2019s business processes. That includes having policies in place to prevent data exfiltration; especially if you work in a regulated industry, such as finance or healthcare. It starts with asking: Who can access the data? Where should the data reside (or not reside)? How can the data be used? How do we prevent oversharing? A modern <a href=\"https:\/\/www.microsoft.com\/security\/business\/information-protection\/microsoft-purview-data-loss-prevention\">data loss prevention<\/a> (DLP) solution\u2014cloud-native and comprehensive\u2014enables you to centrally manage all your DLP policies across cloud services, devices, and on-premises file shares. Even better, this type of unified DLP solution requires no additional infrastructure or agents, helping to keep costs down. Even in a time of great change, today\u2019s workplace requires that people remain free to create, manage, and share data across platforms and services. However, the organizations they work for are often constrained by limited resources and strict privacy standards when seeking to mitigate user risks. For that reason, you\u2019ll need tools that can analyze insider threats and provide <a href=\"https:\/\/www.microsoft.com\/security\/business\/risk-management\/microsoft-purview-insider-risk-management\">integrated detection and investigation capabilities<\/a>. The best solution for insider threats will be:<\/p>\n\n\n\n<ul><li>Transparent\u2014balancing user privacy with organizational risk by using privacy-by-design architecture.<\/li><li>Configurable\u2014enabling policies based on your industry, geographical location, and business groups.<\/li><li>Integrated\u2014maintaining a workflow that\u2019s integrated across all your data, wherever it resides.<\/li><li>Actionable\u2014providing insights to enable reviewer notifications, data investigations, and user investigations.<\/li><\/ul>\n\n\n\n<p>Protecting against insider threats should include templates and policy conditions that define which triggering events and risk indicators require examination. For that reason, your insider-risk solution should be able to look at potential risk patterns across the organization, as well as investigate risky activity with end-to-end workflows. Furthermore, a solution that helps <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/security-compliance-and-identity\/safeguard-your-people-and-data-across-new-ways-of-working-with\/ba-p\/3285727\" target=\"_blank\" rel=\"noreferrer noopener\">detect code of conduct violations<\/a> (harassing or threatening language, adult content, and sharing sensitive information) can be a reliable indicator for possible insider threats. Machine learning will help provide greater context around certain words or key phrases, so investigators can speed up remediation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Automate and integrate your data strategy<\/h2>\n\n\n\n<p>Because many organizations resist going all-in on one vendor, most CISOs have to deal with data spread across a patchwork of on-premises and cloud storage. Though clunky, legacy data silos are a fact of life. If large volumes of \u201cdark data\u201d aren\u2019t correctly classified as sensitive, then it becomes difficult to protect personally identifiable information (PII) or sensitive corporate IP and implement data loss prevention policies. A thrifty CISO needs to simplify wherever possible, using a comprehensive solution to help protect the entire digital estate. A good data management solution should provide both the flexibility for users to manually classify their documents, as well as system administrators applying auto-labeling and machine learning-trainable classifiers.<\/p>\n\n\n\n<ul><li><strong>Data discovery:<\/strong> It\u2019s not unheard of to discover that an employee unknowingly stored a customer\u2019s Social Security Number (SSN) on an unprotected site or a third-party cloud. That\u2019s why you\u2019ll want a data management solution like PII that automatically identifies sensitive data using built-in sensitive information types and regulatory policy templates, such as General Data Protection Regulation (GDPR) and Health Insurance Portability and Accountability Act of 1996 (HIPAA). And since sensitive data can land anywhere, the right solution needs to <a href=\"https:\/\/docs.microsoft.com\/microsoft-365\/compliance\/information-protection?view=o365-worldwide\" target=\"_blank\" rel=\"noreferrer noopener\">use automation to cast a wide net<\/a> across on-premises, multicloud, operational, and software as a service (SaaS) data.<\/li><\/ul>\n\n\n\n<ul><li><strong>Data classification:<\/strong> Look for unified built-in labeling that\u2019s already integrated with broadly used applications and services, allowing users to further customize sensitivity levels for their specific needs. The right solution should also allow automatic labeling and policy enforcement across an organization for faster classification and data loss prevention deployment at enterprise scale. In addition, look for unified data management solutions that identify and classify sensitive data found on-premises, multicloud, and SaaS to create a <a href=\"https:\/\/azure.microsoft.com\/services\/purview\/\" target=\"_blank\" rel=\"noreferrer noopener\">holistic map of your entire data estate.<\/a><\/li><\/ul>\n\n\n\n<ul><li><strong>Data governance:<\/strong> You want your organization\u2019s data to be discoverable, trusted, and stored in a location where it can be readily protected. Storing data longer than necessary increases your risk of exposure in a breach. On the other hand, deleting data too quickly can put your organization at risk of regulatory violations. Data retention, records management, and machine learning capabilities solve this problem by classifying data and <a href=\"https:\/\/www.microsoft.com\/security\/business\/information-protection\/microsoft-purview-data-lifecycle-management\">automatically applying lifecycle policies<\/a>, helping you manage risk and liability by keeping only the data you need and deleting what you don\u2019t.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Make data protection a team effort<\/h2>\n\n\n\n<p>A primary responsibility for any CISO is to protect the organization\u2019s IP, such as software source code, patented designs, creative works\u2014pretty much anything that gives the business a competitive edge. But with the growth of big data and changing regulatory standards, CISOs are also expected to protect user data, such as PII, personal health information (PHI), and payment card industry (PCI) data. Privacy laws are also increasing restrictions on the use, retention, and location of user data, both internally and with third-party vendors.<\/p>\n\n\n\n<p>In addition, hybrid and multicloud services create new challenges by distributing data\u2019s geographic origins, storage location, and user access points. Today\u2019s CISO needs to work with colleagues in data protection, privacy, IT, HR, legal, and compliance, meaning, you may be sharing duties with a Chief Data Officer (CDO), Chief Risk Officer (CRO), Chief Compliance Officer (CCO), and Chief Information Officer (CIO). That\u2019s a lot of acronyms at one table. So, rather than duplicate efforts or compete for territory, an effective CISO should adopt a <a href=\"https:\/\/docs.microsoft.com\/microsoft-365\/compliance\/information-protection?view=o365-worldwide\" target=\"_blank\" rel=\"noreferrer noopener\">unified solution for data protection<\/a> that helps eliminate potential redundancies and keeps your entire security team working off the same script.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Bonus tip\u2014simplify<\/h2>\n\n\n\n<p>We all know the days of firewalls and perimeter-based security aren\u2019t coming back. Enabling an effective <a href=\"https:\/\/www.microsoft.com\/security\/business\/zero-trust\">Zero Trust<\/a> approach requires the ability to protect data across a multicloud, multiplatform environment. Microsoft\u2019s decision to unify data protection, governance, and compliance capabilities as <a href=\"https:\/\/www.microsoft.com\/security\/business\/microsoft-purview\"><strong>Microsoft Purview<\/strong><\/a>\u2014bringing together the former Microsoft Azure Purview and Microsoft 365 Compliance portfolio under one brand\u2014reflects our belief that organizations need a simpler approach to data protection.<\/p>\n\n\n\n<p>If you\u2019re already a&nbsp;<a href=\"https:\/\/www.microsoft.com\/microsoft-365\/enterprise\/e5?activetab=pivot%3aoverviewtab\">Microsoft 365&nbsp;E5<\/a>&nbsp;or&nbsp;<a href=\"https:\/\/www.microsoft.com\/security\/business\/compliance\/e5-compliance?activetab=pivot%3aoverviewtab\">Microsoft 365&nbsp;E5 Compliance<\/a>&nbsp;customer, head over to the revamped&nbsp;<a href=\"http:\/\/purview.microsoft.com\/compliance\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft Purview compliance portal<\/a>&nbsp;to check out some of these changes. If you\u2019re an existing Azure Purview customer, visit the new&nbsp;<a href=\"http:\/\/purview.microsoft.com\/governance\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft Purview governance portal<\/a>. To learn more and get started, visit the&nbsp;<a href=\"http:\/\/aka.ms\/microsoftpurview\">Microsoft Purview website<\/a>&nbsp;or start a&nbsp;<a href=\"http:\/\/aka.ms\/purviewtrial\" target=\"_blank\" rel=\"noreferrer noopener\">free trial<\/a>&nbsp;today.<\/p>\n\n\n\n<p>To learn more about Microsoft Security solutions,&nbsp;<a href=\"https:\/\/www.microsoft.com\/security\/\">visit our&nbsp;website<\/a>.&nbsp;Bookmark the&nbsp;<a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\">Security blog<\/a>&nbsp;to keep up with our expert coverage on security matters. Also, follow us at&nbsp;<a href=\"https:\/\/twitter.com\/@MSFTSecurity\">@MSFTSecurity<\/a>&nbsp;for the latest news and updates on cybersecurity.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<p><sup>1<\/sup> <a href=\"https:\/\/www.ibm.com\/security\/data-breach\" target=\"_blank\" rel=\"noreferrer noopener\">Cost of a Data Breach Report 2021<\/a>, Ponemon Institute, IBM. 2021.<\/p>\n\n\n\n<p><sup>2<\/sup> <a href=\"https:\/\/www.securityweek.com\/great-resignation-comes-great-exfiltration\" target=\"_blank\" rel=\"noreferrer noopener\">With the \u2018Great Resignation\u2019 comes the \u2018Great Exfiltration\u2019<\/a>, Kevin Townsend. January 11, 2022.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Learn how insider threats, data siloes, and shifting responsibilities are all affecting data management\u2014and how security professionals can diminish risks to the organization.<\/p>\n","protected":false},"author":162,"featured_media":114303,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3659],"topic":[3668,3669,4121,3689],"products":[3710],"threat-intelligence":[],"tags":[3787],"coauthors":[2291],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>So you want to be a CISO: What you should know about data protection | Microsoft Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"So you want to be a CISO: What you should know about data protection | Microsoft Security Blog\" \/>\n<meta property=\"og:description\" content=\"Learn how insider threats, data siloes, and shifting responsibilities are all affecting data management\u2014and how security professionals can diminish risks to the organization.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2022-05-18T16:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-09-18T15:57:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/Logistics_4800x3200.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"800\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Alym Rayani\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/Logistics_4800x3200.png\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alym Rayani\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/alym-rayani\/\",\"@type\":\"Person\",\"@name\":\"Alym Rayani\"}],\"headline\":\"So you want to be a CISO: What you should know about data protection\",\"datePublished\":\"2022-05-18T16:00:00+00:00\",\"dateModified\":\"2023-09-18T15:57:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/\"},\"wordCount\":1476,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/Logistics_4800x3200.png\",\"keywords\":[\"Microsoft 365\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/\",\"name\":\"So you want to be a CISO: What you should know about data protection | Microsoft Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/Logistics_4800x3200.png\",\"datePublished\":\"2022-05-18T16:00:00+00:00\",\"dateModified\":\"2023-09-18T15:57:53+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/Logistics_4800x3200.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/Logistics_4800x3200.png\",\"width\":1200,\"height\":800,\"caption\":\"A picture of a truck on a winding road\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"So you want to be a CISO: What you should know about data protection\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"So you want to be a CISO: What you should know about data protection | Microsoft Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/","og_locale":"en_US","og_type":"article","og_title":"So you want to be a CISO: What you should know about data protection | Microsoft Security Blog","og_description":"Learn how insider threats, data siloes, and shifting responsibilities are all affecting data management\u2014and how security professionals can diminish risks to the organization.","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/","og_site_name":"Microsoft Security Blog","article_published_time":"2022-05-18T16:00:00+00:00","article_modified_time":"2023-09-18T15:57:53+00:00","og_image":[{"width":1200,"height":800,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/Logistics_4800x3200.png","type":"image\/png"}],"author":"Alym Rayani","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/Logistics_4800x3200.png","twitter_misc":{"Written by":"Alym Rayani","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/alym-rayani\/","@type":"Person","@name":"Alym Rayani"}],"headline":"So you want to be a CISO: What you should know about data protection","datePublished":"2022-05-18T16:00:00+00:00","dateModified":"2023-09-18T15:57:53+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/"},"wordCount":1476,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/Logistics_4800x3200.png","keywords":["Microsoft 365"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/","name":"So you want to be a CISO: What you should know about data protection | Microsoft Security Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/Logistics_4800x3200.png","datePublished":"2022-05-18T16:00:00+00:00","dateModified":"2023-09-18T15:57:53+00:00","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/Logistics_4800x3200.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/Logistics_4800x3200.png","width":1200,"height":800,"caption":"A picture of a truck on a winding road"},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/18\/so-you-want-to-be-a-ciso-what-you-should-know-about-data-protection\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"So you want to be a CISO: What you should know about data protection"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/114030"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/162"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=114030"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/114030\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media\/114303"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=114030"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=114030"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=114030"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=114030"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=114030"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=114030"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=114030"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}