Certified: The CISSP Audio Course

Virtualization and cloud computing are cornerstones of modern IT, but they also introduce unique security challenges. In this episode, we examine the architecture and risks associated with virtual machines, hypervisors, containers, and cloud platforms. You’ll learn how virtual environments increase complexity and expand the attack surface, and what controls are necessary to mitigate these risks. W...

Security isn’t only about software—hardware matters too. This episode introduces key elements of secure hardware architecture, including trusted computing bases, secure boot processes, and hardware root of trust. We also dive into the Trusted Platform Module (TPM), a hardware chip that provides cryptographic key storage, platform integrity checks, and secure identity verification. You’ll learn how...

Security must be applied across all layers of a system, from the physical infrastructure to the application interface. In this episode, we explore the layered nature of system architecture—starting with the OSI model’s seven layers, then expanding into how security is applied at the hardware, system, and application levels. You’ll learn how to align controls with each layer’s function, recognize c...

Security models are theoretical frameworks that help define how systems enforce access control, integrity, and confidentiality. In this episode, we review the three classic models: Bell-LaPadula (focused on confidentiality), Biba (focused on integrity), and Clark-Wilson (focused on well-formed transactions and separation of duties). We explain the core rules behind each model—like “no read up” and...

Designing secure systems isn’t just about applying tools—it’s about embedding principles. This episode introduces two foundational security design concepts: defense in depth and least privilege. Defense in depth layers multiple controls to prevent, detect, and contain threats, while least privilege ensures users and systems operate with the minimum access necessary. We explain how these principles...

Without visibility, security is just guesswork. In this episode, we explore how logging and monitoring give security teams the information they need to detect, investigate, and respond to incidents. We discuss log types (system, application, network), retention policies, log integrity, and secure storage. Metadata, such as timestamps, source IPs, and user actions, adds context to every alert and e...

Some systems and data are too critical to treat like everything else. This episode focuses on how organizations identify, secure, and manage sensitive systems and high-value assets (HVAs), such as financial databases, intellectual property repositories, and industrial control systems. We discuss segmentation, access control, system hardening, monitoring, and tailored incident response plans for th...

Backup and recovery plans are your insurance against data loss. In this episode, we explore the critical controls necessary to ensure backups are available, secure, and usable when needed. We discuss types of backups (full, incremental, differential), retention policies, storage locations (on-site vs. off-site), and encryption strategies. You’ll also learn about recovery objectives like RTO (Recov...

Cloud services offer scalability and convenience, but they also introduce unique security risks—especially when sharing infrastructure with other tenants. In this episode, we cover best practices for securely using cloud storage, virtualized environments, and shared computing platforms. Topics include encryption, access control, tenant isolation, identity federation, and logging. We also discuss t...

In a global digital economy, where your data resides can determine which laws apply to it. This episode explains data sovereignty—the principle that data is subject to the laws of the country in which it’s stored—and how jurisdictional control affects compliance, privacy, and access. We examine common challenges organizations face when storing or processing data across borders, such as conflicting...

You can’t protect what you don’t know you have. In this episode, we focus on the importance of maintaining a comprehensive and accurate inventory of all information assets—hardware, software, data, and even personnel. Asset inventory management supports effective risk assessments, helps identify gaps in coverage, and is a foundational requirement for many compliance standards. We explore asset cla...

Digital media—whether it’s a hard drive, USB stick, or backup tape—requires special handling to ensure data remains protected throughout its lifecycle. This episode explores how to securely store, track, and sanitize various types of storage media. We discuss media classification, physical protections, encryption, and environmental controls for storage, as well as different sanitization techniques...

Data is constantly on the move—or waiting to be accessed—and must be protected in both states. In this episode, we examine the best practices for securing data at rest (stored on disk or cloud) and data in transit (moving across networks). You'll learn about encryption methods, key management practices, access controls, and monitoring techniques. We also address compliance requirements that demand...

Even when you delete a file, remnants can linger—posing serious security risks. This episode delves into the concept of data remanence and the techniques used to ensure secure data disposal. You'll learn about data wiping, degaussing, shredding, cryptographic erasure, and the standards that guide their use, such as NIST SP 800-88. We also cover the importance of disposal audits, chain of custody f...

Personally Identifiable Information (PII) is one of the most regulated and targeted types of data in cybersecurity. This episode focuses on how organizations identify, handle, and protect PII throughout its lifecycle. We explain what qualifies as PII, the risks associated with its misuse, and the controls needed to ensure confidentiality, integrity, and lawful processing. From consent management a...

Keeping data longer than necessary can increase your risk exposure, but disposing of it too early can create legal and operational gaps. This episode addresses how to build effective data retention and archival strategies that meet legal, regulatory, and business needs. You’ll learn how to define retention periods, implement secure storage solutions for inactive data, and manage transitions into a...

Every piece of information in an organization should have an assigned owner and one or more stewards. In this episode, we define what it means to be a data owner—someone accountable for the data’s use, classification, and protection. We also explore the role of stewards—those responsible for managing data quality and integrity on a day-to-day basis. Clarifying these roles strengthens governance, s...

Labeling data according to its sensitivity is one of the most overlooked but powerful techniques in cybersecurity. In this episode, we explore what it means for data to be considered sensitive, how that sensitivity is determined, and how labels communicate handling requirements to users and systems. We also cover how to implement labeling technologies and ensure compliance with both organizational...

Understanding how data flows through its lifecycle is essential for protecting it appropriately. This episode walks through the phases of the information lifecycle: creation, storage, usage, transmission, archival, and disposal. We then examine data classification schemes—such as public, internal, confidential, and restricted—and how classification drives the application of controls. You'll learn...

Effective security governance depends on clear documentation and measurable performance. This episode explains the structure and function of security documentation—including policies, standards, guidelines, and procedures—as well as how to manage these documents over time. We also explore key performance indicators (KPIs) and metrics used to assess the effectiveness of security controls and govern...

Cybersecurity professionals operate in a legal landscape that spans continents, jurisdictions, and regulatory systems. In this episode, we examine the major types of legal systems—common law, civil law, religious law, and customary law—and how each influences how cybersecurity is enforced. We also explore global cybercrime laws and treaties, including the Budapest Convention, and review how intern...

Cybersecurity professionals must understand how to protect not only data but also intellectual property. This episode unpacks the key types of intellectual property—copyrights, trademarks, patents, and trade secrets—and how they apply in the digital world. We also examine licensing models for software and content, including open-source and proprietary agreements. Understanding the legal landscape...

Protecting personal data is not just a compliance requirement—it’s a trust imperative. In this episode, we dive into key privacy principles such as data minimization, purpose limitation, and transparency. You’ll learn how regulations like the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) define privacy obligations and empower individuals with rights over...

Supply chains extend far beyond traditional logistics—they now include digital components, cloud providers, software dependencies, and more. This episode explores how cyber threats enter through the supply chain and what due diligence processes are needed to prevent compromise. We discuss methods for evaluating supply chain partners, setting clear security expectations, and responding to incidents...

Today’s organizations rely heavily on vendors, contractors, and service providers—but each relationship introduces potential risks. In this episode, we cover the principles of third-party risk management, including due diligence, contractual controls, and ongoing monitoring. You’ll learn how to assess a vendor’s security posture, enforce security requirements through service-level agreements (SLAs...