CISSP Cyber Training Podcast – CISSP Training Program
- Épisodes
- 382
- Parution
- hebdomadaire
- Dernier épisode
- 9 Nov 2026
À propos du podcast
Join Shon Gerber on his weekly CISSP Cyber Training podcast, where his extensive 23-year background in cybersecurity shines through. With a rich history spanning corporate sectors, government roles, and academic positions, Shon imparts the essential insights and advice necessary to conquer the CISSP exam. His expertise is not just theoretical; as a CISSP credential holder since 2009, Shon translates his deep understanding into actionable training. Each episode is packed with invaluable security strategies and tips that you can implement right away, giving you an edge in the cybersecurity realm. Tune in and take the reins of your cybersecurity journey—let’s ride into excellence together! 🚀
Participants
Épisodes 382
CCT 378: Two Feeds, Full Backup, And The Generators Never Started (Domain 3)
Send us Fan MailCISSP Domain 3.9 — design site and facility security controls, built on a real data center power failure where every control in the building worked and the building still went dark.Start free …
Notes de l’épisode
CISSP Domain 3.9 — design site and facility security controls, built on a real data center power failure where every control in the building worked and the building still went dark.
Start free: https://www.cisspcybertraining.com/free-cissp-self-study (360 practice questions, a Domain 1 diagnostic, weekly questions by email, and the slides from this episode)
In October, a cloud provider's London data center lost its utility power. The batteries picked up the load exactly the way they were supposed to, ran for about five minutes, and then ran out. The generators should have taken over in that window. They never got the signal.Nobody attacked anybody here. There are no bad guys in this one. No ransomware, no intrusion, nothing for incident response to chase. It was a cable fault outside the building and a logic error inside it.
HOW THE BUILDING WAS BUILT
Start with the design, because the design was good. Two completely independent utility feeds coming in from the power company — they call them A and B. Google's own words for that are a 2N utility power architecture.Now listen to where that label stops. Behind both of those feeds sits one central bank of high-voltage generators, run by a dual-redundant controller, a PLC. Two of the thing coming in. One of the thing that was supposed to save them. And between the utility going away and the generators coming up, a battery system with about five minutes of runtime. That isn't a lot and it isn't supposed to be. It's a bridge.
So when somebody tells you a site is 2N, the only honest follow-up is: 2N at which layer?
Five days before any of this, they ran a quarterly load test on the generators. A real test, under load. And that test found a problem. So they did the right thing — they scheduled the repair. But to do the repair they had to physically open the breaker on feed B and lock it out, which they did properly: keyed interlock, locked out, tagged out.And that is the moment the building stopped being 2N on the utility side. For several days — Google doesn't publish exactly how many — that site ran on one utility feed. Google's own words for it are a temporary single-feed, 1N, bridged maintenance posture.
Then the cable broke. An underground cable out on the utility network, outside the building entirely, developed a fault. And it was on feed A. The only feed that was live.
WHY THE GENERATORS NEVER STARTED
The PLC decides when to start the generators, and it decides it by sensing voltage. If the voltage goes away, start the generators. Simple enough.But those voltage sensors were wired upstream of the feed breakers. On the line side. And feed B — the one that was open for repairs — was still energized upstream, all the way up to that open breaker. The power company was still feeding it. It just wasn't connected to the building anymore.
So the PLC looks at its sensor, sees voltage on feed B, concludes that a healthy utility source is available, and never issues a start command.
Google's own root cause is this: a misconfiguration of the PLC logic that did not verify both an undervoltage condition and physical breaker position for both utility feeders. It checked whether there was voltage. It never checked whether that voltage was actually connected to anything.
And here's the part worth a line in your notes. That PLC was dual-redundant. There were two of them. Both of them were wrong in exactly the same way, because they shared a configuration. Duplicating the box does not duplicate the judgment. That's common-mode failure, and it is the reason a redundancy count is not a resilience measurement.
Five minutes later the batteries were done and the data halls went dark.
TWO NUMBERS, KEPT APART
About ninety minutes with the data halls unpowered. Six hours and eight minutes before the services on top of them were whole again. Both figures are in Google's report and they measure different things. According to The Register, the companies caught in that window included Lloyds, HSBC, Royal Mail and Revolut — Google published no customer list and no customer count.To their credit, Google published the whole thing: the timeline, the wiring, the root cause, and a list of fixes with dates on them. One of those action items is the most honest line in the document. They committed to making PLC code review part of facility commissioning — which tells you it wasn't.
THE MANAGER'S TAKEAWAY
Two things, and neither one is "test your generators."
They DID test. The quarterly load test is what found the fault in the first place. What nobody did was look at the consequence: fixing that fault meant opening a breaker, and opening that breaker meant the building ran on one feed for days. As far as anybody treated it, that was a maintenance ticket. It wasn't a changed risk posture.
And the second one, the one to carry into the exam room: an automatic control is only as good as the thing it can sense. The generator was perfect. The battery was perfect. The logic was asking a question — is there voltage? — at a place where it could not tell the difference between "the utility is healthy" and "the utility is healthy and no longer connected to us."Redundancy isn't a label on a drawing. It's a property of a system at a particular moment, and that moment includes whatever your facilities team happens to have open for repairs today.
IN THE TRAINING BLOCK• The power chain end to end, and the fourth thing almost nobody reads — the logic that decides when to start, which lives on a controls drawing rather than a power one.
• UPS runtime: battery in minutes, flywheel in seconds, and why five minutes is a bridge rather than a weakness.
• Redundancy notation — N, N+1, 2N, 2(N+1) — and why N+1 survives one failure but not one failure during maintenance.
• Concurrent maintainability versus fault tolerance: two different promises that candidates collapse into one.
• The three states of a redundant system — designed, degraded, failed — and why failure almost never arrives on its own.
• Every physical control has a sensing input: fire, cooling, water detection, door alarms, access control vestibules.
• The 3.9 recall content, and the crossovers named out loud — change management is 7.9, risk acceptance is 1.9, resilience and fault tolerance is 7.10.
FOUR CISSP PRACTICE QUESTIONSSet inside the real incident, so they are hard on the reasoning instead of hard on the reading. Common-mode failure; a FIRST question where the trap is the answer you are proudest of spotting; a MOST DIRECTLY question where the trap is the biggest answer on the list; and a control-class question where the trap is the governance gap the episode itself spent ten minutes describing.
CHAPTERS
0:00 Two power feeds, and the generators never started1:56 The whole thing in thirty seconds
3:36 A spare, or a complete second path
4:44 How the building was built
6:09 The load test, the open breaker, the cable fault
7:40 Why the controller never issued a start command
9:00 Two controllers, one mistake
10:18 The manager's takeaway
12:33 Free Essentials, Accelerator, Pro and the Cohort
15:51 Domain 3.9 and the power chain
19:03 Redundancy, and where the label stops
22:01 The three states of a redundant system
23:37 Every control has a sensing input
29:17 Question 1
32:20 Question 2 — the one that gets people
35:23 Question 3
38:31 Question 4
41:43 The pattern across all four
LINKS
Free CISSP Essentials — 360 practice questions, a Domain 1 diagnostic, weekly questions by email, 8+ hours of rapid review audio and video, and the slides from this episode:
https://www.cisspcybertraining.com/free-cissp-self-study
All episodes and the written walkthrough:
https://www.cisspcybertraining.com/podcast
CISSP Sprint Cohort — for people with a test date on the calendar:
https://www.cisspcybertraining.com/cohort-sprint-page
SOURCES
PRIMARY — Google Cloud's own incident report for europe-west2, Incident Xs2XTHzAVC9YnafnPyzj. Every figure above comes from here unless stated otherwise:
https://status.cloud.google.com/incidents/Xs2XTHzAVC9YnafnPyzjSECONDARY — The Register, 5 November 2026, Simon Sharwood. The four customer names come from here, NOT from Google:
https://www.theregister.com/off-prem/2026/11/05/when-datacenters-lose-power-generators-should-kick-in-that-didnt-happen-for-google-in-london/5307739Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 377: 155 Answers, Nobody Broke In, And The Control Nobody Named (Domain 2)
Send us Fan MailCISSP Domain 2.6 — data security controls, compliance requirements, and the three states of data, built on an AI hosting exposure that encryption could never have reached, because the data was …
Notes de l’épisode
CISSP Domain 2.6 — data security controls, compliance requirements, and the three states of data, built on an AI hosting exposure that encryption could never have reached, because the data was exposed while it was being used.
Start free: https://www.cisspcybertraining.com/free-cissp-self-study (360 practice questions, a Domain 1 diagnostic, weekly questions by email, and the slides from this episode)
One hundred and fifty-five answers went to the wrong people. Nobody broke in.
In late August, Cloudflare launched the GLM-5.3 model on Workers AI. The model advertised a context window of just over one million tokens. The memory pool behind it — the prefill KV cache — held about six hundred and eighty thousand. The pool was smaller than the thing it was advertised to hold.
Picture a shared workbench with a scratch pad on it. You sit down, you do your working-out, you get up and leave. In a well-run shop somebody wipes that pad before the next person sits down. That pad is memory, and wiping it is the control.
When a request came in too big for the pad, the system marked it rejected, which was correct, and then passed the pad downstream anyway. The next stage read it, found the previous request's working still on it, and handed that back as a successful answer. Not an error. An HTTP 200.
155 responses were affected, every one from a prompt over the pool's limit. Cloudflare said only that a small number of customers were involved and published no customer count. It found no evidence of deliberate exploitation. This was an exposure — nothing was taken, nobody broke in — and the misconfigured value and the serving-engine behavior both sat in the hosting stack, not with the model's maker. The advertised context length itself was accurate.
Security researcher Gadi Evron of Knostic reported it through HackerOne. Cloudflare began verifying it the next morning and reproduced it from two independent accounts within twenty-five minutes of declaring the incident — and the model was offline about fifteen hours after the report landed. Root cause thirty-five minutes later, corrected configuration seventeen minutes after that. It raised the pool to roughly twice the advertised window, moved retirement of rejected requests to the admission queue before any cache transfer, added a deployment check comparing pool size to context length, and published the whole timeline itself.
Now the part that turns it into exam content. Encryption at rest and encryption in transit were never going to touch this one. Not because anything was wrong with them. Because neither one has a single thing to say about data while it is being used.
And they knew. Cloudflare knew before launch that the two numbers disagreed. It assumed the engine would handle it cleanly, and what it validated was the status code and the performance — not the answer coming back. The engine said 200 OK, so it looked fine. It was not a secret. It was an assumption nobody had validated, standing in for a control nobody owned.
A control is not a control because of what it is called. It is a control because of what fails when it is wrong.
In this episode:
• The three states of data — at rest, in transit, in use — and why the third is the one you get tested on. At rest and in transit are cryptography questions. In use is an isolation question, and cryptography alone does not reach it. Confidential computing is the exception.
• The data-in-use control vocabulary: memory isolation, zeroization between requests, object reuse controls, confidential computing, homomorphic encryption and admission control. Object reuse is the classic ISC2 phrasing for this failure shape.
• Scoping and tailoring, and the precision trap. Scoping is not a step before tailoring — it is one of the six tailoring actions NIST SP 800-53B names, and an option that sequences them is the distractor.
• Standards selection and baselines: ISO 27001, NIST SP 800-53 and 53B, CSF 2.0, CIS, the Cloud Controls Matrix, PCI DSS and SOC 2, taught by differentiator rather than contents. A baseline is a floor, not a fit.
• Data protection methods — DRM, DLP, CASB, tokenization and masking — and why not one of them would have caught this. Every one reads a content flow.
• Multi-tenancy and shared responsibility, and the control each side assumed the other already owned.
• The crossover, named out loud: "should we accept this?" is Domain 1. "How is it enforced?" is Domain 3. "What does this data require?" is 2.6, and that is this episode.
• Four CISSP practice questions and the trap inside each one. Question two is the one that gets people.
The line to carry into the exam room: Domain 2.6 does not ask you to list encryption types. It asks which controls this data, in this state, in this environment actually requires — and then whether anybody owns them as requirements.LINKS
Free CISSP Essentials:
https://www.cisspcybertraining.com/free-cissp-self-studyAll episodes and the written walkthrough:
https://www.cisspcybertraining.com/podcast
The CISSP Sprint Cohort — 8 weeks, live, paced to your exam date, with an accountability partner:
https://www.cisspcybertraining.com/cohort-sprint-page
SOURCESPrimary — Cloudflare's own incident writeup, published late October 2026:
"Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang"
https://blog.cloudflare.com/kv-cache-exposure-remediation
Reported by security researcher Gadi Evron, Knostic, via HackerOne.
Shon Gerber, CISSP — former Commander, 177th Information Aggressor Squadron. Former CISO, fractional CISO, founder of CISSP Cyber Training.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 376: Investigation Types and the Device Behind the Television (Domain 1)
Send us Fan MailA company found a concealed recording device in the room where its executives meet. They pulled it, imaged it, reviewed the camera footage, went through the employee's internal tool usage …
Notes de l’épisode
A company found a concealed recording device in the room where its executives meet. They pulled it, imaged it, reviewed the camera footage, went through the employee's internal tool usage, found a second device in a bag he had left in another room, terminated him and referred the matter to the FBI.
Every one of those steps was reasonable. And somewhere in the middle of that list, the investigation stopped being theirs.
This episode is CISSP Domain 1.6 — requirements for investigation types. It is five types on one line of the exam outline with no tools in them, and the exam asks about it anyway.
At the start the company was running an administrative investigation: their building, their equipment, their employee, their policies, and a standard of proof that was their own. By the end a federal case was running alongside it, with a standard they do not control and evidence rules they are not a party to. Nobody announces that switch — and four things change the moment it happens: the standard of proof you must meet, what you have authority to collect, whether what you gathered can be used, and who you are permitted to tell. All four change retroactively, across everything you already collected.
In this episode:
· All five investigation types — administrative, criminal, civil, regulatory, industry standards — and what each one can actually do to you
· Why the type follows whose AUTHORITY the inquiry runs under, not the conduct and not the severity
· Burden of proof by type, and why administrative is the one standard the organization sets for itself
· Chain of custody worked step by step from the real case, including the bag that cannot be un-opened
· Why a forensic image that produced no readable data is still a finding, and why process produces admissible evidence while content produces a conclusion
· The five characteristics of evidence, and why only four of them are properties of the evidence
· Civil preservation: the duty attaches when litigation is reasonably anticipated, not when a complaint is served
· Regulatory: the regulator sets the scope and can compel production, so your own investigation discharges nothing
· Industry standards: a contractual obligation, where the contract names who is permitted to do the work
· What a manager decides before any of it — naming the type out loud, setting the referral trigger in advance, and collecting as though the type will changeIt closes with four scenario questions, spread deliberately across all five types. Two are set inside the real case and two are explicitly transposed to a different organization. Question three is the one that catches well-prepared candidates: its trap is the answer the most level-headed person in the room usually gives.
A note on the case: a former engineer has been arrested and charged by criminal complaint. He has not been convicted, and everything about his conduct is an allegation. The company has said it has no indications that model weights, source code or customer data were accessed.
Source: U.S. Department of Justice, Office of Public Affairs press release, October 2026.
Newsroom: https://www.justice.gov/newsGain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox.
Go to CISSPCyberTraining.com for the full question bank, the domain walkthroughs, and the CISSP Sprint Cohort.
Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 375: The Malicious Workflow Was Already There (CISSP Domain 8.2)
Send us Fan MailA “boring” GitHub Actions workflow file should never be able to empty your secrets vault, yet that is exactly what the Ghost Action campaign shows. We walk through GitGuardian’s research and the …
Notes de l’épisode
A “boring” GitHub Actions workflow file should never be able to empty your secrets vault, yet that is exactly what the Ghost Action campaign shows. We walk through GitGuardian’s research and the real mechanics of how attackers use stolen but valid developer tokens to add or modify workflow YAML, scrape secret names from your own repo, and exfiltrate CI/CD secrets to an external endpoint. The scary part is not exotic malware, it is normal automation doing what it was designed to do.
From a CISSP Domain 8.2 perspective, this becomes a lesson in securing the development ecosystem: repositories, pipelines, toolchains, and the endpoints that build software. We unpack the trap many teams fall into during incident response rotating secrets but failing to revoke the credential that injected the workflow, or failing to remove the malicious workflow entirely. If the attacker keeps write access, you may have automated their next theft. We also dig into the governance question that changes budgets and outcomes: who owns the pipeline, not who operates it.
We then connect the dots to modern development realities, including AI coding tools. We cover risks like insecure generated snippets, hallucinated vulnerabilities, dependency confusion, and why an AI assisted editor should be treated as a privileged endpoint based on what it can reach. You will also get a clean mental model for SAST, DAST, IAST, and SCA, plus concrete controls like least privilege build identities, short lived scoped credentials, signed or pinned build steps, separation of duties, and logging that someone actually reads.
If you are studying for the CISSP or leading a secure SDLC program, listen through, take notes, and then share this with the person who “owns” your CI/CD pipeline. Subscribe, leave a review, and tell me what control you would implement first.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 374: They Had Backups, They Could Not Reach Them. (CISSP Domain 7.10)
Send us Fan Mail495 organizations woke up and could not get to their servers. Railways. A prefectural police force. A food logistics company that could not receive or ship goods. All on the same cloud provider …
Notes de l’épisode
495 organizations woke up and could not get to their servers. Railways. A prefectural police force. A food logistics company that could not receive or ship goods. All on the same cloud provider, all locked out at once.
Then the provider said this, in writing: "At this time, our view is that data restoration will only be possible from backup data held by the customer themselves."
Read that again. You are getting your data back from your own backups — and for some of those customers, the backups were sitting in the same cloud that had just gone dark.
This episode is CISSP Domain 7.10 — implement recovery strategies — and it is the subdomain people assume they already know, because everybody has backups. Almost nobody has asked the second question, which is what else has to be working for them to reach those backups.
You keep a spare key to your house. Smart. The only question that matters is where you keep it, and inside the house is a backup you cannot get to on the one day you need it.
We cover RTO versus RPO versus MTD — which number means what, and which control actually satisfies each one, because candidates swap the first two constantly. Backup storage strategies across onsite, offsite, cloud, air-gapped and immutable, and why "offsite" is not a distance. Recovery site tiers from cold through hot, sized by RTO, plus the two nobody revises. Reciprocal agreements and the three ways they fail. Resource capacity agreements, and why a hot site contract can still leave you in a queue. Why high availability is not a recovery strategy, and why synchronous replication copies corruption as faithfully as it copies good data. Shared fate, including the version everybody misses — shared credentials. And the untested restore, where your real recovery time actually comes from.
Then four practice questions set inside the same scenario. Question three is the one that catches well-prepared candidates, and I say so before I ask it.
Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox. Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Source: Cybernews, "Japanese cyberattack hits 495 organizations, railways and police" — https://cybernews.com/security/japanese-cloud-cyberattack-railways-police-495-organizations-idcf/Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 373: An AI Agent Was Told No and Got In Anyway (CISSP Domain 6.2)
Send us Fan MailAn AI agent gets blocked by access controls, then calmly finds another way in anyway and that is the wake-up call. I use a recent Hacker News story about an automated agent bypassing an …
Notes de l’épisode
An AI agent gets blocked by access controls, then calmly finds another way in anyway and that is the wake-up call. I use a recent Hacker News story about an automated agent bypassing an Australian government health portal to dig into what CISSP Domain 6.2 is really testing: not your ability to recite a list of techniques, but your ability to manage authorization, scope, and rules of engagement so a “test” does not turn into an intrusion.
We break down why the portal controls could still be “working as configured” while the outcome is still unacceptable, especially when the client is autonomous and treats refusal as an obstacle instead of an answer. I map the scenario to a simple locksmith model: the same tools and actions can be legitimate with a signed work order, or criminal without one. From there, we get concrete about what must be written down, including in-bounds systems, forbidden actions like writing or persistence, stop conditions, evidence handling, time windows, and a named human point of contact on both sides.
Then we translate the messy reality into clear exam thinking: vulnerability assessment versus penetration testing, black box versus white box versus gray box, and the commonly missed tools like misuse case testing, synthetic transactions, coverage analysis, and interface testing. I also clarify the difference between a penetration test, a red team engagement, and breach and attack simulation, so you can match the method to the question. We close with CISSP-style practice questions that reinforce triage priorities, engagement selection, and how to extend policy and accountability to AI agents acting on your organisation’s behalf.
If you want more Domain 6.2 clarity and fewer distractor traps, subscribe, share this with a study partner, and leave a review so more CISSP candidates can find the show.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 372: Stolen Sessions and Why MFA Never Saw Them (CISSP Domain 5.6)
Send us Fan MailA stolen password is annoying. A stolen session token can be invisible, valid, and instantly profitable. Today we dig into a real warning sign from Okta threat intelligence: infostealer malware …
Notes de l’épisode
A stolen password is annoying. A stolen session token can be invisible, valid, and instantly profitable. Today we dig into a real warning sign from Okta threat intelligence: infostealer malware lifted live session tokens from browsers, and thousands of Google sessions were still working weeks later. No MFA prompt. No brute force. Just a legitimate session replayed by the wrong person, with real dollar damage through unauthorized usage and credits.
We use that story to sharpen the CISSP Domain 5.6 mindset around implementing authentication systems and, more importantly, validating tokens after sign-in. I walk through why authentication and token validation are different security functions with different “owners,” why forcing password resets does not invalidate an attacker’s existing session, and what a token signature does and does not prove. Then we get practical: audience claim checks, expiration and token lifetime ceilings, scope validation, and why “skipping the audience check breaks nothing in testing” is exactly how breaches scale.
We also cover the controls that shrink risk when you cannot reliably detect theft: short access token lifetimes, narrow scoping to limit blast radius, hardware-backed signing key storage, and automated key rotation with defined crypto periods. To lock it in, we run through four CISSP-style questions and explain the traps so you can answer like a risk-focused manager, not a spec reciter.
Subscribe for more CISSP exam training, share this with a teammate who owns IAM, and leave a review so more candidates can find the show.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 371: Secure Communication Channels and Who Is Really On Your Call (Domain 4.3)
Send us Fan MailOne video hotline feels like a single, simple conversation until you trace the call path and realise there may be seven companies involved in making it work. That’s the spark for this …
Notes de l’épisode
One video hotline feels like a single, simple conversation until you trace the call path and realise there may be seven companies involved in making it work. That’s the spark for this training-focused breakdown of CISSP Domain 4.3 secure communication channels, using the viral AI “actress hotline” story to show how modern voice and video collaboration really behaves behind the curtain.
We start with a practical analogy: you think you’re transacting with the waiter, but your meal passes through a hidden chain of people you never met. The same thing happens with telephony, video conferencing, contact centres, telehealth platforms, transcription tools, AI response generation, and cloud infrastructure. Even when every vendor is legitimate, contracted, and disclosed, your security model can fail if it only accounts for the one company you can see.
From there, we get concrete about what CISSP candidates are tested on: who can join a call, what services are attached (recording, transcription, analytics), what survives after the call, and where trust boundaries actually sit. We also tackle a classic trap: encryption in transit can stop interception, but it does not prevent authorised intermediaries like transcription providers or model services from decrypting and processing content. Finally, we connect the dots to retention “clocks” and transborder data flows, including how Domain 4 channel design intersects with Domain 1 legal transfer mechanisms and accountability.
If you’re studying for the CISSP exam or building a real-world secure communications programme, you’ll leave with a clearer mental model and a set of exam-style questions you can use right away. Subscribe, share this with a fellow CISSP candidate, and leave a review so more security pros can find the show.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 370: CISSP Cryptography, FIPS Validation, and Post-Quantum (Domain 3)
Send us Fan MailA compliance deadline can change your security posture without changing a single bit of your encryption. We start with a simple sticker-on-the-windshield analogy that maps directly to what’s …
Notes de l’épisode
A compliance deadline can change your security posture without changing a single bit of your encryption. We start with a simple sticker-on-the-windshield analogy that maps directly to what’s happening with FIPS 140 validations: your VPN can keep encrypting, your database can keep protecting data, and yet an assessor can still mark you down because “working” is not the same as “validated.”
We walk through the practical CISSP Domain 3 lesson behind the noise: the difference between an algorithm claim (we use AES-256), a configuration claim (we run in FIPS mode), and an evidence claim (we hold an active FIPS 140 validation on the CMVP list). With FIPS 140-2 certificates moving to historical status and FIPS 140-3 testing queues stretching beyond 500 days, the manager move is not wishful thinking. It’s documenting the gap, treating it as risk, and getting formal risk acceptance with executive sign-off plus a real remediation plan, especially if you’re facing CMMC or customer security assessments.
From there we connect the dots across cryptographic life cycle management, cryptographic agility, and the real places crypto fails: key management and implementation. We cover HSM storage, rotation, dual control versus split knowledge, PKI revocation choices (CRL, OCSP, OCSP stapling), common cryptanalysis categories, and why side-channel and fault-injection attacks hit modules rather than “the math.” We then get clear on quantum risk, harvest now decrypt later, and what NIST’s post-quantum standards (ML-KEM, ML-DSA, SLH-DSA) mean for your migration plan starting with a cryptographic inventory.
Subscribe for more CISSP exam-ready training, share this with a teammate who owns compliance evidence, and leave a review if it helped. What would fail first in your environment: the crypto itself, or the proof you can show an auditor?Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 369: Security Models Demystified - CISSP Domain 3.2 (Replay of CCT 278)
Send us Fan Mail🔁 REPLAY — this episode originally aired as CCT 278 in September 2025.I'm heads-down finishing a Domain 3 cryptography episode, so I'm re-running oneof the strongest episodes in the …
Notes de l’épisode
🔁 REPLAY — this episode originally aired as CCT 278 in September 2025.
I'm heads-down finishing a Domain 3 cryptography episode, so I'm re-running one
of the strongest episodes in the archive rather than shipping something thin.
If you're newer to the show, you haven't heard this one. And if you're studying
Domain 3 right now the timing works in your favor — security models are the
foundation the rest of the domain sits on, and next week's episode picks up in
the same domain.
New material next Monday.
---
Security models represent some of the most difficult concepts for CISSP exam
candidates to master, yet they form the foundation of implementing and
understanding security controls. This episode breaks down Domain 3.2's security
models using plain language and practical examples.
The episode opens with analysis of the TransUnion data breach affecting 4.4
million individuals, demonstrating why proper security architecture matters. It
then explores the Trusted Computing Base (TCB) — the foundation for secure code —
covering key components like the Security Kernel, Reference Monitor, Trusted
Path, and TCB Boundary.
The core focus examines the eight major security models essential for exam
preparation. These include Bell-LaPadula's confidentiality-focused "no read up,
no write down" principle, Biba's integrity-centered approach, Clark-Wilson's
business integrity enforcement through duty separation, and Brewer-Nash's
conflict-of-interest prevention. Additional models addressing specific security
concerns are also covered.
The episode concludes with exam preparation guidance, highlighting which models
deserve priority study attention.
⚠️ Since this is a replay: the TransUnion breach discussed at the top is from
2025. The Domain 3.2 material is unchanged and still current.
Ready to stop guessing on Domain 3?
Accelerator $19/mo · Pro $39/mo · Sprint Cohort
https://www.cisspcybertraining.comGain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 368: CISSP Asset Security and Data Classification (Domain 2)
Send us Fan MailNine million images. No password. No encryption. And the defence was basically: “It wasn’t public because you had to know the URL.” That single line opens up one of the most important CISSP …
Notes de l’épisode
Nine million images. No password. No encryption. And the defence was basically: “It wasn’t public because you had to know the URL.” That single line opens up one of the most important CISSP Domain 2 conversations you can have: security through obscurity is not access control, and a hidden address is not a key. We take this real data exposure and translate it into the kind of manager-level reasoning the CISSP exam demands, not memorised trivia.
We then zoom out into Asset Security fundamentals: identification and inventory, data classification based on impact, and the roles that make controls enforceable. We break down data owner versus custodian, plus controller and processor language you will see in privacy frameworks like GDPR. The core takeaway is simple and painful: without a named owner, nothing downstream is mandatory, so encryption, authentication, retention jobs, and evidence-producing logging keep losing to deadlines.
Finally, we turn the incident into practice questions and “spot the trap” exam thinking: accountability does not transfer when you outsource, absent controls are not weak controls, and impact is not likelihood. We also hit retention and destruction across the data lifecycle, including NIST SP 800-88 clearing, purging, and destruction, and where degaussing and crypto erase really belong.
Subscribe for more CISSP exam prep with real-world security stories, share this with a study partner, and leave a review if it helps you think more clearly under exam pressure.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 367: Threat Modeling and the AI Agent That Breached Hugging Face (CISSP Domain 1.10)
Send us Fan MailA rogue AI agent didn’t “hack the future” so much as exploit the oldest security problems in the book: weak boundaries, over-trusted inputs, exposed endpoints, and credentials lying around. We …
Notes de l’épisode
A rogue AI agent didn’t “hack the future” so much as exploit the oldest security problems in the book: weak boundaries, over-trusted inputs, exposed endpoints, and credentials lying around. We walk through the Hugging Face intrusion story like a CISO briefing a board, step by step, translating a fast-moving AI-red-team narrative into the kind of clear threat modeling logic you need for ISC2 CISSP Domain 1.10 and for real risk decisions.
From there, we shift into training mode and get concrete about threat modeling concepts and methodologies. We define threat modeling the way the exam cares about it: proactive, iterative, and designed to produce security requirements and prioritised countermeasures that feed your SDLC and risk register. We break down the three starting perspectives (asset-centric, attack-centric, and system-centric), then anchor STRIDE to data flow diagrams and trust boundaries so you can identify what security property is actually being violated, not just recite acronyms.
We also cover the difference between identifying and ranking threats so you don’t fall into the classic traps: DREAD ranks threats you already found, while PASTA starts with business objectives and risk appetite and is built for risk-centric outputs leaders can fund. We talk attack trees, why MITRE ATT&CK is an input rather than a methodology, and why your threat actor catalog must include authorized non-human identities and vendor integrations that can operate outside intended scope. If this helps, subscribe, share it with a study buddy, and leave a quick review so more CISSP candidates can find it.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 366: Software Supply Chain Security Explained — CISSP Domain 8 (ChainDrop Case Study)
Send us Fan MailA supply chain attack that leaves your Git history spotless should change how you think about “secure code.” We walk through ChainDrop, a worm discovered in the NPM ecosystem that poisoned 444 …
Notes de l’épisode
A supply chain attack that leaves your Git history spotless should change how you think about “secure code.” We walk through ChainDrop, a worm discovered in the NPM ecosystem that poisoned 444 packages while evading the places defenders usually look. The unnerving twist is that it can trigger without a classic npm install and can hide in the space between your repository and the package archive your CI/CD pipeline actually pulls, which is exactly why code review alone can’t be your finish line.
From there, we tie the real-world scenario directly to CISSP Domain 8 Software Development Security and the secure SDLC. I lay out a clear, exam-friendly framework for assessing third-party and acquired software risk: Software Composition Analysis (SCA), Software Bill of Materials (SBOM), vendor and publisher risk assessment, and runtime plus pipeline controls. We talk about why SCA is necessary but incomplete, how a living SBOM enables fast exposure checks when a new campaign hits, and why Executive Order 14028 is pushing SBOM adoption into “expected” territory for many organisations.
We also get practical about CI/CD pipeline security: dependency pinning, trusted publishing workflows, signed commits, OIDC, and package signing and verification approaches like Sigstore and Cosign. Finally, we run through scenario-based practice questions that highlight common CISSP traps and the manager mindset the exam rewards. If you want more episodes like this, subscribe, share it with a developer or security lead, and leave a quick review so more CISSP candidates can find the show.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 365: Malicious QR Code Attacks and Digital Forensics Techniques Every CISSP Should Know [REPLAY]
Send us Fan MailOne careless QR scan can quietly turn a “private” chat into a live wiretap. We start with a timely threat story: Russian APT-style actors abusing Signal’s linked device flow by pushing phishing …
Notes de l’épisode
One careless QR scan can quietly turn a “private” chat into a live wiretap. We start with a timely threat story: Russian APT-style actors abusing Signal’s linked device flow by pushing phishing links that contain malicious QR codes, so messages can be mirrored to an attacker device in real time. If you use Signal, WhatsApp, or Telegram at work, this is the kind of simple, human-triggered failure mode worth building into your security awareness habits.
Then we shift into CISSP Question Thursday with a rapid, practical run through CISSP Domain 7.1 style topics in digital forensics and incident response. We break down what comes first when handling digital evidence (forensic copy before analysis), how to examine a suspicious file without detonating it (static analysis), and what makes an incident report useful under pressure (a clear timeline of events and actions taken). We also cover insider threat artifacts, mobile device forensics tools like Cellebrite UFED, and why chain of custody is the backbone that keeps evidence credible from collection to court.
Along the way, we talk about root cause analysis, anomaly-based detection for network traffic, and why clear writing beats big jargon when you’re briefing executives, legal, or a board. If you want exam-ready thinking that also maps to real investigations, you’ll get it here.
Subscribe for weekly CISSP training, share this with a teammate who scans QR codes too fast, and leave a review with the topic you want next.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 364: Third Party Risk Management - How One Vendor Breach Exposed 119,000 Users
Send us Fan MailA breach can hit your headlines even when your own systems never get touched, and that’s exactly why third-party risk management keeps showing up on the CISSP exam and in real incident reports …
Notes de l’épisode
A breach can hit your headlines even when your own systems never get touched, and that’s exactly why third-party risk management keeps showing up on the CISSP exam and in real incident reports. We walk through the Vimeo breach tied to its analytics vendor Anodot, where compromised vendor access and authentication tokens gave attackers a clean path to customer data. No video content or payment data was taken, but names, emails, and metadata exposure is still a trust and reputation problem that security teams have to own.
From there, we zoom out to the bigger pattern behind modern supply chain security: attackers increasingly go after dependencies, CI/CD pipelines, shared developer tools, and widely used vendors because one compromise can cascade across hundreds of customers. We talk about how to reduce that exposure with a stronger TPRM program, including vendor risk tiering, continuous monitoring, SBOM thinking, and practical contractual controls like breach notification timelines, right to audit language, and clear subcontractor disclosure with flow-down requirements to address fourth-party risk.
We also shift into CISSP Domain 1 rapid review mode: what the exam really wants when it asks about due diligence, evidence, and proportional risk decisions. You’ll hear clean explanations of SOC 2 Type 1 vs SOC 2 Type 2, where ISO 27001 fits, why questionnaires like SIG are not proof, and which frameworks matter for third-party and supply chain risk management including NIST 800-161, ISO 27036, and NIST CSF 2.0. We close with practice scenarios that mirror common CISSP traps so you can spot them fast.
Subscribe for more CISSP training, share this with a study partner, and leave a review so more security pros can find the show.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 363: CISSP AI Governance - What Credit Union Examiners Are Really Asking
Send us Fan MailOne bad AI decision can cost you more than money. It can cost you trust, trigger regulators overnight, and put your name on the hook when the board asks, “Who approved this?” We dig into AI …
Notes de l’épisode
One bad AI decision can cost you more than money. It can cost you trust, trigger regulators overnight, and put your name on the hook when the board asks, “Who approved this?” We dig into AI governance through a CISSP lens, using real-world banking and credit union scenarios that show how fast things go sideways when AI tools slip outside your controls.
We start with the uncomfortable reality behind modern AI adoption: vendors ship powerful models, teams connect third parties, and employees reach for whatever chatbot is quickest. From AI-powered lending platforms that promise speed and fairness, to shadow AI that starts with a simple copy paste of customer data, the common thread is the same. Policies are not protection unless you can detect, enforce, and prove what’s happening with data, models, and vendors.
Then we get practical. We walk through what examiners and auditors actually look for, why NIST AI RMF and existing third-party risk management rules are becoming the default playbook, and how to build evidence that holds up. Expect clear guidance on independent bias testing, explainability, contract language like right to audit and incident notification SLAs, and why model revalidation must be triggered by material change rather than an annual calendar cycle. We also tie the work back to CISSP domains and run practice questions designed to expose the “easy” answers that fail in real governance.
If you’re responsible for security, compliance, or risk, this is your roadmap for governing AI before it governs you. Subscribe, share with a teammate, and leave a review so more CISSP candidates and security leaders can find the show.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 362: Security Assessment Strategies & Abandoned Cloud Storage Risks (CISSP 6.1) - REPLAY
Send us Fan MailThat forgotten cloud storage you stopped thinking about months ago can become a real attack path today. We start with a simple but dangerous scenario: abandoned AWS S3 buckets and other orphaned …
Notes de l’épisode
That forgotten cloud storage you stopped thinking about months ago can become a real attack path today. We start with a simple but dangerous scenario: abandoned AWS S3 buckets and other orphaned cloud storage that can be re-registered, repurposed, and used to serve malicious content to systems that still “trust” the old source. We walk through why this turns into a supply chain-style problem, what signals to look for, and the practical mitigations that matter most: proper decommissioning, continuous monitoring, tight access control, and disciplined cloud asset inventories.
From there, we shift into CISSP Domain 6.1 and the real work of designing and validating assessment, test, and audit strategies. We explain how we approach building a security assessment and testing program from the ground up: clear objectives, tight scope, risk-based prioritisation, stakeholder alignment, and baselines grounded in frameworks like NIST CSF, ISO 27001, CIS Benchmarks, and NIST SP 800-53. The aim is simple: identify vulnerabilities, validate security controls, and turn findings into remediation that leadership can act on.
We also break down core security testing methods you will see on the CISSP and in real organisations: vulnerability assessment, penetration testing (white box, black box, gray box), fuzz testing, SAST and DAST for application security, plus red team, blue team, and purple team collaboration. Finally, we demystify SOC 1 vs SOC 2 and Type 1 vs Type 2 reports, why they matter for third-party risk management, and how cyber resilience thinking (including the Cyber Resiliency Index) ties everything back to continuity and trust. If this helps, subscribe, share the show with a colleague studying CISSP, and leave a review with the topic you want next.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 361: Bad Epoll - Root Access in 6 Instructions
Send us Fan MailA six-instruction timing glitch in the Linux kernel can be the difference between “low-priv user” and full root control, and that is why we dig into the Bad EPoll vulnerability from a …
Notes de l’épisode
A six-instruction timing glitch in the Linux kernel can be the difference between “low-priv user” and full root control, and that is why we dig into the Bad EPoll vulnerability from a CISSP-ready, manager-first angle. We start by grounding what the Linux kernel EPoll subsystem does, why it is foundational to high-performance I/O, and why “just disable it” is not a real option when you’re dealing with production Linux servers, desktops, cloud workloads, and Android devices.
Then we unpack the security mechanics in clear terms: a use-after-free race condition, an impossibly thin race window, and the way memory corruption turns into privilege escalation. We also talk about what makes this case extra concerning, including the report that it can be triggered from inside Chrome’s rendering sandbox. If you’ve ever relied on sandboxing, kernel boundaries, or “we run scanners” as your safety net, this story forces a more honest view of defense in depth.
From there we connect the dots to CISSP Domain 8 software development security and real secure SDLC practice. We walk through where SAST, DAST, fuzzing, KASAN-style instrumentation, and AI-assisted code review help and where they fail, especially for concurrency bugs. The real takeaway is a layered detection strategy: automated testing plus manual secure code review for high-blast-radius code, support for external researchers through bug bounty programmes, and a patch management process that moves in days with verification and regression testing so incomplete fixes do not slip through.
If this helps you think like a manager, subscribe, share the episode with a study buddy, and leave a review so more CISSP candidates can find it.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 360: SSA Whistleblower and the Thumb Drive: What CISSP Asset Security Tells Us About This Disaster
Send us Fan MailImagine hearing a claim that the most sensitive identity data in the United States could be sitting on a personal thumb drive. That allegation is still unverified and under investigation, but it …
Notes de l’épisode
Imagine hearing a claim that the most sensitive identity data in the United States could be sitting on a personal thumb drive. That allegation is still unverified and under investigation, but it gives us a rare chance to see CISSP Domain 2 asset security in real time, with consequences that go far beyond a typical data breach.
I walk through what’s being reported about Social Security Administration data access and potential copying, then I put on the Domain 2 lens: data classification and handling requirements, who the true data owner is, what custodians should be enforcing, and how processors should be limited by scope, purpose, and time. We talk about why “high” impact data under FIPS 199 should automatically trigger stricter controls, and how failures in encryption, logging, and data loss prevention can let sensitive datasets slip outside organizational boundaries.
We also dig into the part most teams get wrong: the data lifecycle. If you cannot execute secure disposal and verify it, you cannot “close Pandora’s box.” Using NIST SP 800-88, we break down clear, purge, and destroy, connect it to real operational controls like removable media restrictions, and turn the whole story into practical exam guidance and CISO-level program lessons you can use with leadership.
Subscribe for more CISSP-ready breakdowns, share this with someone studying Domain 2, and leave a review so more security pros can find the show. What is the first control you would fix in your own environment?Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 359: ShinyHunters vs. Oracle — Supply Chain Risk Every CISSP Must Know
Send us Fan MailA vendor gets breached and suddenly your perimeter does not matter, because the attacker does not need to “hack” you. They just reuse the access you already approved. That’s the core lesson …
Notes de l’épisode
A vendor gets breached and suddenly your perimeter does not matter, because the attacker does not need to “hack” you. They just reuse the access you already approved. That’s the core lesson behind the Shiny Hunters campaign targeting Oracle PeopleSoft servers at colleges and universities, where compromised access led to large-scale theft of student data and a messy, high-impact supply chain incident.
We walk through what supply chain security really means for modern cybersecurity and for the CISSP exam: it’s not only the software you buy, but also hardware vendors, cloud service providers, managed service providers, open source libraries, and contractors with privileged access. I break down the four supply chain attack vectors you need to know cold: compromised credentials and OAuth tokens, malicious code injection in CI/CD pipelines, open source package attacks like typosquatting and maintainer compromise, and hardware tampering. Along the way, we map the ideas to CISSP Domains 1, 3, 5, and 8 so you can answer questions like a manager, not just a technician.
Then we go deeper on two concepts that keep showing up in both real breaches and exam questions. First, SBOM (Software Bill of Materials), the “nutrition label” that tells you exactly what’s inside your software so you can respond fast when a new CVE hits. Second, OAuth token governance, where long-lived or overly broad tokens can become silent master keys if you do not scope, expire, inventory, revoke, and monitor them properly. We finish with three practice questions and the reasoning behind the best answers and the common distractors.
If this helps, subscribe so you do not miss the next training, share the episode with a CISSP study partner, and leave a review to help more security pros find the show.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 358: EDR Bypass Ransomware: The Gentle Killer Threat Every CISSP Must Know
Send us Fan MailYour endpoint tool can be world class and still get taken out first. That’s the unsettling reality behind a new wave of “EDR killer” capabilities being packaged inside ransomware-as-a-service …
Notes de l’épisode
Your endpoint tool can be world class and still get taken out first. That’s the unsettling reality behind a new wave of “EDR killer” capabilities being packaged inside ransomware-as-a-service platforms, where affiliates can plug in advanced evasion without building it themselves. When attackers can blind endpoint detection and response before the ransomware payload runs, the old comfort of “we have EDR, so we’re covered” turns into a single point of failure.
We unpack the reporting on a highly active ransomware operation and its toolset, then zoom in on the technical path that makes this work: BYOVD, bring your own vulnerable driver. With admin access, attackers load a legitimate but vulnerable signed driver, escalate into kernel mode, and terminate security processes from below the privilege stack. From there, we shift to what matters for real security programs: defence in depth, kernel integrity protections like HVCI and KMCI, strict driver allow and block policies, and aggressive driver hygiene to reduce attack surface.
Then we put on the CISSP lens. We tie the scenario to Domain 7 security operations (EDR limits, incident response, monitoring), Domain 3 security architecture and engineering (layered controls, hardening), and Domain 1 security and risk management (risk = threat × vulnerability × impact, plus threat landscape shifts). The big takeaway is simple: your job isn’t to find the fanciest tool, it’s to build a program that still works when one control fails and to communicate that risk clearly to leadership.
If this helps you think like a manager and study smarter, subscribe for weekly CISSP-focused breakdowns, share the episode with a teammate, and leave a review so more people can find the show.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 357: Is Your Encrypted Data Already Stolen? Quantum Risk & Supply Chain Attacks for CISSP
Send us Fan MailSomeone is stealing encrypted data right now and they are not trying to read it today. They are saving it for later, betting that quantum computing will eventually break the encryption that …
Notes de l’épisode
Someone is stealing encrypted data right now and they are not trying to read it today. They are saving it for later, betting that quantum computing will eventually break the encryption that protects it. I dig into the “Harvest Now, Decrypt Later” strategy, why it matters most for long-term confidentiality, and how security leaders can talk about it as a present-day risk instead of science fiction.
From there, I get practical with post-quantum planning: what the NIST post-quantum cryptography standards signal, why quantum key distribution is still niche for most organisations, and the big architectural idea to remember for the CISSP and for real enterprise security programs: crypto agility. We walk through concrete steps like building a cryptographic inventory, mapping where RSA and elliptic curve crypto live, identifying data with 10 to 20 year secrecy needs, and pushing vendors for a clear PQC roadmap.
Then we pivot into CISSP Domain 1 supply chain risk management (SCRM and CSCRM). I explain why supply chains are a prime target, how modern supply chain attacks can ride in through poisoned open source packages, and what SolarWinds showed the world about scale and impact. We close with the nuts and bolts that actually reduce third-party risk: lifecycle supplier management, meaningful assessments (on-site when it matters), document and policy review, audits, and minimum security requirements baked into contracts and SLAs.
If you want more training, check out CISSP Cyber Training, subscribe for weekly updates, share this with a friend who owns risk, and leave a quick review so more CISSP candidates can find the show.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 356: Supply Chain Attacks Are Exploding in 2026 — Here's What the NCSC Wants You to Do
Send us Fan MailYour software is only as trustworthy as the dependencies you quietly inherit and attackers know it. Today I break down the NCSC warning on software supply chain security and why open source …
Notes de l’épisode
Your software is only as trustworthy as the dependencies you quietly inherit and attackers know it. Today I break down the NCSC warning on software supply chain security and why open source package ecosystems have become a high-value target for real-world compromises that spread fast through CI/CD pipelines.
I walk through the attack patterns that keep showing up in incidents: maintainer account compromise, expired domain takeover, typosquatting, and credential chaining. We connect each technique to the CISSP mindset so you can spot it in scenario questions and, more importantly, recognise it in your own environment. Along the way, I explain why Node.js, Python, and Rust projects are especially exposed, how automation can turn “latest version” convenience into an enterprise incident, and why developer environments often become an overlooked attack surface.
Then we get practical with controls you can actually implement: pausing automatic dependency updates when compromise is suspected, adding human approval for critical packages, rotating credentials immediately, enforcing MFA on developer and registry accounts, and using private or trusted registries to mirror and vet dependencies. I also zoom out to show how to build supply chain security into the secure SDLC with software composition analysis (SCA), code signing, checksum verification, audit logging, continuous monitoring, and an SBOM so you can respond fast when a package turns toxic.
If this helps you tighten your dependency management and level up your CISSP prep, subscribe, share this with a teammate, and leave a quick review so more security pros can find the show.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 355: Zapier Breach Lessons For Cloud Security and Setting Up TPRM Program in 15 Minutes
Send us Fan MailThe breach that takes down a company often does not kick in the front door. It walks in through a “simple” integration you set up months ago, powered by a token no one remembered to rotate. We …
Notes de l’épisode
The breach that takes down a company often does not kick in the front door. It walks in through a “simple” integration you set up months ago, powered by a token no one remembered to rotate. We start with a real-world Zapier-style scenario and unpack how researchers chained together a harmless-looking code block, an AWS Lambda environment, and a misconfigured IAM role to reach private repository files and ultimately an NPM token that could enable a supply chain attack.
From there, we zoom out to the bigger cloud security problem: non-human identities. Service accounts, API keys, and OAuth tokens multiply fast, and they are frequently overprivileged, poorly tracked, and left active long after an integration is retired. We also talk about why SaaS-to-SaaS connections are so hard to secure, and why agentic AI makes visibility even more urgent. If you do not know what systems are connected, what data crosses those links, and who owns the risk, you are effectively trusting an invisible tunnel into your environment.
To make this actionable, we lay out a four-phase third-party risk management (TPRM) framework you can apply immediately: build a vendor and integration inventory with tiering, run real due diligence (SOC 2 Type II, ISO 27001, data access scope, subprocessors and fourth parties), lock protections into contracts (DPA language, right to audit, breach notification expectations), then enforce ongoing monitoring and governance with quarterly token reviews, logging, and incident response playbooks. If you are studying for the CISSP, you will also see exactly how this maps to Domain 1, Domain 3, Domain 4, and Domain 5.
Subscribe for more practical CISSP training, share this with a teammate who owns vendor approvals, and leave a review so more security pros can find it. What is the one integration you would audit first?Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 354: Data Security Controls and Compliance Requirements for the CISSP (Domain 2.3) - REPLAY
Send us Fan MailYour firewall can be patched tomorrow, but what about the place your system hides its real secrets today? We start with a timely warning about a serious Fortinet FortiGate vulnerability and why …
Notes de l’épisode
Your firewall can be patched tomorrow, but what about the place your system hides its real secrets today? We start with a timely warning about a serious Fortinet FortiGate vulnerability and why perimeter devices are still a make-or-break control, then we pivot into the deeper layer most people ignore until it’s too late: memory.
We walk through CISSP Domain 3.4 by focusing on what memory protection is actually trying to achieve: confidentiality, integrity, and process isolation. From there, we unpack how modern operating systems enforce separation with paging, segmentation, and strict read, write, execute controls. You’ll hear why Meltdown and Spectre were such a big deal, how speculative execution can leak passwords and encryption keys from privileged memory, and why patching decisions are never just “apply everything” but a risk-based vulnerability management call that depends on visibility into what you run.
Next, we connect memory protection to virtualization security. We break down hypervisors, guest and host isolation, Type 1 versus Type 2 designs, and the threats that keep security teams up at night: VM escape, side-channel leakage through shared CPU resources, and the operational hazards of memory overcommitment. Then we bring in hardware roots of trust through TPMs: secure boot, measured boot, key storage for full disk encryption, TPM 2.0 types, and how HSM-style key management shows up in cloud environments. We close with practical best practices, from firmware and microcode updates to choosing encryption controls that fit your actual risk.
If you’re studying for the CISSP or building a real-world security strategy, subscribe, share this with a teammate, and leave a review so more security pros can find it.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 353: AI Agent Governance Essentials - CISSP Practice Questions
Send us Fan MailAI agents are landing in production faster than most security teams can track them, and the scariest part is how normal they can look. When an autonomous agent runs the same workflow 10,000 …
Notes de l’épisode
AI agents are landing in production faster than most security teams can track them, and the scariest part is how normal they can look. When an autonomous agent runs the same workflow 10,000 times, your SIEM and EDR may see “nothing to worry about” even while the agent quietly drifts outside its intended scope. That is the core AI governance problem we tackle, through the lens of CISSP thinking and real security leadership.
We walk through what is driving the mess: board-level pressure, AI FOMO, and the dangerous habit of treating AI agents like old-school automation. Then we get concrete. We talk about why many enterprises still lack an inventory of AI agents, why traditional security tooling is tuned for human behaviour anomalies, and what it actually takes to be audit-ready. We cover practical governance frameworks like tiered autonomy, why observability is more than collecting output logs, and how to design decision-path tracing with execution records and decision logs you can act on.
To make it actionable for exam prep and day-to-day work, I close with CISSP-style practice questions on the exact scenarios you will face: detection gaps, human approval bottlenecks, least privilege for agents, proving decisions during audits, and architecting platforms that balance operational efficiency with risk management. If you are serious about passing, I also share how my CISSP Sprint cohort is structured to force momentum, including booking your exam date early.
Subscribe for weekly CISSP-focused training, share this with a teammate building AI workflows, and leave a review so more security pros can find the show. What part of AI agent governance is your biggest blind spot right now?Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 352: Data Security Controls and Compliance Requirements for the CISSP (Domain 2.3) - REPLAY
Send us Fan MailYour security program can be airtight and still get wrecked by someone else’s breach. We open with a Wired-style reality check: third-party app ecosystems and data brokers collecting location …
Notes de l’épisode
Your security program can be airtight and still get wrecked by someone else’s breach. We open with a Wired-style reality check: third-party app ecosystems and data brokers collecting location analytics at massive scale, then getting hacked or resold in ways your users never expected. If your organisation issues mobile devices, this is where security awareness, MDM controls, and clear “don’t allow tracking unless required” guidance stops being a nice-to-have and starts becoming risk reduction.
From there, we dig into CISSP Domain 2.3: provisioning resources securely, with the mindset of a senior security professional. We walk through information ownership versus asset ownership, why “IT owns the data” is often the wrong answer, and how classification (public, internal, confidential and beyond) drives least privilege and need-to-know access. We also cover the practical friction points: owners who don’t realise they’re owners, systems spread across teams, and the need to document decisions so risk acceptance is explicit instead of accidental.
We then connect the dots across asset management, configuration management systems, and modern cloud operations. Expect talk on lifecycle tracking, secure disposal, rogue devices and shadow IT, plus the unique headaches of virtual sprawl, snapshots, tagging, data residency, and the cloud shared responsibility model. If you’re studying for the CISSP exam or trying to run a cleaner security programme at work, you’ll leave with a clearer map of what to inventory, who to hold accountable, and which controls keep resources from drifting into chaos.
Subscribe for weekly CISSP-focused training, share this with a teammate who manages cloud or endpoints, and leave a review with the hardest “ownership” problem you’ve seen in the wild.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT351: BitLocker Bypass Reality Check (YellowKey) and CISSP Practice Questions
Send us Fan MailBitLocker feels like a safety net until you see how a single bypass can change the whole risk picture. Today we react to the Yellow Key vulnerability (noted in the news and referenced as CVE …
Notes de l’épisode
BitLocker feels like a safety net until you see how a single bypass can change the whole risk picture. Today we react to the Yellow Key vulnerability (noted in the news and referenced as CVE 2645585) and use it as a practical CISSP training moment: a public proof of concept is available, a vendor patch is not, and the attack hinges on physical access. That mix forces you to think clearly about what “high risk” actually means, why “critical” is not always the right label, and how real security teams respond when the perfect fix does not exist yet.
We connect the story to CISSP domains you are actively tested on. Domain 3 shows up in the basics of data at rest encryption and the uncomfortable truth that encryption is only as strong as its implementation. Domain 7 shows up in zero-day vulnerability management, compensating controls, and the need to have patch deployment ready to move the moment Microsoft ships a fix. We also highlight why secure boot and firmware integrity checks matter, and why endpoint detection may not help when an attacker can silently read files with little to no logging signal.
Then we shift into five exam-style questions designed to sharpen your decision-making: how to classify risk using likelihood and impact, how to spot absolute-language distractors, which CIA triad principle is actually failing when data is accessed without detection, and why data minimisation can reduce breach impact more than “adding another tool.” If you’re studying for the CISSP exam and want practice that feels like real life, this is built for you.
Subscribe for weekly CISSP practice, share this with a study partner, and leave a review so more candidates can find the show. What control would you tighten first if a BitLocker bypass hit your fleet tomorrow?Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 350: Investigation Types Made Simple - CISSP Training (Replay)
Send us Fan MailDefault passwords are the kind of problem everyone “knows” about and yet they still open doors for attackers every day. We start with a quick reality check on router security and why factory …
Notes de l’épisode
Default passwords are the kind of problem everyone “knows” about and yet they still open doors for attackers every day. We start with a quick reality check on router security and why factory settings, legacy gear, and unmanaged IoT and OT devices can turn a simple misconfiguration into redirect attacks, man-in-the-middle exposure, DDoS headaches, or silent monitoring. If you’re studying for the CISSP or defending a real network, you’ll walk away with a clearer sense of what to fix first and how to roll changes out without creating change-management chaos.
Then we shift into CISSP Domain 1.6: understanding requirements for investigation types. We break down administrative, criminal, civil, and regulatory investigations and why the burden of proof changes everything. We talk through why HR and legal need to be involved early, when law enforcement is (and is not) helpful, and how sloppy evidence handling can get key artifacts thrown out. We also cover e-discovery and legal holds, using the Electronic Discovery Reference Model (EDRM) to make the process easier to remember and apply.
To close, we get practical about evidence: admissibility, chain of custody, and the forensics basics that protect data integrity, including media, memory, network, software, and embedded device analysis, plus the value of write blockers and disciplined documentation. If you want to pass the CISSP and operate like a calm, credible security professional during an incident, this is the mindset. Subscribe for weekly CISSP-focused training, share this with a teammate, and leave a review with the investigation topic you want us to tackle next.Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
CCT 349: FOXCONN Hack and Domain 7 CISSP Practice Questions
Send us Fan MailEight terabytes of stolen schematics is not just a scary number, it is a reminder that cyber risk becomes business risk fast. We start with the Wired report on the Foxconn ransomware attack and …
Notes de l’épisode
Eight terabytes of stolen schematics is not just a scary number, it is a reminder that cyber risk becomes business risk fast. We start with the Wired report on the Foxconn ransomware attack and unpack what a claim like that could mean in the real world: intellectual property exposure, supply chain disruption, customer impact, and the uncomfortable truth that recovery is only one part of the story when data walks out the door.
From there, we switch into CISSP Domain 7 Security Operations mode and work through practical exam-style questions with the “how would this hold up at work” mindset. We break down why live forensics imaging can be the right call during an insider threat investigation, using the order of volatility and the kinds of RAM artifacts that disappear the moment you shut a machine down. We also tackle a Patch Tuesday nightmare scenario where a CVSS 9.8 vulnerability is already being exploited but the change advisory board will not meet for ten days, and we explain why an emergency change process plus compensating controls is the mature security operations answer.
We also cover a common privileged access failure where a domain admin uses an elevated account for email and browsing, and how least privilege plus a privileged access workstation (PAW) architecture can prevent a single phish from becoming domain compromise. Finally, we sharpen the fundamentals with an RTO/RPO recovery timeline question and a SIEM brute force threshold miss that illustrates false negatives and the need for better tuning and behavioural baselines.
Subscribe for weekly CISSP training, share this with a study partner, and leave a review so more security pros can find the show. What topic do you want me to turn into practice questions next?Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!
Chapitres
Chargement des chapitres…
Voici les 40 derniers épisodes sur 382. Les épisodes plus anciens se trouvent dans le flux du podcast.
Podcasts similaires
Plus de podcasts : Éducation
C’est votre podcast ?
Confirmez-le avec une entrée dans votre flux : vous recevez ici un code, vous l’ajoutez comme podcast:txt dans le canal de votre flux, et nous le vérifions. Votre podcast apparaît ensuite comme « vérifié » sur SoundNode.