* [Blog](https://www2.paloaltonetworks.com/blog) * [Cloud Security](https://www2.paloaltonetworks.com/blog/cloud-security/) * [Data Detection and Response](https://www2.paloaltonetworks.com/blog/cloud-security/category/data-detection-and-response/) * How to Build an Enterpris... # How to Build an Enterprise Data Security Team [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fhow-to-build-enterprise-data-security-team%2F) [](https://twitter.com/share?text=How+to+Build+an+Enterprise+Data+Security+Team&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fhow-to-build-enterprise-data-security-team%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fhow-to-build-enterprise-data-security-team%2F&title=How+to+Build+an+Enterprise+Data+Security+Team&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www2.paloaltonetworks.com/blog/cloud-security/how-to-build-enterprise-data-security-team/&ts=markdown) \[\](mailto:?subject=How to Build an Enterprise Data Security Team) Link copied By [Dan Benjamin](https://www.paloaltonetworks.com/blog/author/dan-benjamin/?ts=markdown "Posts by Dan Benjamin") Apr 16, 2024 9 minutes [Data Detection and Response](https://www.paloaltonetworks.com/blog/cloud-security/category/data-detection-and-response/?ts=markdown) [Data Security](https://www.paloaltonetworks.com/blog/category/data-security/?ts=markdown) [Data Security Posture Management](https://www.paloaltonetworks.com/blog/cloud-security/category/data-security-posture-management/?ts=markdown) [DLP](https://www.paloaltonetworks.com/blog/tag/dlp/?ts=markdown) ![How to Build an Enterprise Data Security Team](https://www.paloaltonetworks.com/blog/wp-content/uploads/2024/04/how-to-build-an-enterprise-data-security-team.png) Leading a data security company comes with great responsibility. A good chunk of my time is spent with security leaders discussing top-of-mind trends and topics. One trend I've come across is the desire of security leaders to rebuild their data security teams -- which also happens to raise many questions. For example: What areas should the team be responsible for? What skills and tools should they be looking for? What KPIs should they use to measure the team's ability to support the organization's growth in this new era? This was also the topic of a recent talk that I, together with my good friend Tyson Kopczynski, Global CISO of Oportun, gave at the Team8 CISO summit. ## Why Are Enterprises Building Dedicated Data Security Teams? Before diving into the details, let me address a more basic question. Why are organizations rebuilding their data security teams in the first place? The shift to cloud computing has been accompanied by new ways to process and store data. Given that microservices are now the new norm, data has sprawled and fragmented, with each team using its own copy of the data. And the end result is that organizations are now facing a number of new challenges: ### **More Data Collected** To support the vast amount of collected data, the size and variety of data assets in a typical organization has grown by at least 4 times, leaving it with over 20 different types of data services (i.e. storage, database, and analytic platforms) spanning hundreds -- if not thousands -- of instances. And the numbers keep on growing. ### **More Shadow Data** The result is a growing amount of "shadow data'' that accumulates in the form of orphaned snapshots and database backups. Since they can't be tracked by legacy tools, they can be easily exposed to attackers looking to ransom data. Even if you take ransom money out of the equation, the average cost of a data breach exceeds $4 million, according to IBM's Cost of a Data Breach 2022. ### **More Regulations** As data continues to move and grow, organizations are required to comply with more [data privacy](https://www.paloaltonetworks.com/cyberpedia/data-privacy), data sovereignty, and data governance regulations. Keeping inventory of PII, PCI, and PHI data, however, is more challenging than ever, especially with most tools limited to a single architecture, service, cloud, or policy. As with any new reality, there's a need for new solutions and a new security stack. With the perimeter now irrelevant, security leaders are realizing they need to secure the data itself. In the past, protecting sensitive data from exfiltration was done either at the endpoint (EDR) or the network (NDR/XDR). But 90% of attacks on data in the cloud never even reach the endpoint. That's why security leaders are quickly realizing that to succeed in the new world of data, they need a dedicated data security team. But where should they begin? ## Key Responsibilities of a Data Security Team A good place to start is by defining the responsibilities of a [data security](https://www.paloaltonetworks.com/cyberpedia/what-is-data-security) team and understanding how it differs from other cybersecurity groups. ### **Data Inventory and Classification Across All Enterprise Datastores** There's an old saying that you can't protect what you don't know. Knowing your data, where it is stored, and what is stored in it is at the top of the team's responsibilities and represents the foundation of data security. An organization's data assets are not stored on-prem, but rather in cloud [SaaS](https://www.paloaltonetworks.com/cyberpedia/what-is-saas), [PaaS](https://www.paloaltonetworks.com/cyberpedia/what-is-pass), and [IaaS](https://www.paloaltonetworks.com/cyberpedia/what-is-infrastructure-as-a-service), with the latter providing no data management APIs. And more than half of cloud data is considered "dark" -- that is, data no longer in use that is left unprotected. ### **Data Classification** [Data classification](https://www.paloaltonetworks.com/cyberpedia/data-classification) identifies [personal information (PII)](https://www.paloaltonetworks.com/cyberpedia/pii), patient records (PHI), and [credit card information (PCI)](https://www.paloaltonetworks.com/cyberpedia/pci-dss). But it can also locate an organization's crown jewels such as trade secrets. Whether the data is [structured](https://www.paloaltonetworks.com/cyberpedia/structured-data), semi-structured, or unstructured, all of it should be classified. In addition, inventory should include other data contexts such as location, environment (production vs. development), or anything else that can help you decide how it should be protected. ### **Data Ownership and Governance** The team should engage its business units to assign data owners by providing them with context. Data owners can determine whether certain risks should be remediated or controlled. For example: Should encryption be turned on? Should versioning be conducted? Should access be granted or removed? ### **Data Security Posture Management (** [**DSPM**](https://www.paloaltonetworks.com/cyberpedia/what-is-dspm)**)** Your data security team should ensure that proper controls are assigned to all data assets. These include [encryption](https://www.paloaltonetworks.com/cyberpedia/data-encryption), logging, retention, authentication, and authorization for datastores that contain customer and other sensitive information. Using the context of the data (through [discovery](https://www.paloaltonetworks.com/cyberpedia/data-discovery)) can help you prioritize various risks and work with their business owners to remediate. ### **Real-Time Data Detection and Response (** [**DDR**](https://www.paloaltonetworks.com/cyberpedia/data-security-posture-management-why-dspm)**)** Since data is constantly changing, each risk that arises represents an opportunity for an attacker to exploit. No data security stack could be complete without real-time detection of risks followed by response. ### **Understanding the Data Attack Kill Chain** Knowing your enemy and how they act improves your chances to win. Here's an example of a series of events that can lead to data theft and exfiltration: * Disabling security measures or modifying IAM policies are examples of an attacker making "first moves" along the data kill chain. * Disabling control that allows data movement across different accounts could constitute a compliance breach. * Starting mass download of sensitive data, altering storage in production environments, or transferring sensitive data to a foreign account are examples of popular attacks that often take months to discover, especially if the attackers cover their tracks. ### **Applying Data Detection and Response (DDR) to All Data** The ability to detect events and respond in real time to attacks is essential regardless of where your data is stored. To carry out DDR, you need to: * Actively monitor all sensitive data assets across different environments using available logs * Build a threat model around the attack vector for each data service such as storage bucket, database, and data analytics to map the steps -- for example, reconnaissance, first move, and attack -- in the attack kill chain * Analyze each data interaction that could lead to a breach, and when a real threat arises, immediately raise an alert to issue a response ## The Data Security Toolkit The world of information protection is complex. You can simplify current offerings by dividing them into three categories. ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2024/04/word-image-319432-2.jpeg) * **Data privacy**: Focuses on fulfilling privacy regulation requirements for data containing PII and PHI through business workflows such as data subject access rights (DSARS) and data subject consent tools. Examples include OneTrust and BigID. * [**Data governance**](https://www.paloaltonetworks.com/cyberpedia/data-governance): Focuses on building policies to define who is allowed to access [sensitive data](https://www.paloaltonetworks.com/cyberpedia/sensitive-data) through role definitions and data ownership. Examples include Colibra, Privacera, and Alation. * **Data security**: Enterprise data currently resides across five locations, each with its own solution. With 60% of the world's corporate data stored in the cloud, data security is clearly becoming the largest force in the market today. ## Lessons Learned from Building a Data Security Program Building a data security team does not happen overnight and requires an understanding of the domain and the business. Learning from others who have either built a team or experienced its establishment can help you avoid mistakes along the way. Here are a few points to keep in mind: ### Accelerate Time to Value Using the Right Tools and Internal Partners Many teams fail to estimate the total cost of building versus buying solutions, especially in cybersecurity, which involves a never-ending cat-and-mouse game. Finding the right tool for your business will save you time and money. Partner internally with people who will support your initiatives and help you drive the change you need. ### Start with "The Edges" Don't try to build granular policies on day 1. There are problems common to all datastores, such as visibility and classification. Start by discovering where your sensitive data is and what is stored in it. This will help you prioritize your work later on by applying top-down logging and retention.‍ ### Separate Static Risk and Real-Time Risk Different risks are remediated by different teams. Static risks, such as misconfigured data (e.g. bucket open to the world, production data not encrypted) should be handled by the data owners and IT. Real-time events that pose a risk, like an actor's attempt at transferring data to an external account, should be handled immediately upon being alerted by the security operation team (SOC). ### Additional Tips * Train your data security analysts in mitigating data risk * Train your SOC team in real-time data security alerts‍ * Hire people who can navigate the organization and understand complex environments. Borrow people from relevant teams such as GRC, IT, and [IAM](https://www.paloaltonetworks.com/cyberpedia/what-is-identity-and-access-management). Bringing about change requires an understanding of the existing processes and working with familiar colleagues to help drive and support it. ‍ * Focus on where data is growing at accelerated rates. That's where new attacks will be coming from. ## Measuring Success from Inception to Launch As you're building your data security team, consider who you should be adding. To measure their success once a program is up and running, take a look at the questions below. How you answer them is an excellent way to track your KPIs. * What data does my organization collect and store? * Can I list all locations where sensitive data resides? Do I know what type of sensitive data exists in each location? * Do we have data owners assigned for different data stores, and do they certify the data controls periodically? Who can access sensitive data, and what are they allowed to do with it? * How do we strengthen the security posture of all sensitive data such as encryption, logging, and retention, which, unless remediated, may lead to [data leaks](https://www.paloaltonetworks.com/cyberpedia/data-leak)? * Do we monitor our data assets to identify suspicious activities that may lead to [data exfiltration](https://www.paloaltonetworks.com/cyberpedia/data-exfiltration)? * Data detection and response (DDR) and [cloud data loss prevention (DLP)](https://www.paloaltonetworks.com/cyberpedia/cloud-data-loss-prevention) -- Do we have the right controls to detect and stop data from exfiltrating from our organization? * Can we respond to new data risks within minutes to stop data leaking and prevent a breach? * What are our company's [data security policies](https://www.paloaltonetworks.com/cyberpedia/data-security-policy), and how often are they updated? What compliance requirements apply to my organizations, and are we aligned with our internal and external auditors? * Are we using tools to defend our organizational data from recent attack techniques (tools that use frameworks such as the [MITRE ATT\&CK framework](https://www.paloaltonetworks.com/cyberpedia/what-is-mitre-attack) and are up to date with current adversary tactics)? ## Learn More If you're interested in discussing this with me, please get in touch. I'd love to support your journey of building an enterprise data security team. And if you'd like to see Prisma Cloud in action, why not [book a demo](https://start.paloaltonetworks.com/prisma-cloud-dspm-demo-request.html)? *** ** * ** *** ## Related Blogs ### [Data Detection and Response](https://www.paloaltonetworks.com/blog/cloud-security/category/data-detection-and-response/?ts=markdown), [Data Security](https://www.paloaltonetworks.com/blog/category/data-security/?ts=markdown), [Data Security Posture Management](https://www.paloaltonetworks.com/blog/cloud-security/category/data-security-posture-management/?ts=markdown) [#### Redshift Security: Attack Surface Explained](https://www2.paloaltonetworks.com/blog/cloud-security/redshift-security-attack-surface-explained/) ### [Data Detection and Response](https://www.paloaltonetworks.com/blog/cloud-security/category/data-detection-and-response/?ts=markdown), [Data Security](https://www.paloaltonetworks.com/blog/category/data-security/?ts=markdown), [Data Security Posture Management](https://www.paloaltonetworks.com/blog/cloud-security/category/data-security-posture-management/?ts=markdown) [#### Redshift Security: Access and Data Flows Explained](https://www2.paloaltonetworks.com/blog/cloud-security/redshift-inside-out-part-1/) ### [Data Detection and Response](https://www.paloaltonetworks.com/blog/cloud-security/category/data-detection-and-response/?ts=markdown), [Data Security](https://www.paloaltonetworks.com/blog/category/data-security/?ts=markdown), [Data Security Posture Management](https://www.paloaltonetworks.com/blog/cloud-security/category/data-security-posture-management/?ts=markdown), [DLP](https://www.paloaltonetworks.com/blog/cloud-security/category/dlp/?ts=markdown) [#### Data Security Platforms: 9 Key Capabilities and Evaluation Criteria](https://www2.paloaltonetworks.com/blog/cloud-security/data-security-platform-capabilities-criteria/) ### [Data Detection and Response](https://www.paloaltonetworks.com/blog/cloud-security/category/data-detection-and-response/?ts=markdown), [Data Security](https://www.paloaltonetworks.com/blog/category/data-security/?ts=markdown), [Data Security Posture Management](https://www.paloaltonetworks.com/blog/cloud-security/category/data-security-posture-management/?ts=markdown) [#### Cloud Data Security \& Protection: Everything You Need to Know](https://www2.paloaltonetworks.com/blog/cloud-security/cloud-data-security-protection-everything-you-need-to-know/) ### [Data Detection and Response](https://www.paloaltonetworks.com/blog/cloud-security/category/data-detection-and-response/?ts=markdown), [Data Security](https://www.paloaltonetworks.com/blog/category/data-security/?ts=markdown), [Data Security Posture Management](https://www.paloaltonetworks.com/blog/cloud-security/category/data-security-posture-management/?ts=markdown) [#### Prisma Cloud Data Security Vs. Other CSPM Vendors](https://www2.paloaltonetworks.com/blog/cloud-security/dspm-vs-cspm/) ### [Data Detection and Response](https://www.paloaltonetworks.com/blog/cloud-security/category/data-detection-and-response/?ts=markdown), [Data Security](https://www.paloaltonetworks.com/blog/category/data-security/?ts=markdown), [Data Security Posture Management](https://www.paloaltonetworks.com/blog/cloud-security/category/data-security-posture-management/?ts=markdown) [#### Shadow Data Is Inevitable, But Security Risks Aren't](https://www2.paloaltonetworks.com/blog/cloud-security/shadow-data-risk-mitigation/) ### Subscribe to Cloud Security Blogs! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www2.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language