GOTD - Compliation
===

Speaker 2: [00:00:00] Welcome to Guardians of the Data. I'm your host, ward Balza. Each episode will explore the passions, expertise, and real world experiences of security leaders who are helping the future of data security and governance. Guardians of the data is made possible by support from Centro. To learn more about our AI powered data security platform, please visit sentra.io.

Let's dive in.

ward-balcerzak_14_10-24-2025_090330: it's a much bigger risk to classify data inappropriately than to not have it classified at all. and.

and

that, that statement actually opened doors because, you know, I, I found like the biggest concern wasn't that we were doing this thing, which I thought that's what it was.

I thought that was the pushback. We don't want to click a button, we don't want to classify data, we don't wanna do those things. We don't see the value. Like, I've often heard those objections, but the objection being, we don't want to misclassify 'cause that's a bigger risk to the organization.

Tobias Simpson: [00:01:00] conducting a tabletop exercise with departments across the organization. To classify what type of data they're using and storing and moving and, and what's important to that department.

Because I think if you, you narrow down and you put focus on and strategically plan around what those departments hold as their golden egg of data, I think that's going to, that's gonna smooth out the process and you have to do that.

Hans Vargas: A foreign agent in an organization or a department, and then you are, um, auditing what, what their information is and asking questions, and maybe they haven't, they haven't been accustomed to answer and I think it's important to, for them to know that you are not there to hurt them.

You are there to help them. It may be as silly as as it is, uh, I don't know if you've seen some of those, um, helping hoarder, uh, [00:02:00] TV shows where people a comes and basically it through the, the entire home and. There are some requirements, like anything older than this. Anything here, anything that is, you know, broken needs to be pitched and, but there are some other things that they say, Hey, I wanna keep my, any picture I wanna keep, or at at least I want to review.

If you find a golden green, um, please let me know because it's missing. Um, uh, I, my military. No, those things are, are, are tough and they're very emotional sometimes because you are, you are coming and you, you have obviously a different lens than the owner of the data, but you are trying to help them to get to a better place.

Trevor Dolan: we broke it down into essentially five main areas. Um, first main area being, uh, more focused around governance and [00:03:00] leadership. At a high level, that's making sure that you have a good foundation from a leadership perspective of developing and defining the scope, um, getting buy-in from key stakeholders and, uh, really aligning the, the program, uh, to, to get started.

Uh, second major area is assessing where you are, where are you today? Um, you know, leveraging frameworks like, uh, nist, CSF or others that are out there doing maturity assessment. Um, identify where you are, uh, currently where you want to be, and developing a roadmap. Third one is making sure that you have good policies and procedure frameworks to support what you are doing and, and clearly define those requirements for the organization, but also for the technology to enforce.

Finally, or actually, um, th uh, fourth is, uh, training and awareness to make sure that, um, those policies, those frameworks and uh, um, those requirements are disseminated throughout the organization and the employee and the workforce. Uh, understand what those [00:04:00] expectations are. And then finally, from a team and organizational structure, make sure you have the right mix of team members from a engineering, operational, and a governance perspective, uh, to support the mission and to deliver those capabilities for the organization.

it doesn't need to be a full, you know, overhaul of all your policies and procedures.

Identify the pain points that need to be addressed, address those first, but then put those other items in the backlog of your roadmaps so you can say, these are the things that we, we did. These are the things that we still know that we need to do. And they're on the, the, uh, um, the future plan. Um, that way it's, it's defensible when you have those conversations later on.

You know, why, why wasn't this addressed yet?

squadcaster-13ib_1_11-07-2025_103419: a,

Matthew Gonzales: you need to define a vision and a mission I know that sounds kind of corny and cheesy, but, um, you really need to do that just to kind of really understand what it is that you're trying to do. And it really needs to be something that is a, a step down from a broader cybersecurity vision and mission, or an organization vision and mission, right?

[00:05:00] It should be used to enhance. the greater organizational, uh, mission and vision, right? And you, that allows you to set the tone of what it is you're trying to do and where you're trying to go. And then from there, right, it's really setting business objectives because once you understand what it is you're trying to do, then you can set some business objectives, right?

Hans Vargas: I think it's a little bit of storytelling. If we don't have a good story, why we need to classify and protect data, then we are not. We're not, maybe we're failing at communicating because we do classification all the time. You know, we do it at home. We do it on the daily. This is how we operate.

At least maybe I'm a little biased because I like organizing things in my life. because it provides me some, framework on how things work. I don't know. I don't know about you, but, you know, I usually put my forks with the forks, you know, the spoons with the spoons. And [00:06:00] I put in a specific place don't just drop it everywhere.

So I think selling the idea why classification is important, one of the first steps is just because we wanna know where our data is, what goes with what. And I think perhaps, uh, selling also what is new. Right? Right now we are. If we know that you can help the business to understand what is, what they have, it's better, there's more visibility for them because I, can care less maybe what, what is sensitive for law compared to, you know, supply chain.

But I think the level of detail is important because the more we understand. what is really important for a logistics, um, is going to help them to, let's think about all the things we're doing with data analytics. Now, you know, that cannot happen if data is, is, is a mess, right?

Right.

If you start putting data in a data warehouse and you start squeezing the [00:07:00] live of, um.

Data. Data and aggregating it, not only aggregating, but making sense of it. Maybe doing predictive, predictive maintenance, maybe predictive, um, uh, projections of sales or how to make something of some, some product because of the, the season of the time or based on response of how, how well it's been selling.

So all that could be happening only if your data is as accurate as possible and, and. I think that is kind of the, we are here to help you to go to the next level, which is the analytics, which is the, uh, think about how agent AI could be more effective if, if you have your data in such a way that it's, it's easily indexed, it's easily found.

We understand where it is and how we can better analyze it. Then predictive is the next thing and, and how AI can help us do that. I think [00:08:00] that's, that's going to be the business differentiator for a lot of companies in the future.

Joshua Copeland : unless you can talk business risk, not cyber risk, business risk, and you can talk real dollars and cents to the business, you're gonna fail. Every single time they're, you're gonna be in a board meeting, they're gonna glass over and they're gonna go, okay, Josh, go in your corner and do your cyber thing.

But when I start talking about things that they truly care about. What's the risk to my business? You know, if this happens, what does it do to our larger organization? What does it do to our ability to manufacture our product or run our service or do the things that make the company money? And when we start switching that mindset from, You know, a purely technical cybersecurity piece into the more business piece, you get a lot more traction.

And ultimately we can't expect them to meet us where we are. You know, they have that business mindset. They're worried about [00:09:00] operations and the technical to whatever the product is that you have. They're not gonna learn cybersecurity, nor should we expect them to learn cybersecurity. We need to learn the business and specifically the business that you're supporting, because not all businesses are the same.

Five seconds is nothing right until I talk to the operations side and go, I have 300 people who are each doing one of those critical things every minute for their entire 8-hour shift. And oh, by the way, we have 365 24/7 operations.

And now start mapping that out. 300 people, times this, times that and that, You know, five seconds becomes hours and hours where we have to either change our SLAs with our customers. We're gonna have to either hire more people because it's gonna take more time to do each of these transactions because, You know, five seconds [00:10:00] doesn't seem like much, but five seconds times, 300 people times, You know, 60 minutes, an hour times 24 hours a day.

That adds up significantly. You're talking hours and hours of productivity lost, and that's something that you're not gonna really think about until you talk to the operations folks and go, no, no. This is what the real impact of the security is.

Luis Valenzuela: one would think. Ransomware is the biggest challenge, but if you look under the hood under that main problem, that is for every organization, how you, you address that big ransomware problem.

There are three major challenges that kind of help to define the solution for that, and that is. Uh, what is the data that we need to protect because we can protect everything equally because we've gotta go out of business. So what is the, the, the key critical, valuable data and, and all of the features around it?

Who has access to it? Where is it located? Uh, how all is it? Things like that. Then the second challenge about [00:11:00] that specific, uh, set of, uh, the crown jewels, the valuable data is what risks we have. Specifically, uh, do we have to protect it in some special way or do we accept the risk of having it? Open the way it is.

On the extreme, uh, do we have any legal exposure, any implications for access, risk, availability, confidentiality, integrity, all of the things around what could go wrong that will cost to our business additional money if we don't do something about it. And the third one, uh, that may or may not apply for all businesses is the, the monetization of data.

Like what can we do with this data that we have within the legal and privacy boundaries to, uh, bring additional revenue streams to maybe enhance our sales pipeline marketing relationship with other companies?

in life there are things that are under your control and there are things that are outside of your control.

Uh, and uh, I [00:12:00] think it was Steven Coy who say, you concentrate on what is in, in your control and be the best at what you do provide value, learn, apply, give it all. If it's under your control, and it end ends up paying off, paying off and bearing some fruits, great. You did it. That's, that's how it's supposed to work.

You saw here, you planted, you grew. Now you collect the reward. Fantastic. it doesn't work out, however, you don't have the, the, the regret of, Hmm. If I had done better, because alive without regrets is so much fulfilling than when you like Yeah, I didn't try. Maybe if I had tried. Maybe some things didn't work for me, but one thing I can tell you, I tried my hardest every step of the way.

So that's what I tell people who are either trying to get in, um, hey, it's difficult right now. The market is hard. [00:13:00] you won't be able to get in cybersecurity in the next three years. Maybe never. But I'll tell you what, if you work hard where you are you find your way in, 10 years later, you will look back and say, you know, cyber security was not for me.

This new thing is what was for me. will never know. But uh, doing your best job, giving it your all, I think is how you get the best potential possible oppor opportunities.

Ketan Gotmare: biggest challenge is, uh, uh, the velocity versus control paradox.

Uh, what I mean by that is, um. With the, with the no, with the business. Trying to get the, the digital engagement from our customer. It doesn't matter which industry you are in. Um, our, um, our expectation from our business, um, uh, to, to, to get on and do innovate, and then do the, um, uh, You know, uh, to the new initiatives, um, are are much [00:14:00] higher.

Um, whereas security teams, uh, are more still into that era of verify and check. Um, so I think, uh, one of the biggest challenges that, uh, that, You know, velocity versus control. How do we continue to do the, the right thing for the business and then support them and not be the blockers, right?

ward-balcerzak_3_07-03-2025_080524: I love that. I mean, that's, that's grit right there, right? Um, you know, you definitely had, uh. Um, I, I don't wanna call it interesting, um, you know, coming up in, in Columbia, but We'll, we'll just call it that for the show. Right? It was, it was interesting. You, you had a lot of difficulty. Um, you came, you came to, uh, to the US and you just put your head down and grinded, you know, everything.

I heard that's what it was. You put your head down and grinded. You recognized if I don't, who else, right? You talk, you just talked about the, uh, um, the hospitality there, the hotel like. It was you and nobody else. You looked around and who else was gonna do it? [00:15:00] And you accepted that, said, well, I guess it's me.

Here we go. Um, you know, I'll share. It's kind of the same mentality I have with things. Um, you know, I kind of get in my own head when I'm about to do something. Right. You know, I try to over prepare. I try to be ready, but I finally got to the point in my own career where, you know, I'll still do that. Right?

I'll still prep, I'll still grind. But then I'll finally get to this mental state where it's like I either have it or I don't. Right? I'm either gonna succeed or I'm not. And I gotta be okay with that. 'cause, 'cause what else am I gonna do? Am I gonna do analysis paralysis and not move forward or am I just gonna trudge forward anyways?

Um, and, and again, going back to your story, I heard a lot of that as well, right? You just put your head down, you kept going, I'm going to guess, you probably hit a few brick walls, right? You probably hit a few, few stops. Um, but based on your, your very impressive career, it sounds like you probably pushed through those walls or.

[00:16:00] You made your own doorway through that wall and kind of went around it.

Luis Valenzuela: if you have a job, do your best in that job. Your current job's performance is your best preparation, your best component for your resume for the next job.

Ketan Gotmare: start with the obvious bucket, right? Obvious bucket when you look at your user, greater data, I mean, OO pretty much every other organization use either.

Microsoft or Google, which is both three, five or, or, and also your emails, your, your document. Um, uh, so that's very obvious, right? You probably want to, uh, consider that. Right? Um, uh, it's, it's also most challenging one because it's unstructured and it's con uh, it's actually constantly updated. Um, so it's kind of difficult to.

To really, um, scan it on daily basis or our catalog is, or classified.

But,

Kevin Feck: I'm trying to fix my AI problem with ai. I mean, you, you just can't make it up, right?

So I, I'm saying, Hey, You know, what? Tools and technologies out there can help me get beyond RegX to identify all my sensitive [00:17:00] information across my, across my SharePoint, OneDrive, and team sites, right? Granular data classification, contextual data classification, and then I can correlate that sensitive data with the permissions on that data, right?

And I can lock that down. And then when somebody spins up a copilot chat. Or a, um, one of the agents, You know, one of the copilot agents, and it can scour basically any of my, my M 365 instance. I know that I've got my sensitive data locked down to authorized users. So that's the number one. The number one goal for me in 2026 and probably early 2027, is securing my M 365.

I think if you try to boil the ocean, it's kinda like multitasking. People wanna believe that they, they're good at multitasking, but really you're given partial effort to everything you're doing. And it's kind of like the old school data protection mentality, right? Some companies, a lot of companies thought, well, I'm just, I'm not gonna do data classification.

I'm gonna protect all my data the same, which means you're really not protecting any of your data

ward-balcerzak_17_11-17-2025_103426: what, what things do you propose folks [00:18:00] do to, uh, to defend themselves?

Dr. Sergio: Well, first try to be is now. Your obligation is now your duty.

I.

To be up to date with what is coming or what is already here, number one. Number two It's not only emails anymore, now it's vishing which is, you know, voice

that

they can, you know, take a copy of your mailbox, like a Hi, hello. How are you at this moment?

I am not available. Blah, blah, blah. They are now able to, three seconds of your voice. Capture that, pass it through ai. and says whatever you want, number one. And now also is video deep fakes. I, actually that's funny. Last Friday I have a presentation for basically everybody in the company and I took a picture on purpose I took a picture of [00:19:00] one of the CEO's, social, uh, you know, networks. From five years ago. So you can see that has a different haircut, she has different glasses, et cetera, et cetera. And I make her talk with her voice and I put in the video, uh, you know, this is fake. This is not me. Just, uh, it is used for you to see how hackers are able now to handle, video and audio. And be sure that, uh, when I call you for anything, ask me what is the code word now. So one of the things that I will tell everybody, and this is sounds kind of ridiculous, but you will have to have, uh, a word there that you have to type or you have to say uh, employer, uh, sorry, when employee. [00:20:00] Receive a call from you or an email from you, or a video from you. Like, Hey boss, do you remember what is the code, uh, word of this week or this month? Or, you know, and if they says, yes, it is supercalifragilisticexpialidocious whatever,

Yeah.

now you know that it's is your, uh, not even now, you know, the famous secret, uh, questions when you was creating an email. I'm sorry, uh, an account, uh, how many people in Facebook used to says, Hey, what is your favorite pet? Or, or what was your first car? Or what is your questions that, you know, was part of, you know, the secret questions

Yep.

And the people was giving away

Another thing that I want you to point is, we received two weeks ago, my CEO sent me an email telling me, asking me [00:21:00] it was real, and the email. Came from jp morgan.com

ward-balcerzak_17_11-17-2025_103426: Hmm.

squadcaster-93bj_1_11-17-2025_113426: I went to check and yes, jp morgan.com is, but something in the email and that didn't make too much sense. First, we don't have an account with JP Morgan. Second, the uh, email was about, Hey, I wanna be sure that the information you send is correct. And she swear that she didn't send any information.

So what I was doing is check really the spelling of JP Morgan, like everybody you know normally tell you to check in. I discovered that the P in JP Morgan actually the R in the Selic

Yep.

but. You [00:22:00] know, it is, is new ways that the or, or, or, uh, threat actors try to fool you. Uh, one that is very funny is, uh, microsoft.com

Yes.

called very small and really is and a n, but it's so small and so close together that you is a m. So you have to really, really pay attention.

That's a wrap on another episode of Guardians of the Data. Thanks for tuning in for show notes and more Visit Guardians. The data do show Guardians of the data is made possible by support from Centro to see how we help organizations discover and classify all of their data accurately and automatically while quickly achieving scale data protection without the fuss, please visit sentra.io.

Catch you next [00:23:00] time.