Roadmaps Security roadmaps Information security and data protection
Find sensitive data, control who can reach it, protect it with encryption and masking, and stop it leaving where it should not.
Estimated time: 15–26 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Data is created, stored, used, shared, archived and destroyed. Each stage has its own risks and controls. Map it before you protect it.
Label data by sensitivity so controls can follow it. Keep the scheme simple: too many levels and nobody uses it correctly.
Find where sensitive data actually lives, including the copies in test systems, spreadsheets and old shares. You cannot protect what you cannot find.
Grant access by role and need, review it regularly, and prefer short-lived access to standing permissions. Over-broad access is the root of most data loss.
Encrypt stored data, protect it as it moves, and learn the newer options for protecting it while it is being processed.
The safest data is the data you never collected or already deleted. Keep only what you need, for only as long as you need it.
Choose algorithms and modes, encrypt databases and storage, and above all manage the keys well. Bad key handling undoes good encryption.
Hide real values in test systems and analytics by masking them or swapping them for tokens, so sensitive data is not copied everywhere.
DLP watches email, web, endpoints and cloud for sensitive data leaving, and blocks or alerts. Tune it carefully or it drowns everyone in false positives.
Harden databases, control access, encrypt sensitive columns, and turn on auditing. Databases are where the most valuable data sits.
Watch for unusual queries, bulk exports and access outside normal patterns. This catches both attackers and insider misuse.
Backups hold everything and are a ransomware target. Encrypt them, control access, and make at least one copy immutable and offline.
DSPM continuously finds sensitive data across cloud and on-premises, maps who can reach it, and flags risky exposure. It is how data security scales.
Object storage, data lakes and managed databases each have their own access and encryption controls. Misconfigured buckets are a classic breach.
Use a key management service or HSM, separate duties, rotate keys and keep an audit trail. Consider customer-managed keys in the cloud.
Confidential computing and techniques such as homomorphic encryption protect data even while it is processed. Know what is practical today.
Much data loss is by insiders, by mistake or on purpose. Combine monitoring, least privilege and a fair investigation process.
Sharing data with partners and analysts safely needs access controls, logging and sometimes privacy techniques. Plan it instead of emailing spreadsheets.
Set the classification scheme, the controls per level and the balance with usability, across the whole organisation.
Data security works best alongside data governance: ownership, quality and lifecycle. Align with the teams that own the data.
Track classified coverage, exposed sensitive data, DLP incidents and encryption coverage. Report risk reduced, not tool output.
Data security protects the information itself, wherever it lives: in databases, files, cloud storage and backups. It starts with knowing what data you hold and how sensitive it is, then controlling access, protecting it with encryption and masking, and watching for it leaving the organisation.
The work spans classification and discovery, database and storage security, encryption and key handling, and data loss prevention. It overlaps with privacy and cloud security, and it is central to meeting regulations about personal and financial data.
Data is what attackers are usually after and what regulators protect. Breaches are measured in records lost. Organisations need people who can protect data across sprawling systems without blocking the business.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact