CISO Insider S2E6 - Data is trust with Emilio Escobar

Chris Martinez
August 20, 2021
24 min read

On this page

Chris Martinez: We're going to get started with some questions on data security fundamentals. In your own words, why is data security so important to you in your role and for your company?
Chris Martinez: How has your experience as a security practitioner in the entertainment and media industry informed how you approach data security?
Chris Martinez: Would you be able to tell our audience which companies you worked for in the media and entertainment space? Chris Martinez: How do you approach the data sprawl problem in your everyday work?
Chris Martinez: We talked about shadow IT with Chris Sandulow at MongoDB. Can you define what shadow IT is for our listeners who don't know what that term means?
Chris Martinez: I think that's a good segue into our next question. How does your team maintain visibility and security of critical data for the entire company?
Chris Martinez: As teams evolve and change the coding languages and tools that they use, what impact does this have on data security infrastructure?
Chris Martinez: What unique challenges is your security organization facing in the new landscape of rapid cloud adoption and remote work?
Chris Martinez: As a company that's undergoing massive growth, how has Datadog's approach to solving data security problems evolve with your company's growth?
Chris Martinez: How are you addressing different security challenges among your infrastructure and different apps? Where have you identified the biggest gaps and where are the biggest learnings coming from?
Chris Martinez: Where are the biggest hotspots or areas of concern for data security in your organization? This can be general like code repos or databases or specific like apps and other platforms that you use.
Chris Martinez: What's one hidden or lesser-known skill that security leaders need to excel in their work, on the security side and as a successful manager and coworker?
Chris Martinez: What motivates you to get out of bed every day as an infosec leader?
Chris Martinez: What are the top two lessons you've learned from your team in the last year?
Chris Martinez: How does your team approach data security when acquiring companies and integrating the workforce and systems of an acquired company?
Chris Martinez: Do you have any podcasts or books that you can recommend to our listeners?
Chris Martinez: Do you have anything you'd like to promote, like your social media channels, articles you've written or your team has written, or anything else?
Chris Martinez: Thank you so much. Emilio. I had a wonderful time talking with you today.

At Nightfall, we believe in the power of learning from those who have done it before. That’s why we created CISO Insider — a podcast interview series that features CISOs and security executives with a broad set of backgrounds, from hyper-growth startups to established enterprises. Through these interviews, we’ll learn how industry experts overcame obstacles, navigated their infosec careers, and created an impact in their organizations.

We’re sharing the unique opportunity to learn how to further your security expertise, hear best practices from thought leaders, and learn what to expect when pursuing a career path in the security industry. For CISOs and executives, it’s an opportunity to share learnings and provide mentorship at scale. Security professionals will get a unique lens into the security landscape, uncovering career-accelerating insights.

Datadog CISO Emilio Escobar joins CISO Insider for a discussion on data security approaches for today’s cloud-first world. By seeing data as trust, Emilio can influence his teams to find better solutions to data security problems and learn from typical pain points.

Interview Highlights

Chris Martinez: We're going to get started with some questions on data security fundamentals. In your own words, why is data security so important to you in your role and for your company?

Emilio Escobar: I think data is trust. In our business at Datadog, our customers send us their data and logs, and they trust us with it. Without proper data security, that means that they can't fully trust us as a vendor. We have to give them the assurance that their data is handled with the utmost care and that they can benefit from their own usage of that data. We need to have the right controls in place.

Chris Martinez: How has your experience as a security practitioner in the entertainment and media industry informed how you approach data security?

Emilio Escobar: Working in the media and entertainment space taught me the different cohorts of the value of data. In security, you always prioritize data that has liability concerns behind it, or regulatory requirements like personal data, intellectual property, or credit cards. But, in the media and entertainment space, you also have this whole subset of data that outside that space, you don't have to deal with. Things like creative content, which has its own life cycle, which is different from data in other industries. What's interesting about it is that content is a piece of data that is meant to be shared and seen and touched by multiple hands. As you're filming a show, there are multiple stages and different people who have to see it.

Chris Martinez: Would you be able to tell our audience which companies you worked for in the media and entertainment space?

Emilio Escobar: Prior to Datadog, I was running security for Hulu, which is a video on demand and live TV streaming platform.

Chris Martinez: How do you approach the data sprawl problem in your everyday work?

Emilio Escobar: Data is continuously growing. Many people think that data is like garbage. The more you keep it, the more it starts to smell. But it has value and meaning to different teams and different business units. We have to make sure that our customers have the proper tools that they need to handle and manage their everyday work. We have a known catalog of services and tools that we use at Datadog. We know where the data is, so we can help them apply the right level of controls and legal agreements. But then we also create an environment where our culture is open. People can ask for new tools if the ones that we currently support do not meet their needs.

Chris Martinez: We talked about shadow IT with Chris Sandulow at MongoDB. Can you define what shadow IT is for our listeners who don't know what that term means?

Emilio Escobar: Shadow IT, in its literal definition, is tools, applications, and services that people are using that are not known to your IT or security teams, or other teams that are tasked with maintaining those systems or at least need to be informed. That includes legal, for example. I think shadow IT is a good measure to track. At Datadog, I also oversee IT security. For me, it's a good indicator of how well we are serving our customers.

Chris Martinez: I think that's a good segue into our next question. How does your team maintain visibility and security of critical data for the entire company?

Emilio Escobar: At the very least, we rely on people. The business units know what data they need, and the value and criticality of the data. We have a hybrid approach where dedicated people make sure that we're implementing the right guard rails or controls when we onboard a vendor or a service. If the tool is managed by an operations team that sits under finance, for example, they need the right knowledge and mindset to know exactly how that data needs to be protected. Or, we rely on those teams to tell us which data they need and for what purpose.

Chris Martinez: As teams evolve and change the coding languages and tools that they use, what impact does this have on data security infrastructure?

Emilio Escobar: We don't rely on a blanket overview of people using a certain set of languages or frameworks, because the moment that changes, we're caught off guard. But we also realize that complexity can also be an enemy to security. One of the things that we benefit from is that we leverage managed services as much as possible. Our product offering runs Datadog’s main cloud providers and they have native services that they offer for data storage, databases, and segmentation.

Chris Martinez: What unique challenges is your security organization facing in the new landscape of rapid cloud adoption and remote work?

Emilio Escobar: Historically, and moving forward, we've maintained a flexible work environment. We have people who are fully remote. We have people who work in the office and we have people who work in a remote/office hybrid. Datadog was born in the cloud. Not only do we offer products natively from the cloud, but a lot of the services, vendors, and software as a service that we use are cloud-hosted.

Chris Martinez: As a company that's undergoing massive growth, how has Datadog's approach to solving data security problems evolve with your company's growth?

Emilio Escobar: I have the teams focusing on continuous improvement. Our growth has been great, but with that you have different approaches for how to manage security.

Chris Martinez: How are you addressing different security challenges among your infrastructure and different apps? Where have you identified the biggest gaps and where are the biggest learnings coming from?

Emilio Escobar: I see the needs of the business teams as a hierarchy. There are teams that still are in that survival stage of needs where they might need more feedback and very basic support.

Chris Martinez: Where are the biggest hotspots or areas of concern for data security in your organization?

Emilio Escobar: We have unique needs based on what we do as a business, but we also have some overarching needs that I think the entire industry also has a problem with. We've made significant investments in this problem already.

Chris Martinez: What's one hidden or lesser-known skill that security leaders need to excel in their work, on the security side and as a successful manager and coworker?

Emilio Escobar: This is an area that I spend quite a bit of time thinking about. As I grow my teams, I just have to say one word. Empathy.

Chris Martinez: What motivates you to get out of bed every day as an infosec leader?

Emilio Escobar: What motivates me every day is asking, “What new thing can I learn?” When there’s a new breach to read about that day, I know potentially my board is going to ask me about it.

Chris Martinez: What are the top two lessons you've learned from your team in the last year?

Emilio Escobar: I’ve learned that people are generally interested in everything that happens at the company.

Chris Martinez: How does your team approach data security when acquiring companies and integrating the workforce and systems of an acquired company?

Emilio Escobar: We have an active Corp Dev team. We're pretty much attached at the hip with them. They loop us in when we're working on an acquisition and they gave us time to do the due diligence.

Chris Martinez: Do you have any podcasts or books that you can recommend to our listeners?

Emilio Escobar: I enjoy the Hacker Valley Studio Podcast, and the CISO Series Podcast.

Chris Martinez: Do you have anything you'd like to promote, like your social media channels, articles you've written or your team has written?

Emilio Escobar: Check out Datadog. We're always hiring. Follow us on social media. I'm on social media as well, if you want to follow me.