Podcasts about cissp

Security operations are the frontlines of cyber defense—and CISSP Domain 7 is where your expertise gets real. In this power-packed episode of our Deep-Dive series, we break down Domain 7: Security Operations using real-world SOC workflows and exam-style scenarios.From SIEM tuning and threat hunting to digital forensics and disaster recovery, learn how to master every objective through practical strategies and rapid-fire review questions.

If your security stops at the network's edge, it's already too late. In this CISSP Deep Dive, we take you inside Domain 4—Communication & Network Security—with a Zero-Trust mindset.Explore how traditional models fail and why "never trust, always verify" is essential for securing today's complex networks. From secure protocols to micro-segmentation and cloud-edge controls, this episode connects every CISSP Domain 4 concept to practical Zero-Trust implementation.

Send us a textThe cybersecurity landscape grows more complex each day, especially when it comes to protecting critical infrastructure. In this essential episode of the CISSP Cyber Training Podcast, Sean Gerber breaks down Domain 2 of the CISSP certification - a vital area representing approximately 10% of the exam questions that every security professional must master.Sean begins with a timely discussion of the recently discovered Honeywell Experion PKS vulnerability that could allow remote manipulation of industrial processes. This real-world example perfectly illustrates why understanding industrial control security is crucial across all sectors - from energy and water treatment to manufacturing and healthcare. The vulnerability serves as a sobering reminder that patching isn't always straightforward in environments that operate 24/7/365.Diving into Domain 2.1, Sean meticulously explains data classification fundamentals - how sensitivity levels are assigned based on business value, regulatory requirements, and potential compromise impact. He walks through the relationship between classification levels (public through highly confidential) and corresponding handling procedures. The podcast builds logically through ownership concepts, introducing essential roles like data owners, custodians, stewards, and asset owners.Perhaps most valuable is Sean's practical exploration of asset inventory management. Drawing from his extensive experience, he shares surprising stories of servers found in bathroom closets and emphasizes why knowing your asset locations isn't just good practice - it's essential for incident response and vulnerability management.The episode thoroughly covers the complete data lifecycle from collection through destruction. Sean explains data minimization principles, location considerations for sovereignty compliance, maintenance requirements, and proper destruction techniques. His discussion of data remnants highlights why simply deleting files is never sufficient for sensitive information.Sean wraps up with crucial insights on end-of-life system management and data protection technologies including encryption, DRM, DLP, and Cloud Access Security Brokers. His rapid review approach efficiently condenses critical knowledge while maintaining depth where it matters most.Whether you're preparing for the CISSP exam or seeking to strengthen your security program, this episode delivers actionable knowledge you can immediately apply. Visit CISSP Cyber Training for free study resources and take the next step in your cybersecurity journey today!Support the showGain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Send us a textCheck us out at:  https://www.cisspcybertraining.com/Get access to 360 FREE CISSP Questions:  https://www.cisspcybertraining.com/offers/dzHKVcDB/checkoutGet access to my FREE CISSP Self-Study Essentials Videos:  https://www.cisspcybertraining.com/offers/KzBKKouvSecuring SaaS environments and mastering security assessment techniques are critical skills for today's cybersecurity professionals. This episode delivers a powerful examination of Domain 6.3 of the CISSP certification, focusing on security testing methodologies that can make or break your organization's defensive posture.Sean Gerber begins with a startling statistic: 96.7% of organizations now use at least one SaaS application, yet many fail to properly secure these cloud-based services. When you migrate from on-premises solutions to SaaS offerings, your sensitive data moves from environments protected by your security infrastructure to those secured by third parties. This fundamental shift demands rigorous risk assessment processes. Sean provides practical guidance on evaluating SaaS providers, emphasizing critical areas like data encryption practices, multi-factor authentication implementation, account access controls, and comprehensive backup strategies.The heart of this episode explores essential testing methodologies every security professional should master. Black box testing techniques like penetration testing simulate real-world attacks without prior knowledge of system internals. Vulnerability assessments evaluate risk exposure by systematically identifying weaknesses. Dynamic analysis tests systems during operation, while code reviews catch vulnerabilities before deployment. Each approach serves a unique purpose in a comprehensive security program. Sean clarifies the crucial distinction between false positives (incorrectly identified vulnerabilities) and false negatives (missed vulnerabilities), explaining why the latter pose a significantly greater risk to organizations.Whether you're preparing for the CISSP exam or strengthening your organization's security posture, this episode provides the knowledge you need to implement effective security assessment strategies. Join our growing community of security professionals at CISSP Cyber Training, where you'll find additional resources to accelerate your cybersecurity journey while supporting a worthy cause – all proceeds go to a nonprofit supporting adoptive families. Take your security knowledge to the next level and make a difference!Support the showGain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Send us a textCheck us out at:  https://www.cisspcybertraining.com/Get access to 360 FREE CISSP Questions:  https://www.cisspcybertraining.com/offers/dzHKVcDB/checkoutGet access to my FREE CISSP Self-Study Essentials Videos:  https://www.cisspcybertraining.com/offers/KzBKKouvA shocking cybersecurity case recently hit the headlines—a 50-year-old IT contractor sentenced to over 8 years in prison for acting as a mule for North Korean hackers. What makes this story particularly alarming? Companies were unknowingly shipping laptops directly to her, providing legitimate access credentials that she then shared with foreign adversaries. This case serves as a powerful reminder of why third-party risk management isn't just a compliance exercise but a critical security function.Diving into CISSP Domain 6.3, we explore the fundamental security processes that could prevent such compromises. User account lifecycle management forms the backbone of organizational security, from proper identity verification during onboarding to the principle of least privilege and role-based access controls. We examine the critical differences between disabling and deleting accounts during deprovisioning, and why service accounts deserve special attention as high-value targets for attackers.Security assessments and audits provide the verification mechanisms needed to ensure your controls are both properly designed and effectively operating. Understanding the distinction between vulnerability assessments, penetration tests, and formal audits helps you build a comprehensive evaluation strategy. We clarify the differences between SOC Type 1 and Type 2 reports when evaluating service providers, and explain why metrics must be measurable, actionable, relevant, timely, and attributional (SMARTA) to drive meaningful security improvements.Perhaps most critically, we address backup verification strategies—because discovering your backups are corrupted during a recovery situation is a career-limiting event. Through practical guidance on security training approaches, enforcement mechanisms, and measurement techniques, this episode provides both CISSP candidates and practicing security professionals with actionable insights to strengthen their security programs. Ready to transform your security posture? Listen now, then visit CISSPCyberTraining.com for more resources to accelerate your cybersecurity journey.Support the showGain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

In this episode of The Other Side of the Firewall's Thursday episode, Ask a CISSP, Ryan Williams Sr. interviews Angela Diaz, an expert in risk management and fraud prevention. They discuss the importance of understanding the three lines of defense in risk management, the impact of fraud on individuals and organizations, and the career pathways available in the field. Angela shares her personal journey into risk management, the significance of soft skills, and her involvement in the Fraud Fight Club initiative. The conversation also touches on mindfulness practices and the importance of maintaining a balanced life outside of work. Contact Angela - https://www.linkedin.com/in/angela-diaz-crmp-37430064/ Fraud Fight Club - https://www.fraudfightclub.com/ Please buy my book: https://theothersideofthefirewall.com Socials: Website - www.ramcyber.io Heroes Media Group: https://www.heroesmediagroup.com/shows/the-other-side-of-the-firewall/ Audio - https://podcasts.apple.com/us/podcast/the-other-side-of-the-firewall/id1542479181 YouTube - https://www.youtube.com/@theothersideofthefirewall7511 ReppedFLIX - https://lnkd.in/eVis2CbS WDJY 99.1 FM: https://www.wdjyfm.com/ TuneIn: https://lnkd.in/e2crcZU8 Facebook - https://www.facebook.com/profile.php?id=61556539026086 Instagram - https://www.instagram.com/theothersideofthefw X (Twitter) - https://twitter.com/Ask_a_CISSP TikTok - https://www.tiktok.com/@ryanwilliams683 Medium - https://medium.com/@ryanwilliamssenior Subscribe to LinkedIn Newsletter - https://www.linkedin.com/build-relation/newsletter-follow?entityUrn=7172626552545865728 LinkedIn - https://www.linkedin.com/company/the-other-side-of-the-firewall/ Ryan on Twitter, LinkedIn, Clubhouse, and Threads - @ryrysecurityguy Chris on LinkedIn - https://www.linkedin.com/in/chrisabacon/ Chapters 00:00 Introduction to Risk Management and Fraud 03:58 Understanding the Three Lines of Defense 11:58 The Importance of Risk Management in Financial Institutions 19:45 Career Pathways in Risk Management 25:59 Soft Skills for Success in Risk Management 29:47 Engagement in the Fraud Fight Club Initiative 37:49 Personal Insights and Mindfulness Practices 41:43 Conclusion and Future Connections #cybersecurity #riskmanagement #fraud

Send us a textCheck us out at:  https://www.cisspcybertraining.com/Get access to 360 FREE CISSP Questions:  https://www.cisspcybertraining.com/offers/dzHKVcDB/checkoutGet access to my FREE CISSP Self-Study Essentials Videos:  https://www.cisspcybertraining.com/offers/KzBKKouvThe cybersecurity landscape is rapidly evolving, and AI stands at the forefront of this transformation. In this thought-provoking episode, Shon Gerber explores the projected $450 billion impact AI will have by 2028 and what this means for security professionals today.With only 2% of companies having fully deployed AI solutions and 39% not yet exploring them, we're at the beginning of a massive shift that will fundamentally change how organizations approach security. Shon provides a candid assessment of why cybersecurity roles haven't yet been automated (risk aversion) and why this protection is temporary—predicting significant changes within the next five years.For CISSP candidates, the episode delivers exceptional value through a detailed breakdown of five Domain 1 questions. Rather than simply providing correct answers, Shon dissects each question to reveal the underlying principles and reasoning. This approach helps listeners develop the critical thinking needed to succeed not just on the exam, but in real-world security scenarios.The questions cover essential security concepts including risk treatment strategies, due diligence versus due care, professional ethics, policy versus procedure distinctions, and governance structures. Each explanation includes common points of confusion and practical workplace applications, bridging the gap between exam preparation and professional practice.Perhaps most valuable is Shon advice on navigating ethical dilemmas in security consulting. His guidance on how to inform clients of regulatory violations while maintaining professional relationships demonstrates the nuanced people skills that separate truly effective security leaders from technical practitioners.Ready to future-proof your cybersecurity career while preparing for CISSP certification? This episode delivers actionable insights for both immediate exam success and long-term career viability in an AI-transformed landscape. Check out CISSPCyberTraining.com for additional resources, including 360 free practice questions to accelerate your certification journey.Support the showGain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Ready to pass the ISSAP like a pro? This episode is your go-to resource for mastering the Information Systems Security Architecture Professional (ISSAP) certification. We'll cover the most frequently asked exam questions, key concepts, and real-world strategies that align with enterprise security architecture roles.From designing secure systems to understanding governance frameworks, you'll learn how to showcase your knowledge and approach the exam with confidence. Whether you're transitioning from CISSP or aiming to level up as a cybersecurity architect, this prep session has you covered.

　少し前のことだが、ユーザー企業に勤務してセキュリティの仕事を担当する本誌読者の方と、直接お会いして話をする機会があった。まだお若いのに CISSP で、当時転職先を探していた。

Send us a textCheck us out at:  https://www.cisspcybertraining.com/Get access to 360 FREE CISSP Questions:  https://www.cisspcybertraining.com/offers/dzHKVcDB/checkoutGet access to my FREE CISSP Self-Study Essentials Videos:  https://www.cisspcybertraining.com/offers/KzBKKouvLooking to strengthen your organization's defenses against unauthorized access? This episode dives deep into CISSP Domain 5.1, exploring the critical components of physical and logical access controls that protect your most valuable assets.We begin with a startling discussion about China's "Maciantool" - sophisticated software secretly deployed at security checkpoints to extract SMS messages, GPS data, and images from travelers' phones. You'll learn practical strategies for protecting executive devices during international travel, including recommendations for burner phones and proper security protocols at checkpoints.The foundation of effective access control starts with proper identity proofing and registration processes. We examine how to match verification rigor with resource sensitivity and explore the four authentication factors: something you know (passwords), something you have (tokens), something you are (biometrics), and something you do (keystroke patterns). Understanding how multi-factor authentication leverages these factors is essential for building robust security layers.From preventative controls that stop unauthorized actions before they occur to detective measures that identify incidents after the fact, we break down each access control type with real-world examples. You'll discover how physical barriers like fences and man traps work alongside compensating controls when primary measures aren't feasible, plus strategies for implementing corrective actions after security breaches occur.The principle of least privilege emerges as a central theme throughout our discussion - granting users only the minimum access necessary prevents credential creep while maintaining operational efficiency. We also emphasize the critical importance of documentation, regular testing, and effective communication channels for all access control measures.Visit CISSP Cyber Training for free resources including practice questions, study plans, and additional podcasts. Ready to advance your cybersecurity career? Check out our mentoring programs designed to help you maximize both job fulfillment and income potential.Support the showGain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

In this powerful episode, we sit down with cybersecurity executive and thought leader Tammy Klotz to explore the profound impact of compassionate leadership in high-stakes environments. Tammy shares a deeply personal story of receiving crucial support from a leader during a professional and personal crisis—a moment that shaped her own leadership philosophy and redefined how she views strength in the workplace.We discuss what it means to show vulnerability in a world that often demands perfection, and why soft skills like emotional intelligence, grace, and empathy aren't optional—they're essential. Tammy opens up about how leaders can create psychological safety, establish rituals that foster connection and trust, and give explicit permission for authenticity, rest, boundaries, and even failure.This conversation is a masterclass in human-centered leadership and a reminder that some of the most powerful things leaders can offer don't come from a playbook—they come from the heart.Topics Covered:The moment a leader's support changed everythingCreating space for vulnerability in high-performing teamsWhy emotional intelligence and empathy are critical leadership skillsBuilding team rituals that support culture and connectionThe impact of leaders giving “permission” to be humanGuest Bio:Tammy Klotz is the Chief Information Security Officer at Trinseo, a Top 100 CISO, and the author of Leading with Empathy & Grace. With over 30 years in cybersecurity leadership, she is redefining what it means to lead with both strength and soul. She holds esteemed certifications including CISM, CISSP, and CRISC, and has earned notable accolades such as the 2022 Covanta Leadership Award and recognition as a Top 100 CISO by Cyber Defense Magazine in 2023. Tammy is also the author of "Leading with Empathy & Grace: Secrets to Developing High-Performing Teams", where she shares insights on leadership, resilience, and emotional intelligence.Resources: Leading with Empathy and Grace - Tammy KlotzLeading with Empathy and Grace: Secrets to Developing High- Performing TeamsRituals Roadmap - Erica KeswinRituals Roadmap: The Human Way to Transform Everyday Routines into Workplace MagicThe Anxious Generation - Jonathan Haidt The Anxious Generation: How the Great Rewiring of Childhood Is Causing an Epidemic of Mental Illness

In this conversation, Chris Glandon interviews Josh Mason, a Solutions Architect at CINAC and founder of Newb Village. They discuss Josh's journey from being a U.S. Air Force pilot to entering the cybersecurity field, his motivation behind creating Newb Village to support newcomers in the industry, and his new book 'Speak Security with a Business Accent'. They also explore the role of SYNAC in cybersecurity and share insights on creating a welcoming environment for new professionals in the field. The conversation wraps up with a light-hearted discussion about unique bars and venues in the cybersecurity community.00:00 Josh Mason's Journey into Cybersecurity08:38 The Birth of Noob Village20:02 Speak Security with a Business Accent26:59 Transforming Technical Language for Business Impact30:01 Understanding Metrics for Different Audiences33:15 Aligning Business Goals with Security Metrics36:49 Insights into SYNAC and Its Offerings47:22 Exploring Unique Bars and Venues48:37 Imagining a Cybersecurity-Themed BarSYMLINK[Noob Village] - An inclusive space at DEF CON is designed to welcome and guide newcomers in the cybersecurity community. It offers resources like pamphlets, volunteers (“buddies”), and a booth called “No Stupid Questions” to support first-time attendees.Noob Village LinkedIn Page –A LinkedIn organization page with updates about volunteer calls, community news, and DEF CON involvement .[Joshua C. Mason – LinkedIn] - A cybersecurity leader and vCISO profile with extensive experience, offering insights on Noob Village, initiatives for veterans, and IT-to-security career development. Frequently shares event involvement (like DEF CON), mentorship tips, and professional updates.[Joshua C. Mason – Website] – Josh's professional website for Mason Security Consulting (Mason SC), where he offers vCISO services, cybersecurity consultancy, and insights from his military and IT background.[Mason SC Book Page] - Josh Mason's personal site, where signed copies of his book are available. The book includes cybersecurity leadership insights drawn from his experiences in the Air Force and IT.[Onward to Opportunity – A career training program for veterans, offering free training and certification opportunities in areas like project management and IT, including PMP and CISSP prep.[Synack] - A cybersecurity company offering “pen test as a service.” It connects clients with vetted ethical hackers using a managed platform to identify exploitable vulnerabilities efficiently.

Send us a textSecurity vulnerabilities lurk in the most unexpected places – even in your home internet modem. Today we kick off with breaking news about a security flaw discovered in Cox modems that could potentially allow unauthorized access to run malicious commands on connected devices. While Cox reports fixing the issue within 24 hours, this real-world example perfectly illustrates a critical concept we explore further: how exposed APIs often become significant data exfiltration points because organizations fail to track and manage their connections properly.Diving into our CISSP Question Thursday, we tackle fifteen practice questions specifically targeting Domain 3.1.2 and 3.1.3 concepts. These questions explore fundamental security principles including encryption standards (why AES-256 trumps proprietary algorithms), access controls (how custom APIs demonstrate both abstraction and access restriction), and defense in depth strategies (protecting data across multiple states). Each question builds practical understanding of how these principles apply in real-world scenarios – from secure boot configurations that hide complexity from users to the dangers of storing all encryption keys on a single, inadequately protected server.The beauty of these practice questions lies in their practical applications. We examine how stenography conceals data within other files, how security defaults strengthen systems through pre-configuration, and how patching vulnerabilities relates to maintaining secure environments (while acknowledging that patches themselves can sometimes introduce new issues). Whether you're actively preparing for the CISSP exam or simply looking to strengthen your cybersecurity knowledge, these practice scenarios provide valuable training in identifying and addressing common security challenges. Visit cisspcybertraining.com to access this episode's questions and many more resources to support your cybersecurity journey.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Send us a textThe medieval castle with its moat, high walls, and sentries provides the perfect metaphor for modern cybersecurity. Just as each defensive element served a specific purpose in protecting the castle, today's information security requires multiple layers working in concert to safeguard digital assets.Shon Gerber opens this episode with a timely discussion of the UnitedHealthcare ransomware attack, which reportedly cost $22 million and sparked controversy around the CISO's qualifications. This real-world example perfectly frames the importance of defense in depth strategies that could have prevented such a catastrophic breach.The core of defense in depth involves implementing multiple security controls that protect various aspects of information systems. Shon walks through each layer, starting with perimeter security (firewalls, IDS/IPS systems), moving to access controls and data security (encryption, DLP), and continuing through system hardening and detection mechanisms. Each layer serves two crucial purposes: stopping attackers altogether or, at minimum, slowing them down enough that they move on to easier targets.Particularly enlightening is Shon's breakdown of abstraction in security - how operating systems, networking protocols, databases, and APIs hide complexity from users while maintaining protection. This concept extends to data hiding techniques like steganography, tokenization, and encryption that conceal sensitive information from prying eyes.The episode concludes with an examination of secure defaults - the principle that systems should ship with security enabled rather than requiring manual configuration. Shon provides practical guidance on implementing secure defaults and overcoming common challenges like vendor limitations and legacy systems.Whether you're studying for the CISSP exam or looking to strengthen your organization's security posture, this episode delivers actionable insights on building robust, multi-layered defense strategies that balance protection with usability. Visit CISSP Cyber Training for additional resources, including practice questions and comprehensive study materials.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Send us a textMicrosoft recently released 137 security patches, with 14 critical vulnerabilities that could allow attackers to seize control of Windows systems with minimal user interaction. Among these, the Windows authentication negotiation flaw rated at 9.8 severity poses a significant threat to all current Windows versions. For security professionals, this underscores the crucial importance of effective patch management strategies—balancing timely updates against thorough testing procedures.When approaching CISSP certification, understanding different investigation types provides essential context for security operations. Administrative investigations address potential policy violations and inappropriate resource usage, while criminal investigations gather evidence when laws are broken. Civil investigations resolve disputes between parties, regulatory investigations examine compliance with industry mandates, and standards investigations assess adherence to best practices like ISO 27001. Each investigation type requires distinct approaches and yields different outcomes, from disciplinary actions to legal proceedings.The security documentation hierarchy—policies stating high-level objectives, standards specifying mandatory requirements, procedures providing step-by-step instructions, and guidelines offering flexible recommendations—creates a comprehensive framework for organizational security. However, these documents must use clear, accessible language that employees can understand and apply, not just legal jargon that looks impressive but goes unread.Business continuity planning begins with a thorough Business Impact Analysis that identifies critical functions and establishes recovery objectives. This foundational work must involve stakeholders from across the organization to ensure operational reality aligns with security requirements. Similarly, personnel security extends beyond employee screening to include robust onboarding, transfer, and termination procedures—with equivalent controls for third-party relationships.Risk management concepts form the core of security operations, from identifying threats and vulnerabilities to selecting appropriate controls. Understanding the distinction between preventative, detective, corrective, deterrent, and compensating controls enables security professionals to build comprehensive protection strategies. Combined with threat modeling methodologies like STRIDE and PASTA, these concepts create the framework for proactive security postures.Ready to deepen your CISSP knowledge? Visit CISSP Cyber Training for both free resources and comprehensive paid training options that will help you pass your exam the first time while building practical security expertise.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

In this session, we explore Domain 6 of the CISSP certification — Security Assessment & Testing — one of the most critical areas for identifying vulnerabilities, validating controls, and ensuring compliance. You'll dive deep into testing methodologies such as penetration testing, vulnerability scanning, risk assessments, and continuous monitoring. We also cover static and dynamic analysis, log review processes, and how to implement SIEM, IDS/IPS, and automation frameworks to strengthen system defenses.Whether you're studying for CISSP or sharpening your security testing skills, this episode provides real-world insights, exam tips, and a solid foundation for mastering Domain 6 — all mapped to frameworks like NIST, ISO 27001, and PCI DSS.

Send us a textReady to conquer CISSP Domain 1? This rapid review episode delivers essential knowledge on security and risk management fundamentals that form the cornerstone of information security practice.We begin with a timely discussion on preventing ransomware through exfiltration controls, noting the alarming shift where 90% of ransomware attacks now involve data theft. The practical advice on implementing zero trust architecture acknowledges real-world challenges while providing actionable steps for gradual deployment.Diving into Domain 1, we explore the ISC² Code of Professional Ethics and its four critical canons: protecting society and infrastructure, acting honorably, providing competent services, and advancing the security profession. The CIA triad (Confidentiality, Integrity, Availability) is thoroughly unpacked alongside the critical concepts of Authenticity and Non-repudiation, with practical examples of how these manifest in organizational security.Security governance emerges as a crucial topic, emphasizing the necessity of aligning security efforts with business objectives rather than operating in isolation. Practical guidance on establishing effective governance committees, defining clear roles, and implementing proper segregation of duties provides real-world context beyond theoretical concepts.The complexity of compliance requirements is demystified as we navigate legal regulations, industry standards, contractual obligations, and escalating privacy requirements. Particular attention is given to data breach notification timelines, evidence collection procedures, and transborder data flow considerations – all essential knowledge for modern security professionals.Whether you're preparing for the CISSP exam or seeking to strengthen your security program, this rapid review provides the comprehensive foundation you need. Visit cisspcybertraining.com for additional resources including practice questions and study materials to support your certification journey.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Send us a textCheck us out at:  https://www.cisspcybertraining.com/Get access to 360 FREE CISSP Questions:  https://www.cisspcybertraining.com/offers/dzHKVcDB/checkoutReady to master data classification for your CISSP exam? This episode delivers exactly what you need through fifteen practical questions that mirror real exam scenarios, all focused on Domain 2.1.1.The cybersecurity world is constantly evolving, and our discussion of the newly formed ARPA-H demonstrates this perfectly. Modeled after DARPA but focused on healthcare innovation, this agency represents a $50 million opportunity for security professionals to tackle the persistent ransomware threats plaguing the healthcare industry.Diving into our practice questions, we explore how marketing materials receive "sensitive" classifications, while revolutionary battery technology blueprints warrant "class three severe impact" protection. We clarify why social security numbers in healthcare settings fall under Protected Health Information rather than just PII, and why government agencies use distinctive classification schemas including terms like "top secret" that aren't merely arbitrary labels.The episode tackles complex scenarios including cloud storage responsibilities (you retain ownership of customer data even when stored by third parties), the limitations of DLP solutions for printed documents, and proper breach response protocols. Each question provides context-rich explanations that go beyond simple answers to build your understanding of the underlying principles.Perhaps most valuable is our exploration of classification system design - revealing why simply labeling all non-public information as "sensitive" creates security vulnerabilities by failing to distinguish between different impact levels. This practical insight helps you not just memorize concepts but understand how to implement effective classification in real-world environments.Whether you're studying for your CISSP exam or wanting to strengthen your organization's security posture, these fifteen questions provide the perfect framework for mastering data classification principles. Visit cisspcybertraining.com to access our complete blueprint and mentoring services guaranteed to help you pass the CISSP exam on your first attempt.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Send us a textEffective data classification isn't just about regulatory compliance—it's the foundation of your entire security program. Whether you're preparing for the CISSP exam or leading security initiatives at your organization, understanding how to identify, categorize, and protect sensitive information is critical to your success.This episode dives deep into the world of sensitive data management, breaking down the fundamental frameworks and approaches you need to master. Data classification might seem deceptively simple on the surface, but implementing it effectively requires navigating complex regulatory environments, understanding technical controls, and driving cultural change within your organization.We begin by exploring what constitutes sensitive data across different industries—from financial institutions prioritizing monetary data to healthcare organizations safeguarding patient information. You'll learn about key regulatory frameworks like GDPR and HIPAA, their specific requirements, and the substantial penalties for non-compliance. The episode provides a practical breakdown of classification schemes in both government and private sectors, with actionable advice on simplifying these systems to improve employee compliance.Most importantly, we address the critical human element of data protection. Without clear ownership and responsibility, sensitive information falls victim to the "tragedy of the commons"—accessible to everyone but protected by no one. The episode outlines strategies for assigning data ownership and implementing controls throughout the entire information lifecycle, from creation through disposal.Along the way, we examine an emerging privacy concern with Microsoft's Copilot "recall" feature that captures screenshots of everything you do on your computer. This real-world example perfectly illustrates the constant tension between innovation and privacy that security professionals must navigate daily.Whether you're just starting your security journey or looking to refine your approach as a seasoned professional, this episode provides the practical knowledge you need to build robust data protection strategies that balance security requirements with business needs. Subscribe now to continue building your cybersecurity expertise and prepare for the challenges of tomorrow's threat landscape.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Podcast: PrOTect It All (LS 26 · TOP 10% what is this?)Episode: Driving OT Security Innovation: AI, Risk Reduction, and the Future of Critical InfrastructurePub date: 2025-06-23Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationWelcome back to Protect It All! In this episode, host Aaron Crow sits down with longtime friend and OT cybersecurity veteran Brian Proctor for a deep dive into the current state—and future—of the OT cyber landscape. Together, they trade stories from the front lines, reflecting on how their early experiences as asset owners shaped their passion for innovation and helping critical infrastructure run safely and securely. Brian, whose career spans roles from OT engineer to startup co-founder, opens up about his journey—highlighting his drive to push the boundaries of traditional OT security and the evolution of key industry technologies. The conversation explores everything from the persistent lack of innovation in OT, to AI's growing role in tackling the daunting challenges of risk reduction, visibility, and scaling assessments across sprawling environments. If you've ever wondered how new tech like AI is reshaping industrial cybersecurity, why “we've always done it this way” just doesn't cut it anymore, or how organizations can realistically stay ahead without breaking the bank, this episode delivers honest insights, practical advice, and a look toward an exciting, if sometimes daunting, future. So grab your headphones and settle in as Aaron and Brian share stories, hot takes, and strategies designed to protect it all—because in critical infrastructure, the stakes have never been higher. Key Moments:  06:45 OT Cyber Industry Evolution 11:57 Evolving Challenges in OT Security 19:34 Bridging the OT Security Skills Gap 21:54 Enhancing OT Security Understanding 30:46 AI Model Security Challenges 34:26 Rapid Scaling for Site Assessments 40:56 Simulating Cyber Threat Responses 47:19 Operational Priorities: Equipment vs. Cyber Tools 49:30 Focus on Meaningful Security Metrics 56:30 Rapid AI Adoption vs. Internet 01:02:12 Cybersecurity: Small Targets are Vulnerable About the guest :  Brian Proctor is a cybersecurity leader with over 20 years of experience protecting critical infrastructure across energy, industrial automation, and operational technology sectors. As the co-founder and CEO of Frenos, he empowers critical infrastructure operators to proactively secure their environments against evolving cyber threats. Brian built his foundation in ICS/OT cybersecurity during his 13+ year tenure at two progressive California Investor Owned Utilities, San Diego Gas & Electric and Southern California Edison serving the 2nd and 8th largest cities in the United States. He managed a team of 15 security engineers and researchers across 150+ projects, established OT security roadmaps, and co-invented an R&D Magazine Top 100 award-winning GPS anti-spoofing mitigation technology that earned him a patent. Brian has published IEEE papers on security monitoring, served as Critical Infrastructure Co-Chair for Securing Our eCity, and regularly speaks at conferences to educate and build the ICS/OT cybersecurity community. He holds technical certifications including GICSP, CISSP, and CRISC, along with a Business Administration degree from the University of San Diego. Links:  https://frenos.io/services - Learn more about Optica, the industry's first tech-enabled rapid OT visibility service  https://frenos.io/autonomous-ot-security-assessment-platform - Learn more about how to automate OT security risk assessments Connect Brian : https://www.linkedin.com/in/brianproctor67/ Connect With Aaron Crow: Website: www.corvosec.com  LinkedIn: https://www.linkedin.com/in/aaronccrow   Learn more about PrOTect IT All: Email: info@protectitall.co  Website: https://protectitall.co/  X: https://twitter.com/protectitall  YouTube: https://www.youtube.com/@PrOTectITAll  FaceBook:  https://facebook.com/protectitallpodcast    To be a guest or suggest a guest/episode, please email us at info@protectitall.co   Please leave us a review on Apple/Spotify Podcasts: Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124 Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Send us a textCheck us out at: https://www.cisspcybertraining.com/Ethical dilemmas lurk around every corner in cybersecurity, ready to challenge even the most technically competent professionals. Sean Gerber tackles these moral minefields head-on in this thought-provoking episode focused on CISSP Domain 1.1, presenting fifteen real-world ethical scenarios that will test your professional judgment.The episode opens with crucial context about the New York Department of Financial Services (NYDFS) and its significant influence on cybersecurity standards in the financial sector. Sean explains how their recent bulletin addressing Iranian threats emphasizes essential security controls including multi-factor authentication and third-party risk management - requirements that extend well beyond the financial industry.Diving into the ethical scenarios, listeners will confront challenging questions: What would you do upon discovering a concealed data breach orchestrated by previous leadership? How should you handle a zero-day vulnerability when the vendor is notorious for slow responses? Is it ever appropriate to modify security logging standards when employees resist what they perceive as surveillance?Through each scenario, Sean walks through multiple possible responses, highlighting the correct ethical choice while acknowledging the complex organizational dynamics at play. The discussions reveal that ethical practice isn't just about knowing the right answer—it's about effectively implementing ethical decisions through proper channels, documentation, and constructive solutions.The episode offers invaluable guidance for anyone preparing for the CISSP exam or working in cybersecurity, demonstrating that while technical competence opens doors in this field, ethical judgment keeps those doors from slamming shut. As cyber threats evolve in complexity, the moral compass of security professionals becomes an increasingly critical asset in protecting organizations and their stakeholders.Ready to test your ethical judgment against CISSP standards? Visit CISSPcybertraining.com for 360 free practice questions and additional resources to strengthen both your technical knowledge and ethical reasoning.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Send us a textEthical leadership lies at the heart of effective cybersecurity practice. In this episode, we dive deep into Domain 1.1 of the CISSP certification, exploring professional ethics and their critical importance for security professionals.The episode opens with a sobering look at the current landscape of cyber warfare, examining how Israeli-linked hackers are actively targeting Iran's financial systems. This real-world example serves as a stark reminder that cyber conflicts aren't theoretical—they're happening now, with devastating consequences for both government systems and ordinary citizens. For security professionals, this underscores the urgent need for robust resilience planning and strategic preparation for highly targeted attacks.We then unpack the ISC² Code of Ethics through its four foundational canons: protecting society and the common good, acting with integrity, providing competent service, and advancing the profession. Each canon is explored with practical examples and real-world implications. The message becomes clear—security professionals possess extraordinary power through their knowledge and system access, and with this comes profound responsibility.Throughout the discussion, we emphasize that ethical considerations extend beyond compliance requirements. They touch everything from handling sensitive data and discovering vulnerabilities to implementing AI systems and creating organizational cultures where ethical concerns can be safely raised. The principle of "do no harm" stands paramount, recognizing that security decisions impact not just organizations but the individuals who rely on these systems for their livelihoods.Whether you're preparing for your CISSP certification, already working in the field, or leading security teams, this episode provides crucial insights into the ethical framework that must guide cybersecurity practice. Because in information security, ethics isn't just about following rules—it's about protecting people and building trust in the digital systems that increasingly power our world.Ready to strengthen your ethical leadership in cybersecurity? Visit our website for resources including practice questions, mentorship opportunities, and comprehensive CISSP exam preparation materials.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

In the AI era, trust is everything and it's under attack. How do you build digital trust when AI is changing the rules and attackers are getting smarter? Discover how today's CISOs are stepping up, adapting to AI risks, and learning from history to protect our digital future. In this episode of the Fit4Privacy Podcast, host Punit Bhatia is joined by Nick Shevelyov, a cybersecurity expert with extensive experience as a CISO and Chief Privacy Officer, and author of Cyber War and Peace. The discussion focuses on the evolving challenges for Chief Information Security Officers (CISOs) in the age of AI, highlighting risks such as deep fakes and hyper-targeted attacks. Nick emphasizes the importance of translating technical risks into business risks for board members and discusses the implications of new AI legislation, particularly California's SB 468.  Tune in to gain insights into managing digital trust, safeguarding personal data, and the strategic initiatives needed to combat emerging cybersecurity threats.  KEY CONVERSION POINT 00:01:50 How would you define the concept of trust 00:05:26 How do you place trust? How are they shifting? What kind of swans? 00:09:06 How are CISO coping with the change of AI era? 00:20:01 Insights in CISO Perspective for US/California direction in law of terms 00:23:06 About “Cyber War…and Peace: Building Digital Trust Today, with History as our Guide” book 00:27:50 How to get in touch with Nick   ABOUT GUEST Nick Shevelyov helps build next-gen tech companies from the ideation stage. His work includes StackRox (Kubernetes security, acquired by Red Hat for $400M), Kodem (software composition analysis, Greylock Series A), Bedrock Security (data-loss prevention, Greylock Series A), and Laminar (shadow data discovery, Insight Ventures Series A).He advises founders and CEOs on product and go-to-market strategy, boosting time-to-value for companies like Pixee.ai, Quokka.io, Boostsecurity.io, and ETZ. He works across all stages, from seed to IPO.Nick consults with Insight Partners (also an LP) and FTV Capital, and serves on advisory boards for ForgePoint Capital, Mayfield Fund, Evolution Equity Partners, NightDragon, YL Ventures, and Glynn Capital.He is on the boards of Cofense | Phishme and the Bay Area CSO Council (BACC), an invite-only group of CISOs from leading Bay Area companies. A former CIO, he is also an honorary member of the Blumberg Technology Council.Nick authored Cyber War…and Peace and brings historical and behavioral insights to tech and risk management. He holds an Executive MBA from USF and certifications from Stanford, Harvard, plus CISSP, CISM, and CIPPE.ABOUT HOST Punit Bhatia is one of the leading privacy experts who works independently and has worked with professionals in over 30 countries. Punit works with business and privacy leaders to create an organization culture with high privacy awareness and compliance as a business priority. Selectively, Punit is open to mentor and coach professionals.Punit is the author of books “Be Ready for GDPR” which was rated as the best GDPR Book, “AI & Privacy – How to Find Balance”, “Intro To GDPR”, and “Be an Effective DPO”. Punit is a global speaker who has spoken at over 30 global events. Punit is the creator and host of the FIT4PRIVACY Podcast. This podcast has been featured amongst top GDPR and privacy podcasts.As a person, Punit is an avid thinker and believes in thinking, believing, and acting in line with one's value to have joy in life. He has developed the philosophy named ‘ABC for joy of life' which passionately shares. Punit is based out of Belgium, the heart of Europe.  RESOURCES Websites: www.fit4privacy.com,www.punitbhatia.com,https://www.linkedin.com/in/nicholasshevelyov/, https://vcso.ai/   Podcast https://www.fit4privacy.com/podcast Blog https://www.fit4privacy.com/blog YouTube http://youtube.com/fit4privacy   

Send us a textThe pursuit of AI expertise has reached staggering heights in the cybersecurity world. Meta reportedly offering "billion-dollar salaries" and $100 million sign-on bonuses to lure OpenAI talent reveals just how valuable the intersection of AI and security has become. This episode explores why security professionals should seriously consider developing AI skills while highlighting that most organizations are still figuring out their AI security strategy – creating massive opportunity for those who can help bridge the knowledge gap.Transitioning to our main feature, we dive deep into Domain 8.5 of the CISSP with 15 critical questions covering secure coding practices. From preventing XML External Entity attacks to understanding race conditions in concurrent applications, each question unpacks vital security concepts through practical scenarios. Learn why disabling DTDs in XML parsers, implementing proper input validation for APIs, and using prepared statements with parameterized queries are fundamental to building secure applications.The episode explores modern security challenges including infrastructure as code, OAuth 2.0 implementation, and the importance of implementing proper code review processes. Whether you're preparing for the CISSP exam or expanding your practical security knowledge, these questions provide valuable insight into how security vulnerabilities manifest and how to properly mitigate them. Each explanation goes beyond simple answers to help you understand the underlying principles that make certain practices more effective than others.Ready to accelerate your CISSP journey? Visit CISSP Cyber Training for access to hundreds of practice questions, video content, and resources designed to help you pass the exam on your first attempt. Leave a review and let us know what topics you'd like covered next!Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Podcast: PrOTect It All (LS 26 · TOP 10% what is this?)Episode: Inside OT Penetration Testing: Red Teaming, Risks, and Real-World Lessons for Critical Infrastructure with Justin SearlePub date: 2025-06-16Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationIn this episode, host Aaron Crow sits down with OT security expert Justin Searle, Director of ICS Security at InGuardians, for a deep dive into the ever-evolving world of OT and IT cybersecurity.  With over 25 years of experience, ranging from hands-on engineering and water treatment facilities to red-team penetration testing on critical infrastructures such as airports and power plants, Justin brings a wealth of insight and real-world anecdotes. This episode unpacks what it really takes to assess and secure operational technology environments. Whether you're a C-suite executive, a seasoned cyber pro, or brand new to OT security, you'll hear why network expertise, cross-team trust, and careful, collaborative engagement with engineers are so crucial when testing high-stakes environments. Aaron and Justin also discuss how the industry has matured, the importance of dedicated OT cybersecurity teams, and why practical, people-first approaches make all the difference, especially when lives, reliability, and national infrastructure are on the line. Get ready for actionable advice, hard-earned lessons from the field, and a candid look at both the progress and the ongoing challenges in protecting our most critical systems.   Key Moments:  05:55 Breaking Into Cybersecurity Without Classes 09:26 Production Environment Security Testing 13:28 Credential Evaluation and Light Probing 14:33 Firewall Misconfiguration Comedy 19:14 Dedicated OT Cybersecurity Professionals 20:50 "Prioritize Reliability Over Latest Features" 24:18 "IT-OT Convergence Challenges" 29:04 Patching Program and OT Security 32:08 Complexity of OT Environments 35:45 Dress-Code Trust in Industry 38:23 Legacy System Security Challenges 42:15 OT Cybersecurity for IT Professionals 43:40 "Building Rapport with Food" 47:59 Future OT Cyber Risks and Readiness 51:30 Skill Building for Tech Professionals   About the Guest :  Justin Searle is the Director of ICS Security at InGuardians, specializing in ICS security architecture design and penetration testing.  He led the Smart Grid Security Architecture group in the creation of NIST Interagency Report 7628 and played critical roles in the Advanced Security Acceleration Project for the Smart Grid (ASAP-SG), National Electric Sector Cybersecurity Organization Resources (NESCOR), and Smart Grid Interoperability Panel (SGIP).     Justin has taught hacking techniques, forensics, networking, and intrusion detection courses for multiple universities, corporations, and security conferences.  His current courses at SANS and Black Hat are among the world's most attended ICS cybersecurity courses.  Justin is currently a Senior Instructor for the SANS Institute and a faculty member at IANS. In addition to electric power industry conferences, he frequently presents at top international security conferences such as Black Hat, DEFCON, OWASP, HITBSecConf, Brucon, Shmoocon, Toorcon, Nullcon, Hardware.io, and AusCERT.     Justin leads prominent open-source projects, including The Control Thing Platform, Samurai Web Testing Framework (SamuraiWTF), and Samurai Security Testing Framework for Utilities (SamuraiSTFU).  He has an MBA in International Technology and is a CISSP and SANS GIAC certified Incident Handler (GCIH), Intrusion Analyst (GCIA), Web Application Penetration Tester (GWAPT), and GIAC Industrial Control Security Professional (GICSP)   How to connect Justin:  https://www.controlthings.io https://www.linkedin.com/in/meeas/ Email: justin@controlthings.io Connect With Aaron Crow: Website: www.corvosec.com  LinkedIn: https://www.linkedin.com/in/aaronccrow   Learn more about PrOTect IT All: Email: info@protectitall.co  Website: https://protectitall.co/  X: https://twitter.com/protectitall  YouTube: https://www.youtube.com/@PrOTectITAll  FaceBook:  https://facebook.com/protectitallpodcast    To be a guest or suggest a guest/episode, please email us at info@protectitall.co   Please leave us a review on Apple/Spotify Podcasts: Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124 Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Join The Full Nerd gang as they talk about the latest PC hardware topics. In this episode the gang talks with security expert Mike Danseglio, CISSP & CEH, about the Windows 10 end of life situation, whether now is the time to switch to Linux, the rise of new kinds of scams and more. And of course we answer your questions live! Windows 10 security updates: https://learn.microsoft.com/en-us/windows/whats-new/extended-security-updates Sign up for The Full Nerd newsletter: https://www.pcworld.com/newsletters/signup The opening music is Rollout (MaxPC Theme) by Jeremy Williams used under a Creative Commons 3.0 attrib license. You can grab the source files at Podcast Fantastic: http://podcastfantastic.com/ Join the PC related discussions and ask us questions on Discord: https://discord.gg/SGPRSy7 Follow the crew on X: @AdamPMurray @BradChacos @MorphingBall @WillSmith ============= Follow PCWorld! Website: http://www.pcworld.com X: https://www.x.com/pcworld =============

Send us a textCybersecurity vulnerabilities continue to emerge in unexpected places, as evidenced by the recent Iranian-backed attacks on U.S. water treatment facilities through poorly secured Unitronics PLCs. This alarming development sets the stage for our deep dive into API security - a critical yet often overlooked aspect of modern cybersecurity strategy.APIs form the connective tissue of our digital world, enabling seamless communication between different software systems. However, this interconnectivity creates numerous potential entry points for attackers. From RESTful APIs with their statelessness to enterprise-focused SOAP protocols and the newer GraphQL systems, each implementation brings unique security challenges that must be addressed proactively.We explore the most common API security threats facing organizations today: injection attacks that exploit poorly coded interfaces, broken authentication mechanisms that enable unauthorized access, sensitive data exposure through improper configurations, and man-in-the-middle attacks that intercept communications. Understanding these threats is just the beginning - implementing robust countermeasures is where real security happens.Authentication and access controls form the foundation of API security. OAuth, OpenID Connect, and token-based authentication systems provide powerful protection when implemented correctly. However, token management practices - including secure storage, proper revocation procedures, and regular refreshing - are equally critical yet frequently overlooked components of a comprehensive security strategy.API gateways emerge as perhaps the most valuable security control in your arsenal. Acting as centralized checkpoints, they provide enhanced visibility, consistent authentication enforcement, traffic throttling capabilities, and simplified management across numerous API connections. Cloud-based API gateways from major providers offer scalability and robust features that on-premises solutions struggle to match.Beyond the technical controls, we discuss the human element of API security. The most secure implementations balance protection with functionality while fostering collaboration between security professionals and developers. As I emphasize throughout the episode, effective security isn't about forcing compliance - it's about building bridges of understanding between teams with different expertise.Ready to strengthen your API security posture or prepare for your CISSP exam? Visit cisspcybertraining.com for free questions, comprehensive courseware, and a proven blueprint for certification success.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Send us a textSecurity professionals face a constant battle to keep up with evolving threats, and our latest CISSP Question Thursday podcast delivers critical insights into one of the most fundamental cybersecurity capabilities: effective logging and monitoring.The episode begins with a warning about a sophisticated attack campaign targeting recruiters. The hacker group FIN6 (Skeleton Spiders) has been creating fake candidate profiles with malware-laced resume attachments, tricking HR professionals into downloading zip files containing the "More Eggs" JavaScript backdoor. This social engineering tactic exploits normal recruiting workflows to steal credentials and gain network access. We discuss why security teams must partner with recruitment departments to develop specialized awareness training and technical controls to address this growing threat.Diving into CISSP Domain 7.2, we explore fifteen practical questions about logging and monitoring implementations. We cover critical distinctions between detection and prevention technologies, explaining why deep packet inspection is essential for identifying encrypted command and control communications over HTTPS. We examine why log integrity and non-repudiation are paramount when logs may serve as legal evidence, and why HR data provides crucial context for User and Entity Behavior Analytics (UEBA) systems trying to identify insider threats.For those implementing Network Intrusion Prevention Systems, we emphasize the importance of deployment in detection-only mode for extended tuning periods before enabling blocking capabilities. We examine why mean time to respond (MTTR) to critical incidents provides the most holistic metric for evaluating security operations effectiveness, and why automated ingestion of threat intelligence feeds delivers the most value for continuous monitoring objectives.This episode balances technical depth with practical implementation guidance, making it valuable for both CISSP candidates preparing for the exam and practicing security professionals looking to strengthen their monitoring capabilities. Visit CISSP Cyber Training for access to all our training materials and sign up for 360 free practice questions to accelerate your certification journey.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Send us a textDive deep into the critical world of security logging and monitoring as we explore Domain 7.2 of the CISSP certification. This episode unpacks the strategic considerations behind effective logging practices that balance comprehensive visibility with practical resource management.We begin with a thought-provoking look at Anthropic's new AI chatbot designed specifically for classified government environments. Could this be the beginning of something like Skynet? While AI offers tremendous capabilities for processing classified data, these developments raise important questions about reliability, oversight, and unintended consequences.The heart of this episode focuses on building a robust logging and monitoring strategy. We examine the various types of logs you should consider—security logs, system logs, application logs, network logs, and database logs—while emphasizing the importance of starting small and focusing on critical systems. You'll learn why centralized logging through SIEM platforms has become the industry standard, and how to approach log retention policies that balance regulatory requirements with storage costs.Active monitoring, passive monitoring, and the correlation of events each serve distinct security purposes. We explore how techniques like log sampling and clipping levels can help manage the overwhelming volume of data modern networks generate, while highlighting the risks of missing critical security events if these techniques aren't properly implemented.Special attention is given to egress monitoring—watching what leaves your network—as a crucial but often overlooked security practice. Since attackers ultimately need to extract data from compromised systems, monitoring outbound traffic can catch breaches even when the initial compromise was missed.The episode rounds out with discussions on emerging technologies transforming the security monitoring landscape: SOAR tools that automate security operations, the integration of AI and machine learning for threat detection, and the strategic use of threat intelligence to understand attacker methodologies through frameworks like the cyber kill chain.Whether you're preparing for the CISSP exam or working to strengthen your organization's security monitoring capabilities, this episode provides both the conceptual understanding and practical considerations you need. Connect with us at CISSP Cyber Training for more resources to support your certification journey.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

We're back! It's time for a "Meet The Mentor" session with our newest CISSP Program Instructor, John Kennedy. From joining the Air Force to being an ISSM and a cybersecurity mentor, John transports us from his challenges in tech to now leading live sessions, the pressure of building slide decks, and why giving back is essential to him and the security field. Listen to hear John's success story and get a glimpse into to this year's CISSP Cohort! For more information on FRSecure's CISSP Program, visit our webpage:https://frsecure.com/cissp-mentor-program/And register for this year's cohort through our event page! CISSP Program 2025 Registration--Continue to stay connected with our happenings through our social platforms! LinkedIn InstagramFacebookBlueSkyAbout FRSecure: https://frsecure.com/ FRSecure is a mission-driven information security consultancy headquartered in Minneapolis, MN. Our team of experts is constantly developing solutions and training to assist clients in improving the measurable fundamentals of their information security programs. These fundamentals are lacking in our industry, and while progress is being made, we can't do it alone. Whether you're wondering where to start, or looking for a team of experts to collaborate with you, we are ready to serve.

The powerful and emerging world of quantum computing is on its way. Quantum computing is a technology that is set to redefine privacy, trust, and artificial intelligence. What does quantum computing really mean, how will it change the digital trust landscape, what will happen when organizations gain quantum capabilities, and how existing standards and laws can help us govern. Quantum computing is still in its early stages, but it promises to open new possibilities, bring new challenges, and create risks we need to understand today.  To help us navigate this complex but exciting topic, host Punit Bhatia speaks with cybersecurity expert Ramsés Gallego about the exciting and challenging world of quantum computing. With over 25 years of experience in cybersecurity and technology governance, Ramsés brings not just knowledge, but incredible energy to the discussion — "quantum energy," as we like to say. Will it change the way we define and manage digital trust?   KEY CONVERSION POINT 00:02:20 How would you define digital trust 00:05:03 Demystify what is Quantum 00:10:52 How Quantum change the AI game? 00:15:44 What will happen if you acquire Quantum Computing 00:19:17 How are we seeing digital trust dimension with Quantum Computing? 00:28:10 How would an organization or a corporate govern this? 00:33:20 Get in touch with Ramses  ABOUT GUEST With an MBA and Law education, Ramsés Gallego is a +25 year security professional with deep expertise in the Risk Management and Governance areas. Ramsés is now  Chief Technologist Cybersecurity with DXC, where he defines the vision and mission, purpose and promise of the division. He has recently been Strategist & Evangelist for the office of the CTO with Symantec and holds the following professional accreditations: CISM, CGEIT, CISSP, SCPM, CCSK, ITIL and COBIT Foundations. An internationally recognized public speaker, has visited +25 different countries in the past 12 months and has been awarded 'Best Speaker' in four continents. He is also a Six Sigma Black Belt professional and is proud of being Past International VP for ISACA's Board of Directors, actual President of the Barcelona Chapter, Ambassador of the association and honored to be inducted into the ISACA Hall of Fame. Ramsés is also Executive Vice President of the Quantum World Association and has had the US flag flown on his honor at The Capitol, in Washington DC, USA. With already 22 Marathons -and other crazy adventures- on his legs he lives in Barcelona, Spain, with his wonderful wife and his two loved kids.  ABOUT HOST Punit Bhatia is one of the leading privacy experts who works independently and has worked with professionals in over 30 countries. Punit works with business and privacy leaders to create an organization culture with high privacy awareness and compliance as a business priority. Selectively, Punit is open to mentor and coach professionals.  Punit is the author of books “Be Ready for GDPR'' which was rated as the best GDPR Book, “AI & Privacy – How to Find Balance”, “Intro To GDPR”, and “Be an Effective DPO”. Punit is a global speaker who has spoken at over 30 global events. Punit is the creator and host of the FIT4PRIVACY Podcast. This podcast has been featured amongst top GDPR and privacy podcasts.  As a person, Punit is an avid thinker and believes in thinking, believing, and acting in line with one's value to have joy in life. He has developed the philosophy named ‘ABC for joy of life' which passionately shares. Punit is based out of Belgium, the heart of Europe.  RESOURCES Websites www.fit4privacy.com, www.punitbhatia.com, https://www.linkedin.com/in/ramsesgallego/ Podcast https://www.fit4privacy.com/podcast Blog https://www.fit4privacy.com/blog YouTube http://youtube.com/fit4privacy  

Send us a textThe boundaries between digital vulnerabilities and physical warfare are dissolving before our eyes. Ukrainian forces have dramatically shifted military paradigms by marrying cybersecurity breaches with commercial drone attacks against strategic Russian targets like Tupolev aircraft manufacturers. This evolution demands security professionals develop capabilities far beyond traditional network defense – a stark reminder that our field continues expanding into unexpected territories.Security testing forms the foundation of effective defense, and distinguishing between key methodologies is crucial both for the CISSP exam and real-world implementation. Vulnerability assessments detect weaknesses, while penetration tests exploit them to demonstrate actual impact. When evaluating your security testing approach, consider the perspective advantage: internal testing reveals different vulnerabilities than external probing, each simulating distinct attacker vantage points. False negatives represent perhaps the greatest danger in security testing – providing a dangerous illusion of safety while leaving actual vulnerabilities unaddressed.Testing approaches vary in depth and disclosure level. Black box testing simulates external attacks with no prior system knowledge. White box testing grants complete access to internal architecture. Gray box testing offers a middle ground with partial system information – a cost-effective approach for organizations with tighter budgets. Red teams validate incident response plans through realistic attack simulations, while authenticated scans reveal vulnerabilities that exist beyond login barriers. By mastering these concepts for Domain 6.2, you'll build essential knowledge that translates directly to creating more secure environments and passing your CISSP exam the first time. Join us at CISSP Cyber Training for free practice questions and comprehensive preparation resources to accelerate your cybersecurity career.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Podcast: PrOTect It All (LS 26 · TOP 10% what is this?)Episode: Building Trust and Bridging the Gap in OT and IT CybersecurityPub date: 2025-06-02Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationIn this episode, host Aaron Crow sits down with Dean Parsons, one of the most recognized names in the OT and industrial control systems (ICS) security world, for a candid and insightful conversation.   Join Aaron and Dean as they explore what it truly takes to bridge the worlds of IT and OT. Drawing from decades of industry experience, their discussion covers everything from building trust across teams, to the superpower of understanding both operational technology and cybersecurity. Expect real-world stories, practical advice on breaking into OT cybersecurity, and memorable lessons from the plant floor to the boardroom.   They also break down what makes OT security fundamentally different from traditional IT approaches, why risk-based strategies are essential, and how building relationships, sometimes over donuts and coffee—can be just as important as deploying firewalls and patching systems. Whether you're new to ICS and OT security, or a seasoned defender looking for fresh perspective, this episode brings actionable tips, honest assessments, and inspiration to help you better protect what matters most.   So grab your hard hat (and maybe a box of donuts!), and get ready for a masterclass on collaboration, building skills, and why trust is the real currency in the fight to secure our critical infrastructure.   Key Moments:    05:32 Listening Over Speaking in Legacy Spaces 07:01 IT Security Teamwork and Trust 11:21 Cost-Efficient ICS Security Solutions 15:42 Converging Skill Sets in IT Security 17:36 OT vs IT: Different Risks 22:28 Prioritizing Post-Assessment Actions 23:20 Prioritize SANS ICS Critical Controls 29:31 Engineering Perspective on Critical Assets 30:47 Detecting Misuse of Control Systems 35:52 Collaborative Incident Response Dynamics 39:03 Remote Hydroelectric Plant Journey 40:45 Building Trust with Baked Goods 44:55 "Safety Crucial in Facility Disruptions" 48:50 ICS Security: Closing Safety Gaps 53:37 Enhancing ICS Security Controls 57:18 "ICS Summit and LinkedIn Activities"   About the guest :  Dean is the CEO and Principal Consultant of ICS Defense Force and brings over 20 years of technical and management experience to the classroom. He has worked in both Information Technology and Industrial Control System (ICS) Cyber Defense in critical infrastructure sectors such as telecommunications, electric generation, transmission, distribution, and oil & gas refineries, storage, and distribution, and water management. Dean is an ambassador for defending industrial systems and an advocate for the safety, reliability, and cyber protection of critical infrastructure. His mission as an instructor is to empower each of his students, and he earnestly preaches that “Defense is Do-able!”    Over the course of his career, Dean's accomplishments include establishing entire ICS security programs for critical infrastructure sectors, successfully conducting industrial-grade incident response and tabletops, ICS digital forensics, and ICS/OT Cybersecurity assessments across multiple sectors. As a SANS Principal Instructor, Dean teaches ICS515: ICS Visibility, Detection, and Response, is a co-author of the SANS Course ICS418: ICS Security Essentials for Managers and an author of SANS ICS Engineer Technical Awareness Training. Dean is a member of the SANS GIAC Advisory Board and holds many cybersecurity professional certifications including the GICSP, GRID, GSLC, and GCIA, as well as the CISSP®, and holds a BS in computer science. When not in the field, Dean spends tine chasing icebergs off the coast of Newfoundland on a jetski, or writing electric 80s inspired electronic music in this band Arcade Knights.   Resources Mentioned:  5 ICS Cybersecurity Critical Controls: https://www.sans.org/white-papers/five-ics-cybersecurity-critical-controls/ SANS ICS Cybersecurity Summit: https://www.sans.org/cyber-security-training-events/ics-security-summit-2025/ How to connect Dean:  https://www.linkedin.com/in/dean-parsons-cybersecurity/ https://www.sans.org/profiles/dean-parsons/ Dean's Book: https://www.amazon.com/ICS-Cybersecurity-Field-Manual-EXCLUSIVE/dp/B0CGG6GMHW/   Connect With Aaron Crow: Website: www.corvosec.com  LinkedIn: https://www.linkedin.com/in/aaronccrow   Learn more about PrOTect IT All: Email: info@protectitall.co  Website: https://protectitall.co/  X: https://twitter.com/protectitall  YouTube: https://www.youtube.com/@PrOTectITAll  FaceBook:  https://facebook.com/protectitallpodcast    To be a guest or suggest a guest/episode, please email us at info@protectitall.co   Please leave us a review on Apple/Spotify Podcasts: Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124 Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Send us a textVulnerability assessments serve as the frontline defense against cybersecurity threats, yet many professionals struggle to understand the terminology and methodologies that make them effective. In this comprehensive episode, we demystify the critical components of vulnerability management that every security practitioner should master – whether you're preparing for the CISSP exam or strengthening your organization's security posture.We begin by examining recent ransomware attacks targeting municipal governments across the United States, highlighting how 28 county and tribal governments have already fallen victim in 2024 alone. These incidents underscore why vulnerability management isn't just theoretical knowledge but an urgent practical necessity for protecting critical infrastructure and services.Diving into the technical foundations, we explore how the Common Vulnerability and Exposures (CVE) system works, from discovery to disclosure, and how the Common Vulnerability Scoring System (CVSS) helps prioritize remediation efforts through its base, temporal, and environmental metrics. You'll gain clarity on related frameworks including CPE, CCE, and OVAL, understanding how these pieces fit together to create a comprehensive vulnerability management approach.The episode also provides a practical breakdown of network scanning techniques essential for vulnerability discovery, including SYN scans, TCP connect scans, ACK scans, UDP scans, and Christmas tree scans. We explain the intricacies of the TCP handshake process and how different scanning methods leverage various aspects of this protocol to identify potential vulnerabilities while avoiding detection.We also examine how AI-assisted code generation is transforming development practices, with 70% of professional developers expected to use these tools by 2027. While this technology promises significant productivity gains, it creates new security challenges that vulnerability assessment processes must address.Whether you're studying for the CISSP exam or looking to strengthen your organization's security practices, this episode equips you with the knowledge to implement effective vulnerability management. Visit CISSP Cyber Training for additional resources to support your cybersecurity journey.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Welcome back to Grey Dynamics. Today, we are thrilled to announce the OpSec Podcast, a project from our cyber intelligence and operational security expert, which will be produced and edited in-house every couple of weeks. Allen, the show host, is a seasoned intelligence and defence professional with over twenty years of experience, including military service, government contracting and the private sector. Specialising in Intelligence, Surveillance, and Reconnaissance (ISR) collection operations. Allen holds a Master of Science in Cybersecurity and top-tier certifications including CISSP and CASP+. Additionally, his career spans global assignments leading multinational teams and supporting mission-critical programs for the United States military and allied partners. Currently, he serves as a GEOINT advisor for the United States government and an OPSEC specialist in Grey Dynamics team. Find AllenLinkedIn ProfileOpSec PodcastIntel ReportsRelated LinksGrey Dynamics Intelligence Capability Development and TrainingGrey Dynamics Operational SupportGrey Dynamics Open Source Intelligence ServicesGrey Dynamics Case StudiesGrey Dynamics StoryAdvance Your Intelligence Career Today!We are the first fully online intelligence school helping professionals to achieve their long-term goals. Our school with tons of new material is currently under construction and will be out there very The Grey Dynamics Podcast is available on all major platforms!YouTubeSpotifyApple PodcastGoogle PodcastAmazon Podcast Hosted on Acast. See acast.com/privacy for more information.

In this episode, Dr. Jimmy Davies shares his inspiring journey from a variety of jobs to becoming a successful entrepreneur and technology expert. He discusses the importance of mentorship, community support, and the evolution of technology in entrepreneurship. Dr. Davies emphasizes the significance of embracing AI and technology for future business success while also highlighting the legacy of Every.Black, an organization dedicated to supporting Black entrepreneurs. The conversation touches on personal insights, the importance of networking, and the need for a mindset shift towards production and ownership in the community. Please LISTEN

Send us a textRansomware attacks are surging at an alarming rate - a Scottish non-profit recently reported a 100% increase year-over-year, with fraud cases expected to exceed $33 million. Even more concerning, businesses report feeling less resilient against these threats than in previous years. As cybersecurity professionals, we have a responsibility to help organizations understand and mitigate these risks before they become existential threats.Today's CISSP Question Thursday dives deep into Domain 5 concepts that directly address these challenges. We explore fifteen carefully crafted practice questions covering user account provisioning, deprovisioning, the principle of least privilege, Privileged Access Management (PAM), and identity governance. Each question targets critical knowledge areas you'll need to master for exam success while providing practical insights you can immediately apply to strengthen organizational security postures.The practice questions reveal important security principles: collecting user information must precede role assignment in the provisioning process; deprovisioning should occur immediately upon employment termination; personal preferences should never determine access rights; and PAM tools are essential for securing privileged accounts. We also examine why multi-factor authentication enhances security through multiple verification forms while Single Sign-On improves user experience by simplifying authentication processes.Whether you're preparing for the CISSP exam or looking to strengthen your organization's security practices, this episode provides actionable knowledge to protect against today's evolving threat landscape. Visit CISSPCyberTraining.com to access our comprehensive blueprint and additional resources designed to help you pass your exam the first time. Share your thoughts on today's questions and let us know what topics you'd like us to cover in future episodes!Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

“Networking is a two-way street, and I always emphasize the give aspect. When I meet someone new, I try to understand their needs and figure out how I can help them.” – Michael Morgan Today's featured award-winning author is a motivational speaker, mentor, and consultant, Michael Morgan. Michael and I had a fun on a bun chat about his book, “The Power Of Networking: Strategies for Career Excellence, Job Development, and Building Greater Triumphs in Your Work”, the power of changing your zip code, and more!!!Key Things You'll Learn:What led Michael to write and publish his first bookWhy stepping out of your comfort zone is essential to career successWhat setback led him to create more successTwo common networking mistakes to avoidMichael's Site: https://michaelvmorgan.com/Michael's Book: https://a.co/d/7WKc10HThe opening track is titled, “North Wind and the Sun” by Trevin P. To listen to and download the full track, click the following link. https://compilationsforhumanity.bandcamp.com/track/north-wind-and-the-sunPlease support today's podcast to keep this content coming! CashApp: $DomBrightmonDonate on PayPal: @DBrightmonBuy Me a Coffee: https://www.buymeacoffee.com/dombrightmonGet Going North T-Shirts, Stickers, and More: https://www.teepublic.com/stores/dom-brightmonThe Going North Advancement Compass: https://a.co/d/bA9awotYou May Also Like…Ep. 306 – “Be The SPARK” with Dr. Simon T. Bailey (@SimonTBailey): https://www.goingnorthpodcast.com/ep-306-be-the-spark-with-simon-t-bailey-simontbailey/Ep. 669 – “Save Your Asks” with Chris Tuff (@christuff): https://www.goingnorthpodcast.com/ep-669-save-your-asks-with-chris-tuff-christuff/Ep. 623 - "The Day One Executive" With April Armstrong (@ahaconsult): https://www.goingnorthpodcast.com/ep-623-the-day-one-executive-with-april-armstrong-ahaconsult/Ep. 336.5 (H2H Special) – “Own Your Career Own Your Life” with Andy Storch (@AndyStorch): https://www.goingnorthpodcast.com/ep-3365-h2h-special-own-your-career-own-your-life-with-andy-storch-andystorch/Ep. 857 – Side Hustle & Flow with Cliff Beach, DTM (@cliffbeachmusic): https://www.goingnorthpodcast.com/ep-857-side-hustle-flow-with-cliff-beach-dtm-cliffbeachmusic/Ep. 691 – “How to Spark Your Heart and Ignite Your Life” with Hilary DeCesare (@HilaryDeCesare): https://www.goingnorthpodcast.com/ep-691-how-to-spark-your-heart-and-ignite-your-life-with-hilary-decesare-hilarydecesare/Ep. 795 – If You Want to Win, Start Within with Ahmard Vital (@ahmardvital): https://www.goingnorthpodcast.com/ep-795-if-you-want-to-win-start-within-with-ahmard-vital-ahmardvital/Ep. 632 – “The Career Toolkit” with Mark Herschberg (@CareerToolkitBk): https://www.goingnorthpodcast.com/ep-632-the-career-toolkit-with-mark-herschberg-careertoolkitbk/Ep. 353 – “Free Agent” with Rennie Curran (@RennieCurran53): https://www.goingnorthpodcast.com/ep-353-free-agent-with-rennie-curran-renniecurran53/Ep. 307 – “Failure Is Not The Problem, It's The Beginning Of Your Success” with Col. George Milton: https://www.goingnorthpodcast.com/ep-307-failure-is-not-the-problem-its-the-beginning-of-your-success-with-col-george-milton/270 – "Forever Employable" with Jeff Gothelf (@jboogie): https://www.goingnorthpodcast.com/270-forever-employable-with-jeff-gothelf-jboogie/Ep. 348 – “Bring Inner Greatness Out” with Dr. Mansur Hasib, CISSP, PMP, CPHIMS (@mhasib): https://www.goingnorthpodcast.com/ep-348-bring-inner-greatness-out-with-dr-mansur-hasib-cissp-pmp-cphims-mhasib/Ep. 768 – How You Can Become a Valuable Leader with Velma Knowles: https://www.goingnorthpodcast.com/ep-768-how-can-you-become-a-valuable-leader-with-velma-knowles/Ep. 931 – Proven Sales Management Wisdom for a Limitless Career with Meghan Clarke (@meghanclarkeofficial): https://www.goingnorthpodcast.com/ep-931-proven-sales-management-wisdom-for-a-limitless-career-with-meghan-clarke-meghanclarkeoff/

Send us a textNavigating the complex landscape of authentication frameworks is essential for any cybersecurity professional, especially those preparing for the CISSP exam. This deep-dive episode unravels the intricate world of authentication systems that protect our digital identities across multiple platforms and services.We begin by examining OAuth 2.0 and OpenID Connect (OIDC), exploring how these token-based frameworks revolutionize third-party authentication without exposing user credentials. When you click "Login with Google," you're experiencing these protocols in action—reducing password reuse while maintaining security across digital services. Learn the difference between authorization flows and how these systems interact to verify your identity seamlessly across the web.The podcast then transitions to Security Assertion Markup Language (SAML), breaking down how this XML-based protocol establishes trust between identity providers and service providers. Through practical examples, we illustrate how SAML enables web single sign-on capabilities across educational institutions, corporate environments, and cloud services—creating that "connective tissue" between disparate systems while enhancing both security and user experience.Kerberos, MIT's powerful network authentication protocol, takes center stage as we explore its ticketing system architecture. Named after the three-headed dog of Greek mythology, this protocol's Authentication Service, Ticket Granting Service, and Key Distribution Center work in concert to verify identities without transmitting passwords across networks. We also discuss critical considerations like time synchronization requirements that can make or break your Kerberos implementation.For remote authentication scenarios, we compare RADIUS and TACACS+ protocols, highlighting their distinct approaches to the AAA (Authentication, Authorization, and Accounting) framework. Discover why network administrators choose UDP-based RADIUS for general network access while preferring the TCP-based TACACS+ for granular administrative control with command-level authorization and full payload encryption.Whether you're studying for the CISSP exam or looking to strengthen your organization's security posture, this episode provides the knowledge foundation you need to implement robust authentication systems in today's interconnected world. Visit CISSP Cyber Training for additional resources to support your cybersecurity journey.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Craig Taylor is a seasoned cybersecurity leader, CISSP since 2001, and co-founder of CyberHoot, a fully automated SaaS platform that teaches cyber literacy to SMBs and MSPs. As a virtual CISO for over 35 companies and founder of a growing vCISO peer group, he brings deep expertise and collaborative insight to the cybersecurity field. A gifted speaker, Rotarian, and cancer research fundraiser, Craig blends technical leadership with a passion for service and community.Master of Your Crafts is a captivating podcast featuring conversations with individuals who have dedicated themselves to mastering their craft. Whether it's a gift, talent or skill that comes naturally to them, these individuals have taken ownership and honed their abilities to perfection. Through deep conversation, we delve into their inner dialogue, actions and life circumstances offering words of wisdom to empower and guide you on a journey to becoming the master of your own craft.For more information, visit our website https://masterofyourcrafts.com and Bright Shining Light Website: https://brightshininglight.comStay connected with us:- Facebook: https://www.facebook.com/masterofyourcrafts- Instagram: https://www.instagram.com/MasterOfYourCrafts/- Spotify: https://open.spotify.com/show/1M0vp9HoK7kkP1w4ij7PJd?si=7d383a92b93b4e2c- ApplePodcast: https://podcasts.apple.com/ca/podcast/master-of-your-crafts/id1512818795- Amazon Music: https://music.amazon.ca/podcasts/b15079de-bc6a-487c-b8f8-faca73d0f685/master-of-your-crafts- Google Play: https://podcasts.google.com/feed/aHR0...

Send us a textA shocking incident in Spain recently left 60% of the country's power grid dark in less than five seconds. Was it a cyber attack? The jury's still out, but this real-world event perfectly illustrates why understanding access controls and security mechanisms is critical for today's cybersecurity professionals.Sean Gerber, despite battling a cold that affects his voice, delivers a compelling analysis of the Spanish power grid incident before diving into essential CISSP domain four content. He highlights how smaller electrical providers might have fewer security resources, making them attractive targets, and emphasizes the growing importance of professionals who understand both operational technology and information technology security.The episode then transitions into practical CISSP exam preparation, exploring various types of access controls through real-world scenarios. Sean expertly distinguishes between preventative, detective, corrective, and deterrent controls, while also clarifying the differences between physical and logical security mechanisms. Particularly valuable is his breakdown of biometric authentication methods, pointing out how voice recognition (ironically demonstrated by his own cold-affected voice) proves less reliable than alternatives like iris scanning or fingerprinting.Understanding the nuances between Mandatory Access Controls (MAC) and Discretionary Access Controls (DAC), implementing proper identity proofing processes, and recognizing when compensating controls are needed are all critical CISSP concepts covered in this content-rich episode. Whether you're preparing for certification or working to strengthen your organization's security posture, these lessons apply directly to building effective defense-in-depth strategies. Ready to master these concepts and pass your CISSP exam? Visit CISSP Cyber Training for a proven blueprint guaranteed to help you succeed.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Send us a textWhat happens when a former Air Force weapons loader transforms into a cybersecurity expert? Clint Stevens from Physics joins us to share his remarkable journey through military intelligence, special operations support, and cyber warfare before founding his own security consultancy.This conversation peels back the layers of cybersecurity consulting to reveal what truly matters for organizations trying to improve their security posture. Clint explains why expensive security tools often become glorified "paperweights" when organizations fail to understand their specific threat landscape first. His practical approach focuses on identifying business-specific risks rather than implementing generic solutions that waste resources without addressing real vulnerabilities.For aspiring cybersecurity professionals, Clint offers refreshingly honest career advice that contradicts common assumptions. Rather than accumulating certifications without purpose, he emphasizes finding your passion within the vast cybersecurity landscape and developing hands-on experience. "Find what you're most interested in," he advises, noting that true expertise requires thousands of hours of dedication—something only sustainable when you genuinely enjoy the work.Perhaps most valuable is Clint's insight into the crucial skill of translating technical findings into business impacts. This ability to communicate effectively with everyone from system administrators to CEOs—what Sean calls speaking "dolphin to shark"—often determines whether security recommendations are implemented or ignored. The conversation highlights why understanding both the technical and business perspectives is essential for career advancement in cybersecurity.Whether you're preparing for the CISSP exam or exploring career opportunities in information security, this episode delivers practical wisdom from someone who's successfully navigated multiple roles in the field. Visit phycyx.com to learn more about Physics' approach to cybersecurity consulting.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Send us a textCybersecurity professionals need a solid understanding of secure communication protocols, not just for exam success but for real-world implementation. This episode unpacks the essential protocols covered in CISSP Domain 4.1.3, providing clear explanations of how each works and when to use them.We begin with a timely discussion of the recent UnitedHealthcare hack, examining how ransomware crippled Change Healthcare systems nationwide. This case study highlights the critical importance of understanding security protocols and being able to articulate potential business impacts to leadership. Sean shares practical approaches for estimating downtime costs to help justify security investments.The heart of this episode explores crucial security protocols including IPsec tunnels, Kerberos authentication, Secure Shell (SSH), and the Signal protocol. Each section covers how these technologies function, their ideal use cases, and their respective strengths and limitations. The discussion extends to transport layer security (TLS), layer 2 tunneling protocol (L2TP), and lesser-known protocols like secure real-time transport protocol (SRTP) and Zimmerman real-time transport protocol (ZRTP).Sean breaks down complex technical concepts into accessible explanations, perfect for both CISSP candidates and practicing security professionals. Understanding these protocols isn't just about passing an exam—it's about making informed decisions when implementing security architecture in your organization. Whether you're preparing for certification or looking to strengthen your organization's security posture, this episode provides valuable insights into the fundamental building blocks of secure communications.Check out cisspcybertraining.com for free resources including practice questions, training videos, and blog posts to support your cybersecurity learning journey.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Send us a textSecurity regulations are changing dramatically in response to major breaches, and the implications for cybersecurity professionals are profound. Sean Gerber kicks off this episode with a career announcement, sharing his transition to independent consulting after 13 years with his previous employer—a move that highlights the evolving opportunities in the cybersecurity field.The heart of this episode examines the recent UnitedHealthcare breach, where attackers targeted Change Healthcare, a critical system processing 15 billion healthcare transactions annually. The February ransomware attack led to a $22 million ransom payment and disrupted approximately half of all pharmacy operations across the United States. This incident serves as a perfect case study in critical infrastructure vulnerability and has triggered a significant regulatory response from the Biden administration, which is now promising "tough, mandatory cybersecurity standards" for the healthcare industry.What does this mean for security professionals? Potentially stricter oversight, increased financial penalties, and perhaps most concerning—explicit executive liability for security failures. As Sean notes, these developments create an increasingly complex landscape where CISOs must navigate not just technical challenges but also regulatory expectations that might lack technical nuance.The episode transitions into a comprehensive examination of CISSP exam questions covering Domain 3.6, focusing on message integrity, digital signatures, and cryptographic hashing functions. Through fifteen detailed questions and answers, Sean breaks down essential concepts like the difference between checksums and hashing functions, the evolution from SHA-1 to more secure algorithms, and the role of certificate authorities in public key infrastructure. These technical foundations aren't just academic—they're the building blocks of systems that, when implemented correctly, prevent exactly the kind of breach that hit UnitedHealthcare.Ready to deepen your understanding of message integrity and prepare for the CISSP exam? Visit CISSP Cyber Training for videos, transcripts, and additional practice questions to help you master these critical concepts and advance your cybersecurity career.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

“You do not deserve to be harassed, or disrespected, or demeaned in your workplace. That is not normal.” – Jeff Davis Today's featured award-winning bestselling author is a mental health advocate, international keynote speaker, world traveler, TEDx speaker, and digital marketing expert, Jeff Davis. Jeff and I had a fun on a bun chat about his new book, “The Courage To Leave: Breaking Free from Toxic Workplaces”, the importance of self-advocacy, prioritizing your well-being, and more!!Key Things You'll Learn:How he legally challenged a multi-billion dollar company and wonHow he dealt with his severe burnout experience while living overseas during COVID-19The importance of recognizing the signs of burnout and taking proactive steps to address itStrategies for coping with toxic work environments and finding supportWhy standing up for yourself is necessary for your well-beingJeff's Site: https://jeffdspeaks.com/Jeff's Books: https://www.amazon.com/stores/author/B00PF0QL8U/allbooksJeff's TEDx Talk: https://youtu.be/b_hwMJMBBvQ?si=2ozFiXTJF_FkDrOTThe opening track is titled, “North Wind and the Sun” by Trevin P. to listen to the full track and download it, click the following link. https://compilationsforhumanity.bandcamp.com/track/north-wind-and-the-sunPlease support today's podcast to keep this content coming! CashApp: $DomBrightmonDonate on PayPal: @DBrightmonBuy Me a Coffee: https://www.buymeacoffee.com/dombrightmonGet Going North T-Shirts, Stickers, and More: https://www.teepublic.com/stores/dom-brightmonThe Going North Advancement Compass: https://a.co/d/bA9awotYou May Also Like…14 - "Reach Your Mountaintop" Jeff Davis (@JeffDavis027): https://www.goingnorthpodcast.com/14-reach-your-mountaintop-jeff-davis-jeffdavis027/Ep. 322.5 (H2H Special) – “Burnout Proof” with Michael Levitt (@bfastleadership): https://www.goingnorthpodcast.com/ep-3225-h2h-special-burnout-proof-with-michael-levitt-bfastleadership/Ep. 836 – The 6% Club with Dr. Michelle Rozen (@DrMichelleRozen): https://www.goingnorthpodcast.com/ep-836-the-6-club-with-dr-michelle-rozen-drmichellerozen/Ep. 943 – How to Create a Team Culture Where Everyone Thrives with Dr. Patricia Grabarek & Dr. Katina Sawyer (@WorkrBeeing): https://www.goingnorthpodcast.com/ep-943-how-to-create-a-team-culture-where-everyone-thrives-with-dr-patricia-grabarek-dr-katin/Ep. 764 – The 5 Languages of Appreciation in the Workplace with Dr. Paul White (@drpaulwhite): https://www.goingnorthpodcast.com/ep-764-the-5-languages-of-appreciation-in-the-workplace-with-dr-paul-white-drpaulwhite/Ep. 502 – “A Leadership Development Strategy To Bond And Unite” With Amy P. Kelly (@AmyPKelly): https://www.goingnorthpodcast.com/ep-502-a-leadership-development-strategy-to-bond-and-unite-with-amy-p-kelly-amypkelly/Ep. 571 – “A Powerful Culture Starts with You” with Dr. Shahrzad Nooravi (@shahrzadnooravi): https://www.goingnorthpodcast.com/ep-571-a-powerful-culture-starts-with-you-with-dr-shahrzad-nooravi-shahrzadnooravi/#Bonus Host2Host Ep.– “Unleashing the Power of Respect” with Dr. Joseph Shrand (@Drjoeshrand): https://www.goingnorthpodcast.com/bonus-host2host-ep-unleashing-the-power-of-respect-with-dr-joseph-shrand-drjoeshrand/Ep. 411 – “Name That Mouse” with David Wood (@_focusceo): https://www.goingnorthpodcast.com/ep-411-name-that-mouse-with-david-wood-_focusceo/44 - "How to Work With Jerks" by Eric Williamson (@TTS_Williamson): https://www.goingnorthpodcast.com/44-how-to-work-with-jerks-by-eric-williamson-tts_williamson/Ep. 372 – “The Grit Factor” with Shannon Huffman Polson (@ABorderLife): https://www.goingnorthpodcast.com/ep-372-the-grit-factor-with-shannon-huffman-polson-aborderlife/Ep. 348 – “Bring Inner Greatness Out” with Dr. Mansur Hasib, CISSP, PMP, CPHIMS (@mhasib): https://www.goingnorthpodcast.com/ep-348-bring-inner-greatness-out-with-dr-mansur-hasib-cissp-pmp-cphims-mhasib/

Send us a textEver wondered how your sensitive messages stay secure in an increasingly dangerous digital landscape? The answer lies in message integrity controls, digital signatures, and certificate validation – the core components of modern cybersecurity we tackle in this episode.We begin with a timely breakdown of Microsoft's recent security breach by Russian hackers who stole source code by exploiting a test environment. This real-world example perfectly illustrates why proper security controls must extend beyond production environments – a lesson many organizations learn too late.Diving into the technical foundation of message security, we explore how basic checksums evolved into sophisticated hashing algorithms like MD5, SHA-2, and SHA-3. You'll understand what makes these algorithms effective at detecting tampering and why longer digests provide better protection against collision attacks.Digital signatures emerge as the cornerstone of secure communication, providing the crucial trifecta of integrity verification, sender authentication, and non-repudiation. Through practical examples with our fictional users Alice and Bob, we demonstrate exactly how public and private keys work together to safeguard information exchange.The episode culminates with an exploration of digital certificates and S/MIME protocols – the technologies that make secure email possible. You'll learn how certificate authorities establish chains of trust, what happens when certificates are compromised, and how the revocation process protects the entire ecosystem.Whether you're preparing for the CISSP exam or simply want to understand how your sensitive communications remain protected, this episode provides clear, actionable knowledge about the cryptographic building blocks that secure our digital world.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Episode #74 features a great discussion with Steve Winterfeld, Advisor, and Fractional CISO with Cyber Vigilance Advice (CVA) LLC. Steve is passionate about cybersecurity. He served as CISO for Nordstrom Bank, Director of Cybersecurity for Nordstrom, and Director of Incident Response and Threat Intelligence at Charles Schwab. Steve also published a book on Cyber Warfare and holds CISSP, ITIL, and PMP certifications. We discussed a variety of topics, and during our conversation, Steve offered these resources: On finding job: Lessons Learned on Finding a Cybersecurity Job After a Layoff - Security Boulevard On starting / managing a career: Creating a Roadmap for Your Dream Cybersecurity Career - Security Boulevard 

Send Bidemi a Text Message!In this episode, host Bidemi Ologunde spoke with May Brooks-Kempler, a cybersecurity educator, entrepreneur, and consultant. In this episode, May shares her insights into what cybersecurity is and isn't, how to build a successful cybersecurity career, the mindset and skills necessary to thrive within cybersecurity, what led her to build an online cybersecurity community of over 27,000 members, and lots more. May is an Amazon bestselling author, a TEDx speaker, and mentor to hundreds.Support the show