Cloud Security Podcast by Google

EP175 Meet Crystal Lister: From Public Sector to Google Cloud Security and Threat Horizons

Jun 3, 2024

Crystal Lister discusses transitioning from public to private sector, impact on Google work, risk management, Google Threat Horizons reports, insider threats importance. Insights on cybersecurity career transitions, serverless computing threats, and empowering women in cybersecurity.

26:43

Creator website

Episode guests

Crystal Lister

AI Summary

AI Chapters

Episode notes

Podcast summary created with Snipd AI

Quick takeaways

Public sector prioritizes national security, private sector focuses on shareholder value in risk management.

Insider risk management crucial for companies, need targeted security measures and leadership alignment.

Deep dives

Transition from Public to Private Sector Risk Management Practices

In the commercial sector, risk management is often driven by shareholder value and the bottom line, leading to challenges in recognizing threats without direct evidence. Private sector organizations sometimes overlook security needs, assuming they are not targeted. In contrast, the government focuses on protecting national security interests, displaying a clear commitment to addressing risks for homeland protection and critical asset defense.

Introduction

4min

Navigating Career Transitions in Cybersecurity

10min

Insights on Google Cloud Threat Horizon Report and Serverless Computing Threats

2min

Insider Risk Management Importance

6min

Empowering Women in Cybersecurity with Sponsorship Programs

4min

Guest:

Crystal Lister, Technical Program Manager, Google Cloud Security

Topics:

Your background can be sheepishly called “public sector”, what’s your experience been transitioning from public to private? How did you end up here doing what you are doing?
We imagine you learned a lot from what you just described – how’s that impacted your work at Google?
How have you seen risk management practices and outcomes differ?
You now lead Google Threat Horizons reports, do you have a vision for this? How does your past work inform it?
Given the prevalence of ransomware attacks, many organizations are focused on external threats. In your experience, does the risk of insider threats still hold significant weight? What type of company needs a dedicated and separate insider threat program?