8 Nov 2023
Information Security, Cyber Security, and Risk Management
It’s Just Plain Cyber discusses on various topics related to information security, cyber security, and risk management. Key points include:
Information Security vs. Cyber Security: Terry begins by differentiating between information security and cyber security. Information security involves protecting personal and company data, including sensitive information like bank details, while cyber security focuses on safeguarding internet access and protecting against online threats, such as malware and phishing.
Careers in the Security Field: The conversation then shifts to discussing the various career opportunities within the security industry. They emphasise that it's not just about technical roles but also includes roles related to risk management, compliance, and auditing.
GRC (Governance, Risk, and Compliance): GRC involves setting policies and standards to ensure that data is secure and compliant with regulations like ISO 27001.
Third-Party Risk Management: The discussion touches upon the importance of managing third-party risk, especially in the context of supply chains. They highlight the need for companies to assess the security measures of the third-party organisations they work with to prevent data breaches.
MGM Casino Data Breach: The conversation brings up the recent data breach at the MGM casino. Steve shares his perspective on how the breach occurred due to stolen credentials and how it could have been preventable through security training and awareness.
Phishing and User Awareness: They talk about the increasing sophistication of phishing attacks and the challenges faced by employees in recognising them. The importance of user awareness and training is emphasised.
Balancing Security and Usability: It’s just plain cyber underscores the need to strike a balance between strong security measures and user-friendliness, especially for companies with non-technical employees.
About Terry & Steve
Terry German, Group Head of Information Security at Mawdsley
Let me tell you a little about myself. Now I’m not going to copy and paste my CV/Resume as I wouldn’t want you to fall asleep even before you hear the podcast.
I started my passion of Cyber/Information Security whilst working in I.T which I started way back in 1994. Bored and fed-up of working 24/7, not weekends off and being on-call, I had a young family at the time and not seeing them a lot made me feel really low. I was given the opportunity to move into the security team at the company I worked at in 2000. From there my love of security grew and grew along with my career and of course my knowledge. All this has put me in the great position I’m today as the Group Head of Information Security at my current company.
What about outside of security Terry? Well, its hard to not thinking about security in our everyday life but I try my best. I have the same love for security as I do for my football team Liverpool Football Club. I’m season ticket holder and go to most of the home games I can get to, which is sometimes hard when you have a loving family to take care of. I play a lot of golf and enjoy leaving the real world and playing on my Xbox, yes, even adult play computer games.
Steve Arnold, Senior Consultant at Via Resource
Steve joined Via Resource two years ago, having spent the previous 4 years working solely in the Information/Cyber Security sector recruiting roles such as Information Security Manager, Security Architect, Security Engineers and Security Analysts.
Steve now solely focuses on GRC positions for Via Resource and has experience managing the end-to-end recruitment process for organisations nationwide with roles covering all facets of Governance, Risk & Compliance both contract and permanent.
As well as this Steve gained a National Diploma Level 2 and NVQ Level 3 in Recruitment and is CertRP certified.
