Certified: The GIAC GPCS Audio Course
- Episodes
- 61
- Format
- Series – listen from the start
- Latest episode
- Feb 10, 2026
About the podcast
The podcast delivers practical cloud security guidance for professionals who have to ship real systems on real timelines. Episodes focus on the moves that prevent costly incidents: reducing accidental exposure, tightening identity and permissions, hardening serverless triggers, securing managed platforms, and building durable defaults that survive updates and team changes. The approach is technical and operational, with clear explanations that translate directly into repeatable patterns. Each topic is designed to help you think like both a defender and an architect: what attackers exploit first, where misconfigurations hide, and how to constrain blast radius without slowing delivery. If you want deeper reference material, a companion book expands the same concepts in a structured format, and a flash cards book supports fast review and retention for day-to-day work, interviews, and certification prep.
Episodes 61
Welcome to Certified: The GIAC GPCS Audio Course
The podcast delivers practical cloud security guidance for professionals who have to ship real systems on real timelines. Episodes focus on the moves that prevent costly incidents: reducing accidental exposure …
Show notes
The podcast delivers practical cloud security guidance for professionals who have to ship real systems on real timelines. Episodes focus on the moves that prevent costly incidents: reducing accidental exposure, tightening identity and permissions, hardening serverless triggers, securing managed platforms, and building durable defaults that survive updates and team changes. The approach is technical and operational, with clear explanations that translate directly into repeatable patterns.
Each topic is designed to help you think like both a defender and an architect: what attackers exploit first, where misconfigurations hide, and how to constrain blast radius without slowing delivery. If you want deeper reference material, a companion book expands the same concepts in a structured format, and a flash cards book supports fast review and retention for day-to-day work, interviews, and certification prep.
Episode 60 — Secure serverless event triggers so trusted inputs cannot be quietly replaced
This episode explains why event triggers are a primary trust boundary in serverless architectures, because whoever controls the trigger often controls when and how your function executes, and the GPCS exam …
Show notes
This episode explains why event triggers are a primary trust boundary in serverless architectures, because whoever controls the trigger often controls when and how your function executes, and the GPCS exam expects you to reason about trusted inputs and integrity. You’ll define triggers broadly—HTTP endpoints, message queues, storage events, schedules, and integration events—and then map how trigger misconfiguration can allow unauthorized invocation, replay, or substitution of “trusted” events with attacker-controlled payloads. We’ll walk through a scenario where a function is designed to run only on internal events, but a trigger configuration change or permissive access policy allows external actors to invoke it, leading to data access through the function’s permissions. You’ll learn best practices such as authenticating and authorizing invocation, restricting who can modify trigger configuration, validating event source identity, and logging both the trigger source and downstream actions so investigations can prove cause and effect. The goal is to ensure the function’s execution path remains trustworthy even as teams evolve event routing over time. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 59 — Prevent serverless privilege overreach with tight identity and resource scopes
This episode focuses on least privilege for serverless workloads, because functions often start small but accumulate permissions as teams add features, and the GPCS exam regularly tests whether you can spot …
Show notes
This episode focuses on least privilege for serverless workloads, because functions often start small but accumulate permissions as teams add features, and the GPCS exam regularly tests whether you can spot privilege overreach hidden behind “it’s just a function.” You’ll define function identity, permission scope, and resource boundaries, then learn how to map each function’s actions to the smallest set of allowed operations on the smallest set of resources. We’ll cover common overreach patterns such as granting broad access to storage, messaging, or key services “for convenience,” permissions that allow role assumption into stronger identities, and policies that include wildcard actions or resources that expand over time. A scenario follows a function that only needs to read from one queue and write to one database, but is given sweeping permissions that enable lateral movement and data access across environments; you’ll tighten identity scope and validate the function still performs its job while escalation paths fail. This prepares you for exam questions that ask for the best permission design and for real engineering reviews where security must not break reliability. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 58 — Harden serverless functions to block persistence, reinfection, and silent reuse
This episode explains hardening strategies for serverless functions with a focus on attacker goals that are easy to miss: persistence through configuration changes, reinfection through supply chain or …
Show notes
This episode explains hardening strategies for serverless functions with a focus on attacker goals that are easy to miss: persistence through configuration changes, reinfection through supply chain or deployment paths, and silent reuse of compromised identities or triggers. You’ll define persistence in serverless terms, including modified environment variables, altered triggers, injected dependencies, or deployment pipeline abuse that reintroduces malicious changes after cleanup. We’ll walk through a scenario where a function is cleaned up after suspicious activity, but the attacker retains access by modifying a trigger or redeploying through a compromised automation identity, and you’ll design controls that prevent recurrence. You’ll learn best practices such as restricting who can change function configuration, locking down deployment roles, limiting outbound access, using short-lived credentials where possible, and ensuring logs can correlate invocations to configuration states at the time of execution. The emphasis is on making serverless security durable against repeated attempts, which is both operationally realistic and exam-aligned. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 57 — Assess serverless environments for misconfigurations that enable takeover
This episode focuses on assessing serverless deployments for the misconfigurations that enable compromise quickly, matching exam questions that ask you to identify the highest-impact weakness in an event-driven …
Show notes
This episode focuses on assessing serverless deployments for the misconfigurations that enable compromise quickly, matching exam questions that ask you to identify the highest-impact weakness in an event-driven design. You’ll define the main assessment targets: function permissions, trigger exposure, environment configuration, dependency integrity, and observability, then learn how a single misconfiguration can turn a low-risk function into a control-plane bridge. A scenario follows a function with a broad role that can modify identity or storage services; an attacker gains invocation capability and uses the function’s permissions to pivot into wider cloud access. You’ll practice assessment steps that separate “code flaw” from “platform misconfiguration,” such as checking whether invocation is authenticated, whether triggers are constrained, whether the role can assume other roles, and whether logs capture invocation source and downstream API calls. The outcome is a repeatable assessment approach that applies across providers and helps you eliminate distractors on the exam. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 56 — Secure serverless architectures by understanding their real attack surfaces
This episode introduces serverless security by focusing on what changes compared to traditional compute: you manage less infrastructure, but you rely more heavily on identity, event inputs, and managed service …
Show notes
This episode introduces serverless security by focusing on what changes compared to traditional compute: you manage less infrastructure, but you rely more heavily on identity, event inputs, and managed service integrations, which the GPCS exam treats as primary attack surfaces. You’ll define serverless functions, managed runtimes, and event-driven execution, then map the real risks: overly permissive function identities, exposed invocation paths, unsafe dependencies, secrets in environment variables, and weak logging that hides short-lived execution. We’ll use a scenario where a function is triggered by an external-facing event source and processes untrusted input, and you’ll trace how attackers can exploit input handling to access sensitive data or misuse downstream permissions. You’ll also learn how to think about boundaries in serverless: what the function can reach, what can reach the function, and what evidence exists to prove how it was used during an incident. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 55 — Verify hardened configurations remain stable through updates and team changes
This episode teaches configuration stability as a security requirement, because managed platforms change through provider updates, feature toggles, and team-driven modifications, and the GPCS exam often tests …
Show notes
This episode teaches configuration stability as a security requirement, because managed platforms change through provider updates, feature toggles, and team-driven modifications, and the GPCS exam often tests continuous validation rather than one-time setup. You’ll define drift for managed application services, including settings that silently revert, new defaults introduced by platform updates, and permission creep caused by role reuse or new operational tooling. We’ll walk through a scenario where a platform update changes a networking or authentication behavior and a previously hardened service becomes reachable in an unexpected way, then you’ll practice building verification routines that catch the change quickly. You’ll also cover best practices like baseline comparisons, change alerts on high-impact settings, periodic access reviews for service administrators, and validating logs still capture control-plane changes and runtime access patterns. The goal is to ensure your hardening remains true over time, not just true on day one, which is both exam-relevant and operationally critical. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 54 — Build secure defaults for cloud application services that teams will keep
This episode explains how to create secure defaults that are durable in real organizations, because the exam expects you to choose answers that reduce risk without relying on perfect human behavior. You’ll …
Show notes
This episode explains how to create secure defaults that are durable in real organizations, because the exam expects you to choose answers that reduce risk without relying on perfect human behavior. You’ll define secure defaults as baseline configurations applied consistently through templates, policies, and deployment pipelines, so teams inherit safe choices automatically and exceptions become explicit and reviewable. We’ll cover what defaults matter most for application services: minimizing public exposure, enforcing strong authentication, restricting runtime identity permissions, protecting configuration and secrets, enabling useful logs, and preventing risky administrative features from being enabled casually. A scenario compares two teams: one that hardens services manually after deployment and repeatedly misses settings under time pressure, and another that bakes defaults into deployment patterns so every new service starts hardened. You’ll also learn how to design exceptions that do not become permanent drift, including time limits, compensating controls, and evidence that the exception was approved and monitored. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 53 — Reduce control-plane risk by locking down service settings and permissions
This episode focuses on control-plane risk: the danger that someone with access to service configuration can change behavior, expose data, disable protections, or create persistence without touching the …
Show notes
This episode focuses on control-plane risk: the danger that someone with access to service configuration can change behavior, expose data, disable protections, or create persistence without touching the application code, a core theme in GPCS-style “what matters most” questions. You’ll define the control plane versus the data plane, then map common control-plane actions to impact, such as modifying authentication settings, changing network exposure, altering logging, rotating or swapping identities, and injecting configuration that reroutes traffic or exfiltrates secrets. A scenario follows an attacker who gains access to a service administrator role and uses configuration changes to create stealthy persistence; you’ll practice selecting controls that limit who can change settings, require stronger verification for high-impact changes, and ensure changes are logged and reviewable. You’ll also learn operational guardrails like separating deploy roles from admin roles, scoping permissions to specific services, and validating that emergency access paths exist without granting permanent broad authority. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 52 — Assess managed application services for misconfigurations attackers exploit first
This episode trains you to assess managed application services the way attackers do, focusing on misconfigurations that create immediate compromise paths and often appear as “easy points” on the GPCS exam …
Show notes
This episode trains you to assess managed application services the way attackers do, focusing on misconfigurations that create immediate compromise paths and often appear as “easy points” on the GPCS exam. You’ll learn the high-priority assessment questions: is the service publicly reachable when it shouldn’t be, are administrative settings overly permissive, does the runtime identity have broad access, are secrets exposed in configuration, and is logging sufficient to prove what happened during an incident. We’ll work through a scenario where an application platform is deployed quickly with default settings, and an attacker leverages open access plus weak auth controls to reach management features and pivot into data services. You’ll also practice interpreting ambiguous assessment results, such as cases where a service is private but still reachable through unintended network paths, or where identity permissions look narrow but include escalation actions that enable broader access. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 51 — Secure cloud application service platforms with hardened baseline configurations
This episode explains how managed cloud application platforms (such as app services, container platforms, and managed runtimes) concentrate risk in a few baseline settings that determine exposure, identity …
Show notes
This episode explains how managed cloud application platforms (such as app services, container platforms, and managed runtimes) concentrate risk in a few baseline settings that determine exposure, identity permissions, and logging quality, which is why the GPCS exam frequently tests “secure-by-default” configuration thinking. You’ll define what a hardened baseline is for managed application services, including secure network reachability, strong authentication and authorization, restricted administrative actions, safe configuration storage, and reliable audit logging. We’ll walk through an example where a team deploys an application service with permissive inbound access and broad runtime identity permissions, then show how a baseline would have constrained ingress, limited outbound privileges, and preserved visibility into configuration changes. You’ll also cover practical operational checks—confirming management endpoints are restricted, ensuring logs include both control-plane and data-plane activity, and validating that secrets are not embedded in app settings in a way that leaks through debugging or export workflows. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 50 — Restrict administrative paths to trusted networks while keeping operations moving
This episode teaches how to restrict administrative access to trusted network paths without creating brittle processes that teams will bypass, a real-world balancing act that the GPCS exam often encodes in …
Show notes
This episode teaches how to restrict administrative access to trusted network paths without creating brittle processes that teams will bypass, a real-world balancing act that the GPCS exam often encodes in “best answer” choices. You’ll define trusted networks in functional terms—controlled egress, known ingress points, monitored routes, and managed devices—then connect those constraints to administrative interfaces that should never be broadly reachable. We’ll discuss design patterns such as centralized access points, segmentation between user networks and admin networks, and explicit allow paths for critical operations, along with the verification steps that prove restrictions are working. A scenario walks through a distributed operations team that needs reliable access during incidents; you’ll implement network restrictions, pair them with strong identity controls, and ensure the process is usable enough that engineers do not resort to permanent exceptions. The episode closes by showing how to document and test these restrictions so they remain enforceable through change, audits, and outages. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 49 — Reduce admin compromise risk using strong authentication and access constraints
This episode explains how to reduce privileged account compromise by combining strong authentication with constraints that limit what an attacker can do even if they capture a credential, aligning with exam …
Show notes
This episode explains how to reduce privileged account compromise by combining strong authentication with constraints that limit what an attacker can do even if they capture a credential, aligning with exam questions that emphasize layered controls. You’ll define strong authentication in practice, including MFA design choices, phishing-resistant approaches conceptually, and the importance of reauthentication triggers for privileged actions and sensitive changes. We’ll connect authentication to access constraints such as conditional access, time-bound elevation, scoped roles, and session limits, showing how these controls reduce replay and make unauthorized access harder to sustain. A scenario explores a compromised admin password that would normally lead to immediate environment takeover; you’ll apply controls that force additional verification, restrict where sessions can originate, and limit available actions so the attacker’s window is narrow and observable. You’ll also cover operational concerns like preventing lockouts, maintaining break-glass access responsibly, and ensuring logs can prove who did what during high-impact administrative work. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 48 — Harden remote administrative access without leaving durable attack surfaces
This episode focuses on remote administrative access as a high-risk pathway that must be engineered to be both secure and sustainable, a frequent theme on the GPCS exam when questions involve management …
Show notes
This episode focuses on remote administrative access as a high-risk pathway that must be engineered to be both secure and sustainable, a frequent theme on the GPCS exam when questions involve management interfaces and privileged actions. You’ll define administrative access surfaces such as management consoles, remote shells, bastion-style access points, and privileged APIs, then connect them to attacker goals like credential theft, session hijacking, and persistence through access tooling. We’ll cover hardening principles including minimizing exposed endpoints, requiring strong authentication, limiting session duration, reducing standing privilege, and ensuring administrative actions are logged with clear attribution. A scenario follows an engineer who needs emergency access from outside a trusted office network; you’ll design a hardened access path that avoids “temporary open” firewall rules, prevents credential reuse, and preserves audit evidence without blocking urgent operations. You’ll also learn common missteps, such as leaving admin ports open, relying on shared accounts, and failing to validate that access paths are actually restricted. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 47 — Decide when private service endpoints beat public exposure in real architectures
This episode teaches decision-making: when private endpoints are the right answer, when they are overkill, and how to justify the choice using risk and operational requirements, which is a common exam skill …
Show notes
This episode teaches decision-making: when private endpoints are the right answer, when they are overkill, and how to justify the choice using risk and operational requirements, which is a common exam skill. You’ll evaluate factors like data sensitivity, threat model, required consumers, latency and routing complexity, incident response visibility, and the likelihood that “temporary” public exposure becomes permanent. We’ll discuss how public endpoints can be acceptable when access is narrowly controlled, strongly authenticated, and heavily monitored, but also how they increase opportunities for scanning, misconfiguration, and credential misuse to become direct service access. A scenario walks through a multi-team architecture where some consumers are on-prem and some are cloud-native; you’ll decide whether private endpoints, hybrid connectivity, or a controlled public endpoint best meets security and delivery needs, and you’ll identify the control set that makes your choice defensible. This prepares you for exam questions that ask for the “best” solution, not just a possible one. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 46 — Securely access cloud services using private endpoints and scoped connectivity
This episode introduces private service endpoints as a connectivity pattern that reduces exposure by keeping service access off the public internet, and it ties the concept to GPCS exam objectives around …
Show notes
This episode introduces private service endpoints as a connectivity pattern that reduces exposure by keeping service access off the public internet, and it ties the concept to GPCS exam objectives around network boundaries and secure access paths. You’ll define private endpoints in practical terms: a way for workloads and administrators to reach managed services through private network paths with controlled routing and access policies, rather than through public addresses. We’ll cover how scoped connectivity supports least privilege at the network layer, including restricting which subnets, workloads, and administrative paths can reach specific services, and how this reduces attack surface for credential stuffing, service probing, and opportunistic scanning. A scenario compares a database reached via public endpoint with IP allow rules versus a design using private endpoints and limited network paths, highlighting the operational and security tradeoffs you must reason through on the exam. You’ll also learn troubleshooting considerations like DNS resolution, routing mistakes, and how to validate that “private” truly means unreachable from public networks. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 45 — Respond to storage misconfiguration signals before they become headlines
This episode focuses on early response when storage misconfiguration signals appear, emphasizing the exam-relevant difference between containment, validation, and full remediation. You’ll define …
Show notes
This episode focuses on early response when storage misconfiguration signals appear, emphasizing the exam-relevant difference between containment, validation, and full remediation. You’ll define misconfiguration signals such as newly public resources, policy changes that widen access, missing encryption enforcement, or alerts that indicate anonymous reads, then learn how to verify whether the signal reflects real exposure and what data could be impacted. We’ll walk through a scenario where an automated check flags a storage container as publicly accessible after a deployment, and you’ll practice a response sequence that preserves evidence, quickly restricts access, and evaluates whether access occurred before the fix. You’ll also cover operational pitfalls like “fixing” by deleting logs or changing too many settings at once, and how to coordinate with owners so the fix doesn’t break critical workflows. The episode equips you to choose the best next action under time pressure, which is exactly what many exam questions are really measuring. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 44 — Detect storage abuse through access patterns, anomalies, and logging discipline
This episode explains how to detect storage abuse by learning what normal access looks like and then identifying deviations that indicate misuse, a common GPCS pattern when questions test analysis rather than …
Show notes
This episode explains how to detect storage abuse by learning what normal access looks like and then identifying deviations that indicate misuse, a common GPCS pattern when questions test analysis rather than vendor features. You’ll define storage-relevant signals such as unusual listing behavior, spikes in read volume, access from new locations or identities, repeated access-denied events that indicate probing, and suspicious use of sharing workflows. We’ll connect these patterns to logging discipline: ensuring access events are captured, time-synchronized, retained long enough for investigations, and enriched with identity context so you can attribute actions. A scenario follows a user account that rarely touches storage but suddenly performs broad listings and downloads during off-hours, and you’ll practice deciding what to check first, what evidence confirms abuse versus a legitimate job, and how to tune alerts to avoid constant noise. The goal is to build a reliable detection mindset that matches exam expectations and supports real incident triage. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 43 — Reduce cloud storage data exfiltration risk with detection-minded controls
This episode teaches you to reduce exfiltration risk by combining prevention and detection in storage design, because the GPCS exam often rewards answers that interrupt attacker workflows and also produce …
Show notes
This episode teaches you to reduce exfiltration risk by combining prevention and detection in storage design, because the GPCS exam often rewards answers that interrupt attacker workflows and also produce evidence. You’ll define exfiltration in cloud storage terms, including bulk downloads, stealthy object-by-object pulls, and misuse of sharing mechanisms that turn private data into externally accessible data. We’ll cover control choices that are “detection-minded,” such as limiting list and read permissions, separating write from read, enforcing encryption and key-use constraints, and ensuring storage access generates high-quality logs that can be correlated to identities and network origins. A scenario walks through a compromised service identity that begins enumerating and downloading objects at an unusual rate; you’ll practice choosing controls that limit what it can access, and also ensure the event is visible early enough to respond. You’ll leave with a framework for answering exam questions that ask for the best mitigation when storage is high value and attackers are patient. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 42 — Control storage permissions with least privilege and tight data boundaries
This episode focuses on designing storage permissions so access is intentional, reviewable, and limited to the smallest practical scope, which maps directly to exam questions about effective access and …
Show notes
This episode focuses on designing storage permissions so access is intentional, reviewable, and limited to the smallest practical scope, which maps directly to exam questions about effective access and real-world questions about containment. You’ll define identity-based permissions versus resource-based permissions, then learn how scoping works at the level of accounts, projects, resource groups, buckets, containers, and prefixes so you can prevent a role that needs one dataset from gaining visibility into everything. We’ll explore boundary design for sensitive data, including separating environments, separating regulated data, and minimizing cross-team access by default, then apply those concepts to a scenario where a shared “data engineering” role can read multiple business units’ exports because no boundaries were enforced. You’ll also cover troubleshooting considerations such as broken applications after permission tightening, how to identify the missing action without resorting to wildcards, and how to prove the final policy meets functional needs while closing the original overreach. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 41 — Prevent accidental public exposure with durable storage access patterns
This episode explains how cloud storage becomes publicly reachable through default sharing behaviors, inherited permissions, and convenience-driven configuration, and why the GPCS exam tests your ability to …
Show notes
This episode explains how cloud storage becomes publicly reachable through default sharing behaviors, inherited permissions, and convenience-driven configuration, and why the GPCS exam tests your ability to recognize “public by mistake” patterns quickly. You’ll define what public exposure means across object, bucket, container, and share constructs, then connect common root causes such as anonymous access settings, overly broad ACL-style grants, and permissive sharing links that outlive their purpose. We’ll walk through a scenario where a team publishes one asset for a demo and accidentally leaves a broader path open, then you’ll practice selecting durable access patterns that prevent recurrence, including explicit allow lists, scoped principals, and environment segmentation that keeps test data from blending with production. You’ll also learn how to validate exposure status with logging and targeted checks, and how to document safe sharing workflows so “quick” does not become “open.” Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 40 — Secure cloud storage services by design, not by hope
This episode introduces cloud storage security as an architecture problem, not a checklist, aligning with GPCS exam questions that test default risk, access design, and detection readiness for high-value data …
Show notes
This episode introduces cloud storage security as an architecture problem, not a checklist, aligning with GPCS exam questions that test default risk, access design, and detection readiness for high-value data services. You’ll define core storage risks such as unintended public exposure, overly broad internal access, insecure sharing links, weak data boundaries between environments, and missing logging that hides exfiltration. We’ll cover design principles: explicit access patterns, least-privilege permissions, strong identity controls, encryption with governed keys, and consistent configuration enforced through templates and policy guardrails. A scenario walks through a team that relies on “nobody will find it” assumptions until a misconfiguration exposes sensitive data; you’ll identify what controls would have prevented exposure, what logs would reveal the timeline, and how to redesign storage access so secure sharing is the easiest path. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 39 — Validate encryption coverage so “enabled” means provably protecting the data
This episode focuses on proving encryption coverage, because “enabled” is not the same as “effective,” and exam questions often probe whether you can verify coverage across services, datasets, and access paths …
Show notes
This episode focuses on proving encryption coverage, because “enabled” is not the same as “effective,” and exam questions often probe whether you can verify coverage across services, datasets, and access paths. You’ll define coverage as the set of data objects and storage locations that are actually encrypted with the intended keys, under the intended policies, and with the intended access restrictions. We’ll cover validation techniques such as sampling resources across environments, checking service configurations and key associations, verifying that unencrypted creation is blocked, and confirming that key usage logging exists to support investigations. A scenario uses a multi-environment storage footprint where one region is missing required encryption enforcement; you’ll practice finding the gap, determining impact, and implementing a control that prevents recurrence while producing audit-ready evidence of compliance and security. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 38 — Protect encryption workflows from misconfigurations that silently disable security
This episode covers how encryption controls fail quietly through misconfiguration, which the GPCS exam often tests by presenting “encrypted” environments that are actually exposed due to policy, service, or …
Show notes
This episode covers how encryption controls fail quietly through misconfiguration, which the GPCS exam often tests by presenting “encrypted” environments that are actually exposed due to policy, service, or workflow mistakes. You’ll learn how misconfigurations happen: using the wrong key for the wrong dataset, allowing broad decrypt permissions, skipping encryption on specific object types, or deploying services where encryption settings are not inherited as expected. We’ll discuss best practices like enforcing encryption requirements through policy, limiting where keys can be used, validating configuration with targeted tests, and monitoring for resources created without required encryption settings. A scenario walks through a new workload deployed by template that bypasses the intended encryption configuration; you’ll identify the failure point, apply a durable guardrail, and confirm the fix with evidence that would satisfy both a security review and an exam question asking for the “best next step.” Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 37 — Choose encryption approaches that survive incident response and legal scrutiny
This episode teaches you how to choose encryption approaches that remain defensible under incident response pressure and legal scrutiny, where you may need to prove what was protected, what keys were used, and …
Show notes
This episode teaches you how to choose encryption approaches that remain defensible under incident response pressure and legal scrutiny, where you may need to prove what was protected, what keys were used, and whether unauthorized decryption likely occurred. You’ll compare provider-managed keys, customer-managed keys, and application-managed encryption, focusing on control, auditability, operational risk, and the ability to rotate or revoke access during a breach. We’ll connect these choices to exam scenarios that ask you to balance security objectives with maintainability and evidence readiness, especially when regulators or counsel require clear documentation of protections. A scenario explores a suspected insider access case where encryption exists but key usage logs are incomplete; you’ll evaluate which approach produces stronger evidence, how to improve logging and separation, and how to design your key policies so emergency revocation is possible without destroying business continuity. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 36 — Encrypt sensitive data in cloud platforms with sane defaults and verified outcomes
This episode explains how to implement encryption for sensitive cloud data in a way that is both exam-correct and operationally dependable, focusing on what encryption actually guarantees and what it does not …
Show notes
This episode explains how to implement encryption for sensitive cloud data in a way that is both exam-correct and operationally dependable, focusing on what encryption actually guarantees and what it does not. You’ll define encryption at rest, encryption in transit, and the role of key management, then connect these definitions to how cloud services apply encryption by default versus where you must explicitly configure it. We’ll highlight the difference between “service says encrypted” and “data is provably protected,” including how identity permissions can effectively bypass encryption if decrypt rights are too broad. A scenario covers a storage service with default encryption enabled but weak access controls, and you’ll practice validating that encryption is applied to the right data, that keys are properly governed, and that logs can prove what was accessed and by whom during an investigation. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 35 — Prevent key misuse through permissions, separation, and careful key lifecycle
This episode focuses on preventing key misuse by combining least-privilege permissions, separation of duties, and disciplined key lifecycle management, all of which the GPCS exam ties to confidentiality …
Show notes
This episode focuses on preventing key misuse by combining least-privilege permissions, separation of duties, and disciplined key lifecycle management, all of which the GPCS exam ties to confidentiality, integrity, and operational recoverability. You’ll define lifecycle stages—creation, activation, rotation, suspension, and destruction—and connect each stage to risks like accidental lockout, malicious disablement, or unauthorized decryption. We’ll emphasize permissions design that separates key administrators from key users, limits where keys can be invoked, and uses conditions so keys cannot be used from unexpected contexts or for unintended resources. A scenario explores a ransomware-style event where an attacker gains access to an administrative identity; you’ll evaluate how key deletion protections, strict admin boundaries, and rapid revocation steps can prevent total data loss and preserve forensic evidence. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 34 — Assess KMS security posture using threat-driven questions that reveal gaps
This episode teaches you how to evaluate a key management service (KMS) posture using questions that surface real weaknesses, which is a common exam pattern when you must choose the most meaningful assessment …
Show notes
This episode teaches you how to evaluate a key management service (KMS) posture using questions that surface real weaknesses, which is a common exam pattern when you must choose the most meaningful assessment action. You’ll frame KMS threats such as unauthorized key use, key deletion or disablement, policy tampering, and stealthy decryption by overly privileged identities, then map each threat to what you should verify in configuration and logs. We’ll cover assessment prompts like: who can administer keys, who can use keys, are permissions scoped to specific keys and resources, are conditions enforced, and is key usage logging complete and reviewable. A scenario walks through an environment where encryption is enabled but a broad role can decrypt any dataset; you’ll identify the gap, explain why it matters, and outline the specific checks that confirm whether misuse would be detectable and reversible. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 33 — Design key management systems with clear ownership and strong boundaries
This episode explains how to design key management so encryption is not just “turned on,” but governed, auditable, and resilient under real operational pressure—exactly the angle the GPCS exam expects. You’ll …
Show notes
This episode explains how to design key management so encryption is not just “turned on,” but governed, auditable, and resilient under real operational pressure—exactly the angle the GPCS exam expects. You’ll define key ownership, key hierarchy concepts, and the separation between data encryption keys and the systems that wrap, store, and authorize their use. We’ll discuss boundary design: which teams can create keys, who can use keys for encrypt/decrypt, who can rotate or disable keys, and how to prevent a single role from holding end-to-end power. A scenario compares two designs: one where developers can both manage and use production keys, and one where ownership, usage, and audit review are separated with explicit approval paths and scoped permissions. You’ll leave with a threat-driven approach for building KMS designs that resist misuse while still supporting reliable application delivery. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
Episode 32 — Reduce token and session risk with strong lifecycle and revocation discipline
This episode focuses on token and session lifecycle management, because cloud breaches often succeed not by breaking MFA but by stealing and reusing sessions, refresh tokens, or long-lived access paths. You’ll …
Show notes
This episode focuses on token and session lifecycle management, because cloud breaches often succeed not by breaking MFA but by stealing and reusing sessions, refresh tokens, or long-lived access paths. You’ll define access tokens, refresh tokens, session cookies, and session state, then connect their lifetimes and renewal rules to practical risk: the longer a token lives and the broader its scope, the more valuable it is to an attacker. We’ll cover best practices such as short lifetimes for high-privilege sessions, strong reauthentication triggers, explicit logout and revocation workflows, and monitoring for token reuse from unexpected contexts. A scenario walks through a user who completes MFA once, then has a session token stolen via endpoint compromise; you’ll practice choosing controls that limit replay, force revalidation, and revoke quickly without locking out legitimate users during an incident. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
These are the latest 60 of 61 episodes. You’ll find older episodes in the podcast’s feed.
Recommended by Certified: The GIAC GPCS Audio Course
Similar podcasts
More Education podcasts
Is this your podcast?
Confirm it with an entry in your feed: you get a code here, add it as podcast:txt to the channel of your feed, and we check it. Your podcast is then shown as “verified” on SoundNode.