Send us Fan Mail CISSP Domain 3.9 — design site and facility security controls, built on a real data center power failure where every control in the building worked and the building still went dark. Start free: https://www.cisspcybertraining.com/free-cissp-self-study (360 practice questions, a Domain 1 diagnostic, weekly questions by email, and the slides from this episode) In October, a cloud provider's London data center lost its utility power. The batteries picked up the load exactly th...
Nov 9
43 min
Send us Fan Mail CISSP Domain 2.6 — data security controls, compliance requirements, and the three states of data, built on an AI hosting exposure that encryption could never have reached, because the data was exposed while it was being used. Start free: https://www.cisspcybertraining.com/free-cissp-self-study (360 practice questions, a Domain 1 diagnostic, weekly questions by email, and the slides from this episode) One hundred and fifty-five answers went to the wrong people. Nobody broke in...
Nov 2
43 min
Send us Fan Mail A company found a concealed recording device in the room where its executives meet. They pulled it, imaged it, reviewed the camera footage, went through the employee's internal tool usage, found a second device in a bag he had left in another room, terminated him and referred the matter to the FBI. Every one of those steps was reasonable. And somewhere in the middle of that list, the investigation stopped being theirs. This episode is CISSP Domain 1.6 — requirements for inves...
Oct 26
41 min
Send us Fan Mail A “boring” GitHub Actions workflow file should never be able to empty your secrets vault, yet that is exactly what the Ghost Action campaign shows. We walk through GitGuardian’s research and the real mechanics of how attackers use stolen but valid developer tokens to add or modify workflow YAML, scrape secret names from your own repo, and exfiltrate CI/CD secrets to an external endpoint. The scary part is not exotic malware, it is normal automation doing what it was designed ...
Oct 19
49 min
Send us Fan Mail 495 organizations woke up and could not get to their servers. Railways. A prefectural police force. A food logistics company that could not receive or ship goods. All on the same cloud provider, all locked out at once. Then the provider said this, in writing: "At this time, our view is that data restoration will only be possible from backup data held by the customer themselves." Read that again. You are getting your data back from your own backups — and for some...
Oct 12
38 min
Send us Fan Mail An AI agent gets blocked by access controls, then calmly finds another way in anyway and that is the wake-up call. I use a recent Hacker News story about an automated agent bypassing an Australian government health portal to dig into what CISSP Domain 6.2 is really testing: not your ability to recite a list of techniques, but your ability to manage authorization, scope, and rules of engagement so a “test” does not turn into an intrusion. We break down why the portal controls...
Oct 5
37 min
Send us Fan Mail A stolen password is annoying. A stolen session token can be invisible, valid, and instantly profitable. Today we dig into a real warning sign from Okta threat intelligence: infostealer malware lifted live session tokens from browsers, and thousands of Google sessions were still working weeks later. No MFA prompt. No brute force. Just a legitimate session replayed by the wrong person, with real dollar damage through unauthorized usage and credits. We use that story to sharpe...
Sep 28
32 min
Send us Fan Mail One video hotline feels like a single, simple conversation until you trace the call path and realise there may be seven companies involved in making it work. That’s the spark for this training-focused breakdown of CISSP Domain 4.3 secure communication channels, using the viral AI “actress hotline” story to show how modern voice and video collaboration really behaves behind the curtain. We start with a practical analogy: you think you’re transacting with the waiter, but your ...
Sep 21
30 min
Send us Fan Mail A compliance deadline can change your security posture without changing a single bit of your encryption. We start with a simple sticker-on-the-windshield analogy that maps directly to what’s happening with FIPS 140 validations: your VPN can keep encrypting, your database can keep protecting data, and yet an assessor can still mark you down because “working” is not the same as “validated.” We walk through the practical CISSP Domain 3 lesson behind the noise: the difference be...
Sep 14
38 min
Send us Fan Mail 🔁 REPLAY — this episode originally aired as CCT 278 in September 2025. I'm heads-down finishing a Domain 3 cryptography episode, so I'm re-running one of the strongest episodes in the archive rather than shipping something thin. If you're newer to the show, you haven't heard this one. And if you're studying Domain 3 right now the timing works in your favor — security models are the foundation the rest of the domain sits on, and next week's episode picks up in the same domai...
Sep 7
31 min
Load more