Certified: The CISSP Audio Course
Alle afleveringen
141 afleveringen, van nieuw naar oud
-
Episode 91: Security Test Data and Environment Management
23 juni 2025 · 12 min
Security testing requires careful control over both the test environment and the data used within it. In this episode, we explore how to create and manage dedicated testing environments that accurately simulate production systems without risking real assets. We cover the importance of data masking, synthetic data generation, and environment segmentation. You'll also learn how to prevent test environments from becoming security liabilities. CISSPs must understand how to manage test data in compliance with privacy regulations while ensuring integrity and realism in the testing process. Lees meer
-
Episode 90: Code Review and Static/Dynamic Testing
23 juni 2025 · 12 min
Code is a frequent source of vulnerabilities, and reviewing it is essential for secure software development. In this episode, we discuss secure code review techniques—both manual and tool-assisted. We explain how static application security testing (SAST) scans source code before runtime, while dynamic application security testing (DAST) analyzes behavior during execution. You’ll also learn about interactive testing, false positives, secure development lifecycles, and DevSecOps integration. CISSPs don’t have to write code, but they do need to understand how to validate its security and guide development practices. Lees meer
-
Episode 89: Security Control Testing: Manual vs. Automated
23 juni 2025 · 12 min
Security controls are only effective if they’re working as designed. In this episode, we explore how to test those controls using both manual and automated methods. We compare control validation techniques such as checklists, code reviews, synthetic transactions, vulnerability scanners, and red team exercises. You’ll learn when human judgment is needed, when automation scales better, and how to combine the two for comprehensive testing. As a CISSP, knowing how to assess the effectiveness of physical, technical, and administrative controls is key to maintaining a secure and compliant environment. Lees meer
-
Episode 88: Planning a Security Assessment
23 juni 2025 · 13 min
Security assessments must be planned thoroughly to be effective, safe, and actionable. This episode walks through the planning phase of an assessment project, including goal setting, scope definition, timeline management, and stakeholder communication. We explain how to assess organizational readiness, gain necessary approvals, and avoid disrupting operations. You’ll also learn about risk categorization, asset selection, test environment configuration, and the importance of documentation. CISSPs often serve as project leads or advisors for assessments, making this planning knowledge essential for both technical and governance roles. Lees meer
-
Episode 87: Assessment Types: Vulnerability Scans, Pen Testing, Audits
23 juni 2025 · 12 min
Security assessments come in many forms—each with a specific purpose. In this episode, we compare and contrast vulnerability scanning, penetration testing, and formal security audits. We cover the methodologies, tools, scope definitions, and reporting standards associated with each type. You’ll learn how to select the right assessment based on business goals, risk tolerance, and compliance requirements. We also examine legal considerations and rules of engagement for ethical hacking. For CISSPs, choosing and interpreting assessment results is key to effective security governance. Lees meer
-
Episode 86: Threats to IAM: Replay, Pass-the-Hash, Credential Stuffing
23 juni 2025 · 13 min
Identity systems are high-value targets, and attackers use increasingly sophisticated techniques to exploit them. This episode examines key IAM-related attack vectors, including replay attacks, pass-the-hash, credential stuffing, brute-force, and phishing-based compromise. We explain how these attacks work, the conditions that enable them, and the defenses needed to detect and prevent them. Controls discussed include session binding, MFA, rate limiting, password hygiene, and advanced behavioral analytics. CISSPs must understand not just how to build IAM systems, but how to defend them against persistent and evolving threats. Lees meer
-
Episode 85: Session Management and Timeout Policies
23 juni 2025 · 14 min
Controlling user sessions is a critical part of maintaining secure access. In this episode, we examine how session tokens are issued, maintained, and terminated—along with techniques to prevent hijacking and session fixation attacks. We explore timeout policies, inactivity limits, reauthentication triggers, and secure logout practices. You’ll learn how session management differs across web applications, VPNs, and enterprise software. By enforcing proper session controls, CISSPs can prevent unauthorized reuse, detect anomalies, and strengthen overall authentication posture. Lees meer
-
Episode 84: Access Recertification and Review
23 juni 2025 · 13 min
Access permissions tend to accumulate over time, creating a significant security risk if not reviewed regularly. This episode focuses on access recertification—the process of periodically validating that users still need the permissions they’ve been granted. We explain how to plan, automate, and document access reviews, and how to manage exceptions and approvals. You’ll also learn how access governance tools integrate with identity platforms to support audits and compliance. CISSPs play a vital role in ensuring that the principle of least privilege is continuously enforced across dynamic environments. Lees meer
-
Episode 83: Access Control Lists and Capability Tables
23 juni 2025 · 14 min
Access control mechanisms determine who can access what—and how. In this episode, we compare two classic models: Access Control Lists (ACLs) and capability tables. ACLs associate permissions with objects, while capability tables associate them with subjects. We examine their strengths, limitations, and real-world implementations in file systems, network devices, and operating systems. You’ll also learn about how these mechanisms enforce discretionary and mandatory access controls, and how they can be extended using role or attribute-based models. Understanding these concepts is essential for effective system authorization design. Lees meer
-
Episode 82: Credential Management and Recovery
23 juni 2025 · 13 min
Managing credentials securely is critical to preventing unauthorized access and ensuring business continuity. This episode explores techniques for secure credential issuance, storage, expiration, and revocation. We discuss the lifecycle of credentials across devices, users, and systems, including integration with password managers, key vaults, and enterprise authentication platforms. You'll also learn about secure recovery mechanisms such as self-service portals, identity proofing, and multi-step revalidation. CISSPs must understand how to enforce strong credential management policies while balancing usability, privacy, and administrative efficiency. Lees meer
-
Episode 81: Identity-as-a-Service (IDaaS) and Cloud IAM
23 juni 2025 · 14 min
Identity-as-a-Service (IDaaS) provides centralized identity and access management capabilities from the cloud. In this episode, we explore the architecture and benefits of IDaaS solutions, including scalability, simplified administration, and integration with cloud-native applications. You’ll learn how IDaaS supports federated identity, multi-factor authentication, and compliance through managed platforms. We also cover risks such as vendor lock-in, data privacy concerns, and API exposure. CISSPs must be prepared to evaluate IDaaS providers, configure identity governance, and ensure secure, policy-driven access in hybrid environments. Lees meer
-
Episode 80: Multi-Factor Authentication and Implementation
23 juni 2025 · 13 min
Multi-Factor Authentication (MFA) significantly strengthens identity verification by requiring more than one authentication factor. In this episode, we break down the different types of factors—something you know, have, are, do, or where you are—and how they’re combined for robust protection. We explore methods such as SMS codes, authenticator apps, smart cards, biometrics, and physical tokens. You’ll also learn how to implement MFA in various environments, manage usability challenges, and respond to bypass attempts. For CISSPs, mastering MFA is critical to securing both cloud and on-premise access paths. Lees meer
-
Episode 79: Directory Services: LDAP, Active Directory
23 juni 2025 · 16 min
Directory services are centralized databases that store and manage user credentials, permissions, and group memberships. In this episode, we explore how Lightweight Directory Access Protocol (LDAP) and Microsoft Active Directory (AD) function as the backbone of identity infrastructure. Topics include directory hierarchies, schema design, authentication flows, and integration with Kerberos. We also discuss common attacks on directories—like privilege escalation and replication abuse—and how to defend against them. For CISSPs, understanding directory services is essential for building scalable, secure access management systems. Lees meer
-
Episode 78: Privileged Access Management (PAM)
23 juni 2025 · 13 min
Privileged accounts have elevated access and are among the most targeted assets in any organization. In this episode, we examine Privileged Access Management (PAM) solutions, including vaulting, session recording, just-in-time provisioning, and approval workflows. We explain how PAM helps enforce least privilege, reduce insider threats, and meet compliance obligations. You'll also learn how to monitor, audit, and respond to anomalous privileged activity. Managing administrative access is critical to defending your environment, and CISSPs must know how to control the power that comes with privileged credentials. Lees meer
-
Episode 77: Federation and SSO: SAML, OAuth, OpenID
23 juni 2025 · 13 min
Federated identity systems allow users to authenticate across multiple platforms using a single identity, often enabling Single Sign-On (SSO). In this episode, we explain how standards like SAML, OAuth 2.0, and OpenID Connect enable cross-domain authentication. You’ll learn the difference between authentication and authorization, how token exchanges work, and what security concerns arise with federated systems. These technologies reduce friction, improve user experience, and centralize control—but only when implemented correctly. CISSPs must understand how to secure identity federation for enterprise and cloud environments. Lees meer
-
Episode 76: Biometric Authentication Strengths and Weaknesses
23 juni 2025 · 14 min
Biometric authentication uses unique physical or behavioral traits—like fingerprints, facial features, or voice—to verify identity. In this episode, we explore how biometrics work, including the concepts of enrollment, matching algorithms, false acceptance rates (FAR), false rejection rates (FRR), and spoofing resistance. We also examine the strengths and weaknesses of different biometric systems, their privacy implications, and where they’re most effectively deployed. As biometric technologies continue to evolve and gain adoption, CISSPs must understand how to assess, implement, and monitor them securely and ethically. Lees meer
-
Episode 75: Password Policy Design and Management
23 juni 2025 · 15 min
Passwords remain one of the most widely used—but frequently abused—authentication methods. In this episode, we explore how to design and manage effective password policies that balance usability with security. We cover best practices like minimum complexity, reuse prevention, expiration cycles, and password vaulting. You’ll also learn about modern recommendations from NIST that challenge older practices like frequent forced changes. CISSPs must understand how password policies impact behavior, system integration, and the broader security landscape, especially in hybrid and cloud environments. Lees meer
-
Episode 74: IAM Lifecycle and Governance
23 juni 2025 · 15 min
Identity and Access Management (IAM) is not just about technology—it’s a continuous lifecycle that requires strong governance. This episode walks through each stage of the IAM lifecycle: provisioning, access management, auditing, revalidation, and deprovisioning. We also examine governance frameworks that ensure IAM aligns with policy, risk appetite, and regulatory standards. From role design and separation of duties to periodic access reviews and exception handling, we explain how to maintain control and accountability over digital identities. A strong IAM governance model is essential for CISSPs managing access at scale. Lees meer
-
Episode 73: Authorization Techniques: RBAC, ABAC, MAC, DAC
23 juni 2025 · 14 min
Once a user’s identity is authenticated, the system must decide what they are allowed to do. This episode focuses on common authorization models: Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), Mandatory Access Control (MAC), and Discretionary Access Control (DAC). We explore the rules and policies that govern each model, along with their strengths, weaknesses, and appropriate use cases. You'll learn how to align authorization mechanisms with security policies and compliance requirements. For the CISSP exam and real-world implementation, these models form the core of secure resource management. Lees meer
-
Episode 72: Identity Proofing and Registration Processes
23 juni 2025 · 15 min
Before you can authenticate someone, you must first establish their identity through a process called identity proofing. In this episode, we cover how identity proofing works—from in-person validation and biometric capture to document verification and knowledge-based authentication. We explain how organizations perform registration, bind credentials, and manage onboarding securely. These processes form the foundation of digital identity and trust. Whether you're issuing smart cards for physical access or provisioning accounts for a cloud service, CISSPs must understand the lifecycle of identity creation and assurance. Lees meer
-
Episode 71: Authentication Factors and Methods
23 juni 2025 · 16 min
Authentication is the process of verifying identity, and it forms the first line of defense in access control. In this episode, we explore the different authentication factors: something you know (passwords, PINs), something you have (tokens, smart cards), something you are (biometrics), somewhere you are (location), and something you do (behavioral patterns). We also examine common authentication methods, including single-factor, multi-factor, and risk-based authentication. Understanding how these factors work—individually and in combination—is essential for designing secure systems and passing CISSP exam questions that deal with identity assurance. Lees meer
-
Episode 70: DDoS Protection and High Availability Networks
23 juni 2025 · 18 min
Distributed Denial of Service (DDoS) attacks are designed to overwhelm systems and take down critical services. In this episode, we explain how these attacks work—volumetric, protocol, and application-layer—and the techniques used to defend against them. You’ll learn about scrubbing centers, rate limiting, traffic shaping, and the role of content delivery networks in mitigation. We also explore how to design high-availability network architectures with redundancy, failover, and load balancing to ensure service continuity even under stress. CISSPs must be equipped to anticipate, prevent, and recover from large-scale disruption events. Lees meer
-
Episode 69: Cloud Network Security (CASB, SASE, Virtual Firewalls)
23 juni 2025 · 19 min
As more organizations move to the cloud, network security must evolve. This episode focuses on cloud-native controls including Cloud Access Security Brokers (CASB), Secure Access Service Edge (SASE), and virtual firewalls. You’ll learn how these tools provide visibility, policy enforcement, data loss prevention, and threat protection across hybrid and multi-cloud environments. We also cover identity-based access control, cloud segmentation, and encryption in transit. With cloud services extending beyond traditional boundaries, CISSPs must adopt new strategies to maintain consistent and scalable network protections. Lees meer
-
Episode 68: Content Delivery Networks and Edge Security
23 juni 2025 · 18 min
Content Delivery Networks (CDNs) accelerate access to web content by distributing it across global edge nodes, but they also introduce new attack surfaces. In this episode, we discuss how CDNs work, their role in performance optimization, and the security challenges they present, such as cache poisoning, misconfigured access controls, and DDoS targeting. We also explore edge computing security—protecting data and services closer to the end user. CISSPs must understand how to secure the entire content delivery path, from cloud origin to user browser, while balancing speed, scalability, and control. Lees meer
-
Episode 67: Zero Trust and Software-Defined Networking (SDN)
23 juni 2025 · 17 min
Zero Trust has emerged as a powerful model for modern cybersecurity, shifting the focus from perimeter defenses to granular, identity-centric control. In this episode, we explain the principles of Zero Trust—never trust, always verify—and how it’s implemented using continuous authentication, microsegmentation, and least privilege access. We also explore Software-Defined Networking (SDN), a framework for dynamically managing and securing network resources through centralized controllers. Together, Zero Trust and SDN provide the flexibility and control needed for cloud-first, hybrid, and highly distributed environments. Lees meer
-
Episode 66: Network Monitoring and Traffic Analysis
23 juni 2025 · 17 min
Continuous monitoring and traffic analysis are essential for detecting threats, performance issues, and policy violations. In this episode, we explore tools and techniques used to observe network behavior in real time. Topics include flow monitoring, deep packet inspection, NetFlow, and behavioral analytics. You’ll also learn about the role of Security Information and Event Management (SIEM) in aggregating data and generating actionable alerts. By understanding normal traffic patterns, CISSPs can more effectively detect anomalies, trace intrusions, and support forensic investigations. Monitoring is not optional—it's the pulse of your security operations. Lees meer
-
Episode 65: Network Address Translation and Proxy Usage
23 juni 2025 · 17 min
NAT and proxy servers play important roles in hiding internal IP addresses, enforcing access policies, and controlling traffic flow. In this episode, we explore how Network Address Translation (NAT) works to conserve IP space and obscure internal architectures. We also explain how proxies—forward, reverse, and transparent—support web filtering, anonymization, caching, and load balancing. You’ll learn how to implement these technologies securely, monitor their usage, and avoid common pitfalls. CISSPs must understand how to integrate NAT and proxy mechanisms into broader network defense strategies. Lees meer
-
Episode 64: VOIP and Secure Communication Channels
23 juni 2025 · 16 min
Voice over IP (VOIP) technologies have replaced traditional telephony in many organizations, but they come with their own set of security concerns. This episode explores the architecture of VOIP systems and the threats they face, including call interception, eavesdropping, spoofing, and denial-of-service attacks. We also cover secure communication protocols such as SRTP, SIPS, and encrypted signaling mechanisms. You’ll learn how to harden VOIP infrastructure, apply access controls, and monitor for anomalies. CISSPs must be prepared to evaluate communication channels not just for functionality, but also for confidentiality and integrity. Lees meer
-
Episode 63: Wireless Network Security (WEP, WPA2/3, 802.1X)
23 juni 2025 · 18 min
Wireless networks present a unique set of vulnerabilities due to their reliance on open air transmission. In this episode, we examine wireless security protocols and controls, including WEP, WPA2, WPA3, and 802.1X. We explain how authentication frameworks, encryption standards, and access controls protect against threats like rogue access points, packet sniffing, and brute-force attacks. You’ll also learn about secure SSID broadcasting, segmentation, and signal isolation. Securing wireless environments is a critical task for CISSPs, especially as more enterprise traffic shifts to mobile and remote connections. Lees meer
-
Episode 62: VPNs, Remote Access, and Tunneling Protocols
23 juni 2025 · 15 min
-
Episode 61: Secure Routing and Switching
23 juni 2025 · 14 min
Secure routing and switching are foundational elements of network security. In this episode, we explore how routers and switches operate, and how attackers exploit their misconfigurations or weaknesses to gain access or disrupt communication. Topics include route hijacking, ARP poisoning, MAC flooding, and VLAN hopping. You’ll learn best practices for hardening these devices, including access control lists (ACLs), management plane protection, port security, and proper firmware management. Ensuring routing and switching infrastructure is properly secured is a critical skill for any CISSP responsible for protecting the integrity of network environments. Lees meer
-
Episode 60: Intrusion Detection and Prevention Systems
23 juni 2025 · 13 min
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are crucial for identifying and stopping threats in real time. This episode explores how these tools work, their deployment strategies, and how they integrate with broader security operations. You’ll learn about signature-based and anomaly-based detection, false positives, evasion techniques, and tuning practices. We also cover network-based and host-based implementations, and how alerts are correlated in a Security Information and Event Management (SIEM) platform. IDS and IPS are key components of active defense and threat response. Lees meer
-
Episode 59: Defense in Depth with Firewalls and DMZs
23 juni 2025 · 13 min
Layered security—known as defense in depth—is a core concept in cybersecurity architecture. This episode focuses on how firewalls and demilitarized zones (DMZs) serve as essential layers in protecting internal networks. We explore different types of firewalls (packet filtering, stateful, next-gen), the design of DMZs for public-facing services, and how to enforce traffic controls between zones. You'll also learn how to implement rule sets, audit firewall logs, and support intrusion detection systems. This is critical knowledge for securing enterprise perimeters and enforcing trust boundaries. Lees meer
-
Episode 58: Network Segmentation and Microsegmentation
23 juni 2025 · 14 min
Segmentation limits the spread of attacks and improves control over traffic flows within a network. In this episode, we examine both traditional network segmentation and microsegmentation techniques. You’ll learn how VLANs, firewalls, and subnetting create macro boundaries, while software-defined networking enables granular control over traffic between workloads and devices. We discuss how segmentation supports least privilege access, improves detection, and reduces risk. CISSPs must know how to design segmented architectures that balance performance, visibility, and security. Lees meer
-
Episode 57: Secure Protocols: HTTPS, SSH, SFTP, SNMPv3
23 juni 2025 · 13 min
Secure communication protocols form the backbone of protected digital environments. In this episode, we explore widely used secure protocols like HTTPS, SSH, SFTP, and SNMPv3. You’ll learn how each one provides confidentiality, integrity, and authentication for various types of data exchanges—from web traffic and file transfers to remote administration and device management. We cover protocol strengths, configuration tips, and common pitfalls. CISSPs must understand which protocols are appropriate for specific use cases and how to deploy them effectively in enterprise environments. Lees meer
-
Episode 56: OSI and TCP/IP Models Refresher
23 juni 2025 · 12 min
The OSI and TCP/IP models provide a layered approach to understanding how data is transmitted, received, and managed across networks. In this episode, we refresh your understanding of these models and their significance in network security. We explore the function of each layer—from physical cabling to application-level protocols—and explain how attacks and defenses map to specific layers. You’ll also learn how these models aid in troubleshooting, forensic analysis, and control implementation. Mastery of these foundational models helps CISSPs design and secure resilient networked systems. Lees meer
-
Episode 55: Network Architecture: LAN, WAN, Internet
23 juni 2025 · 13 min
Understanding how networks are built and connected is foundational for any security professional. In this episode, we review core network architecture concepts, including the structure and purpose of Local Area Networks (LANs), Wide Area Networks (WANs), and the global Internet. We examine how data moves across these networks and where vulnerabilities may appear, from physical access points to routing protocols. You’ll also learn about segmentation, perimeter controls, and traffic flow management. A solid grasp of network architecture is necessary for applying controls and preventing unauthorized access. Lees meer
-
Episode 54: Fault Tolerance, Redundancy, and High Availability
23 juni 2025 · 13 min
Downtime is not an option for mission-critical systems. In this episode, we dive into fault tolerance, redundancy, and high availability—design strategies that ensure continuity despite component failures or unexpected disruptions. You’ll learn the differences between active-active and active-passive configurations, the role of clustering, load balancing, failover mechanisms, and geographically distributed resources. We also cover the importance of regular testing and monitoring to validate these systems. Building resilient infrastructure is a core CISSP competency and a vital part of risk mitigation planning. Lees meer
-
Episode 53: SCADA and Embedded System Security
23 juni 2025 · 13 min
Supervisory Control and Data Acquisition (SCADA) systems and embedded devices operate some of the most critical infrastructure in the world—from energy grids to transportation systems. This episode explores the unique challenges of securing these environments, including limited resources, outdated firmware, lack of patching, and real-time operational requirements. We cover best practices for access control, network isolation, vendor management, and secure configuration. As cyber threats increasingly target industrial systems, it’s crucial for CISSPs to understand how to protect these specialized and high-impact platforms. Lees meer
-
Episode 52: Emerging Technologies and Security Architecture (e.g., IoT, AI)
23 juni 2025 · 14 min
Technological innovation continues to transform the security landscape. In this episode, we examine how emerging technologies such as the Internet of Things (IoT), Artificial Intelligence (AI), and machine learning are impacting security architecture. We discuss the benefits and vulnerabilities of these systems, including expanded attack surfaces, device sprawl, privacy concerns, and autonomous decision-making risks. You’ll also learn strategies for integrating these technologies securely using layered defenses, segmentation, and monitoring. CISSPs must understand both the opportunity and risk that innovation brings to cybersecurity. Lees meer
-
Episode 51: Security Boundaries and Isolation Techniques
23 juni 2025 · 14 min
Security boundaries are essential for creating logical separations between systems, users, and data flows. In this episode, we explore how boundaries are defined and enforced, using both physical and logical mechanisms. You’ll learn about concepts like trust zones, network segmentation, VLANs, virtualization, and sandboxing. We also discuss isolation techniques that prevent lateral movement, contain breaches, and ensure critical assets remain protected. Proper use of boundaries and isolation helps reduce attack surfaces, enforce policy, and support compliance. These principles are vital for scalable and secure infrastructure design. Lees meer
-
Episode 50: Security Evaluations: Common Criteria, RMF, ISO/IEC
23 juni 2025 · 13 min
Security evaluations provide assurance that systems meet defined security requirements. In this episode, we examine key evaluation frameworks including Common Criteria (CC), the NIST Risk Management Framework (RMF), and the ISO/IEC 27000 series. You'll learn how these models define evaluation assurance levels, categorize controls, and guide secure system development. We also discuss how evaluation results support procurement, risk analysis, and compliance audits. For CISSP candidates and practitioners, understanding security evaluation frameworks is essential for aligning technical design with governance expectations. Lees meer
-
Episode 49: Cryptanalysis and Attacks Against Crypto
23 juni 2025 · 14 min
No cryptographic system is immune to attack, and CISSPs must understand the methods used to break or weaken them. In this episode, we explore cryptanalysis techniques including brute-force, dictionary attacks, chosen plaintext attacks, and side-channel analysis. We explain how poor implementation, weak keys, and outdated algorithms create vulnerabilities, and how to mitigate those risks through proper design and monitoring. Understanding these threats enables security professionals to assess crypto deployments with a critical eye and defend against evolving attack strategies. Lees meer
-
Episode 48: PKI, Digital Certificates, and Trust Models
23 juni 2025 · 13 min
Public Key Infrastructure (PKI) is essential for enabling secure communication and verifying digital identities. This episode breaks down how PKI works, including the roles of certificate authorities (CAs), registration authorities (RAs), and digital certificates. You’ll learn about certificate chaining, revocation, validation protocols like OCSP and CRL, and how trust is established in both hierarchical and web-of-trust models. From SSL/TLS to code signing and user authentication, PKI is everywhere—and CISSPs need to know how to deploy and troubleshoot it securely. Lees meer
-
Episode 47: Key Management and Key Escrow
23 juni 2025 · 15 min
Cryptographic systems are only as secure as the keys they use—and how those keys are managed. In this episode, we delve into key management principles, including generation, storage, distribution, rotation, and destruction. We also explore key escrow, where a third party securely stores encryption keys for legal or recovery purposes. You’ll learn about hardware security modules (HSMs), key management systems (KMS), and the challenges of managing keys in cloud environments. Whether protecting secrets or ensuring regulatory compliance, strong key management is non-negotiable for any CISSP. Lees meer
-
Episode 46: Hashing and Message Integrity
23 juni 2025 · 13 min
Hashing ensures that data remains unchanged during storage or transmission—a core requirement for integrity. In this episode, we explore how cryptographic hash functions like SHA-256 and SHA-3 are used to detect tampering, generate digital signatures, and verify file authenticity. We discuss key properties such as collision resistance, pre-image resistance, and determinism. You'll also learn the difference between hashing and encryption, and how tools like checksums, MACs, and digital signatures work together to protect data. This is foundational knowledge for building secure applications and validating system outputs. Lees meer
-
Episode 45: Cryptographic Lifecycle: Algorithms, Strength, Obsolescence
23 juni 2025 · 15 min
Cryptographic tools aren’t set-and-forget solutions—they require lifecycle management. This episode explores how organizations select, deploy, and eventually retire cryptographic algorithms. We examine how algorithm strength is determined, the impact of key length, and the risks posed by deprecated or broken ciphers like MD5 and SHA-1. You’ll learn how to stay ahead of threats by monitoring crypto standards and planning for migration to newer algorithms. From algorithm selection to end-of-life planning, this topic helps CISSPs build cryptographic systems that remain secure over time. Lees meer
-
Episode 44: Cryptographic Concepts: Symmetric and Asymmetric
23 juni 2025 · 12 min
Cryptography is the backbone of digital security, and understanding its core principles is essential. In this episode, we explain the difference between symmetric and asymmetric encryption, along with their real-world applications. You’ll learn how symmetric encryption uses a single key for both encryption and decryption, while asymmetric encryption relies on key pairs for secure key exchange, digital signatures, and more. We also discuss algorithm examples like AES, RSA, and ECC. Grasping these concepts enables you to evaluate the strength, use cases, and implementation considerations of cryptographic solutions. Lees meer
-
Episode 43: Common Security Flaws in Architecture
23 juni 2025 · 12 min
Flawed architecture is one of the most serious vulnerabilities in any system. In this episode, we explore common architectural security weaknesses, including insecure defaults, lack of isolation, poor trust boundaries, and insufficient input validation. We explain how these flaws emerge during design and how they can be exploited by attackers. You’ll also learn how to apply secure design principles to avoid introducing systemic weaknesses in new systems. Whether you're evaluating an existing architecture or designing one from scratch, recognizing and addressing architectural flaws is a must-have skill for CISSPs. Lees meer
-
Episode 42: Secure Baseline and Configuration Management
23 juni 2025 · 15 min
Systems don’t stay secure by accident—they stay secure through consistent configuration and control. In this episode, we cover the concepts of secure baselining and configuration management. You’ll learn how to establish security baselines, enforce configuration standards, and use automation tools to detect and remediate drift. We also discuss patching, change control, and the role of configuration management databases (CMDBs). These practices ensure your systems remain hardened, predictable, and auditable—critical for minimizing attack surfaces, meeting compliance obligations, and maintaining operational stability. Lees meer