In this episode of Guardians of the Data, Ward sits down with Tobias Simpson, Director of Data Security and Security Awareness at Kennesaw State University, to unpack the realities of data classification, governance, and loss prevention in complex organizations. With over 25 years in IT and cybersecurity, Tobias shares hard-earned lessons on building a data-first culture, getting executive buy-in, and using tools like Microsoft Purview to make DLP actually work, without breaking the business. Tobias also highlights the significance of tabletop exercises with departmental cooperation, implementing document matrices, and maintaining strong relationships with technology providers. The conversation concludes with Tobias reflecting on his career journey from help desk roles to cybersecurity leadership, and offering advice for professionals entering or advancing in the field.
Takeaways:
- Start with Data Classification Tabletop Exercises: Conduct tabletop exercises to classify and understand your organization’s data.
- Involve the Right People: Assign data stewards and involve all key stakeholders in data initiatives.
- Don’t Fear DLP “Prevention” Mode: Move beyond just monitoring to actively preventing data loss, but do so with proper support systems and communication in place.
- Leverage Vendor Relationships: Build strong partnerships with your technology providers to navigate platform changes and challenges.
- Establish Ongoing Support and Feedback Loops: Set up regular check-ins (e.g., quarterly meetings) with departments to review DLP effectiveness and address issues.
- Communicate and Build Awareness: Regularly communicate with high-risk departments (finance, HR, logistics) about DLP and data security. Use newsletters, training, and ongoing discussions to keep data protection top of mind.
Quote of the Show:
- “You should have a strong relationship with those stakeholders and constantly talk about data loss prevention around those people.” - Tobias Simpson
Links:
Ways to Tune In:
