Certified: SANS GIAC GSEC Audio Course

This episode explains why key management is the real security boundary behind most cryptographic controls, and why GSEC questions often reward answers that protect keys rather than swapping algorithms. You’ll define key storage options and their risk tradeoffs, including software keystores, HSM-backed protection, TPM-bound keys, and secrets managers, then connect those choices to threats like thef...

This episode explains hashing as a tool for integrity and secure comparison, and it aligns to GSEC questions that probe whether you understand what hashes can and cannot do. You’ll define a digest as a fixed-length output derived from input data, then explain why hashes detect changes but do not provide confidentiality or identity by themselves. We’ll cover salts as a defense against precomputatio...

This episode covers asymmetric cryptography as the foundation for modern trust and secure exchange, and it targets the GSEC requirement that you understand how keypairs solve problems symmetric crypto cannot solve alone. You’ll define public and private keys, then explain confidentiality use cases like encrypting to a recipient’s public key and authenticity use cases like signing with a private ke...

This episode explains symmetric cryptography in a way that supports both exam answers and real implementation decisions, focusing on what symmetric encryption is good at and how it fails when used incorrectly. You’ll define symmetric encryption as using the same secret key for encryption and decryption, then connect that to why it is fast and commonly used for bulk data, VPN tunnels, and storage e...

This episode establishes the core goals of cryptography and shows how GSEC questions often test whether you can match a security objective to the correct cryptographic mechanism. You’ll define confidentiality as preventing unauthorized disclosure, integrity as detecting unauthorized modification, authenticity as proving identity or origin, and non-repudiation as preventing a signer from credibly d...

This episode explains application execution control as a direct defense against malware and living-off-the-land abuse, and it targets GSEC scenarios where attackers succeed because “anything can run.” You’ll define allowlisting as permitting only approved executables, libraries, or publishers, then connect it to practical realities like software updates, admin tooling, and the operational friction...

This episode builds a practical approach to endpoint telemetry and explains why the GSEC exam expects you to distinguish between “we have logs” and “we can investigate.” You’ll learn what high-value endpoint signals look like, such as authentication events, process creation, command execution, network connections, privilege changes, persistence modifications, and security control status. We’ll con...

This episode focuses on endpoint hardening as a repeatable process that reduces attack surface and improves resilience, which aligns to GSEC questions that ask for the highest-impact control change. You’ll define a baseline as an approved, testable configuration state and connect it to secure defaults, service reduction, and consistent settings across fleets. We’ll explain patch discipline as both...

This episode clarifies what endpoint security controls actually do on a host and why GSEC questions often test whether you can pick the right endpoint control for the objective, not just name a product category. You’ll define endpoint firewalls as host-based traffic enforcement, HIDS as detection through monitoring logs, files, and behaviors, and HIPS as prevention that can block actions based on...

This episode teaches sensor placement as a design decision that shapes what you can prove during an investigation, which is a common GSEC theme hidden inside “why didn’t we see it” questions. You’ll learn how visibility changes at endpoints, network chokepoints, cloud control planes, identity providers, DNS resolvers, and email gateways, and why no single location covers everything. We’ll address...

This episode explains how detection really works in practice and why the GSEC exam expects you to understand the strengths and limits of signature-based and anomaly-based approaches. You’ll define signatures as known patterns tied to specific behaviors or artifacts, and anomalies as deviations from expected baselines that can indicate new or stealthy activity. We’ll connect those ideas to alert qu...

This episode explains stateful inspection as the mechanism that lets many firewalls enforce policy based on connection context, which is a common GSEC concept embedded in questions about allowed return traffic, asymmetric routing, and protocol behavior. You’ll define a state table as tracked session metadata, then connect it to why established connections can be permitted without opening broad inb...

This episode teaches firewall rule quality as a discipline that directly affects both security and availability, and it targets GSEC scenarios where the “most secure” answer is also the most maintainable and auditable. You’ll review the logic of default-deny and explicit allow rules, then learn how rule ordering, scope, and object grouping affect correctness over time. We’ll discuss why exceptions...

This episode clarifies what core network security devices do, what they do not do, and how GSEC questions often test whether you can choose the right device for the right objective. You’ll define firewalls as policy enforcement for traffic flows, NIDS as detection through observation, and NIPS as inline prevention that can block or disrupt traffic when confident rules match. We’ll explore practica...

This episode covers secure remote administration patterns and explains why GSEC often treats management access as a separate risk domain from user access. You’ll define jump hosts and bastions as controlled entry points for administrative sessions, then connect them to strong authentication, session recording, and reduced attack surface by limiting where admin tools can run. We’ll describe managem...

This episode explains why many defenses fail after the first compromise and how to design networks so attackers cannot move freely or exfiltrate quietly, a frequent GSEC scenario pattern. You’ll define egress control as limiting outbound destinations and protocols, then connect it to controlling command-and-control, preventing malware downloads, and making data theft harder. We’ll discuss chokepoi...

This episode teaches monitoring as an architectural decision, not a tool purchase, which aligns with GSEC questions that test where visibility should be placed to detect real threats reliably. You’ll define “signal” as evidence of behavior that can be validated and acted on, then explore collection points such as endpoints, identity systems, DNS, proxies, email gateways, and key network chokepoint...

This episode explains network zoning and segmentation as a way to control blast radius and enforce policy, and it targets the GSEC skill of selecting architectures that reduce risk even when endpoints fail. You’ll define zones as areas with distinct trust levels and control requirements, then connect segmentation to enforcement points like firewalls, ACLs, and security groups that make “should not...

This episode focuses on the exposure mistakes that show up constantly in real incidents and frequently in GSEC questions that ask why an internal system became reachable from the internet. You’ll define NAT as address translation and clarify how it differs from security, then examine port forwarding as an explicit exposure decision that can bypass intended controls if it is undocumented or unmanag...

This episode builds a clean, exam-ready understanding of how HTTP works and why web mechanics are a security topic, not just a developer concern. You’ll review common methods like GET and POST, then connect method choice and idempotence to risks such as unintended state changes, caching mistakes, and insecure endpoints. We’ll break down headers that shape security posture, including Host, Authoriz...

This episode explains the core email protocols in practical terms and ties them to common GSEC exam scenarios involving credential theft, spoofing, and misconfiguration. You’ll contrast SMTP as the sending and relay mechanism with IMAP and POP as retrieval methods, then connect the differences to how security controls are applied at servers, gateways, and endpoints. We’ll cover how attackers explo...

This episode covers DHCP as an essential service that can quietly determine where systems route, which DNS servers they trust, and what networks they believe they are on, making it a practical target and a common GSEC exam topic in network fundamentals and spoofing scenarios. You’ll define how DHCP leases supply addressing, gateway, and resolver settings, then connect that to threats like rogue DH...

This episode explains DNS as a trust dependency that security teams often forget until it breaks, and it aligns to GSEC questions that test how name resolution can redirect users, services, and updates to attacker-controlled destinations. You’ll review the role of recursive resolvers, authoritative servers, and caching, then connect those mechanics to threats like spoofed responses, cache poisonin...

This episode covers ARP in IPv4 and Neighbor Discovery in IPv6 as local network mechanisms that can become attack surfaces when trust is assumed rather than enforced, a pattern that appears in GSEC questions about spoofing and man-in-the-middle risk. You’ll define how a host maps an IP address to a link-layer address for local delivery, then explain why that mapping can be poisoned when an attacke...

This episode explains IP addressing and routing as the foundation for segmentation, access control, and incident scoping, which are all common GSEC themes. You’ll review how IP addresses, subnets, and routing tables determine reachability, then connect those mechanics to security decisions like where to place a firewall rule, which network should be isolated, and how to interpret logs that show so...