Certified: The CompTIA Security+ Audio Course

Encryption is the most widely used method for ensuring data confidentiality, but its implementation must be tailored to the context in which data exists. In this episode, we break down the many forms of encryption, including full-disk, partition, file, volume, and record-level encryption, explaining when and why each is used. We explore symmetric encryption—fast and efficient for large data sets—a...

Cryptography is the bedrock of secure communication, and understanding its principles is essential for every cybersecurity professional. In this episode, we introduce core cryptographic concepts including confidentiality, integrity, non-repudiation, and authenticity, and how these are enabled through mathematical transformations of data. We focus especially on Public Key Infrastructure (PKI), whic...

Documentation is the connective tissue that holds a secure environment together, enabling repeatability, accountability, and informed decision-making across teams and time. In this episode, we explore the crucial role documentation plays in cybersecurity—from network diagrams and policy manuals to change logs and incident response plans. When systems fail or incidents occur, having current and acc...

Change at the technical level affects more than just configurations—it can ripple through applications, dependencies, and user experiences in complex and unexpected ways. In this episode, we dive into the technical implications of change management, such as the use of allow lists and deny lists, the handling of restricted activities, and managing service restarts or downtimes associated with legac...

A successful change doesn’t end with approval—it must be implemented carefully and maintained with consistency. In this episode, we cover critical operational elements of change management, including pre-deployment testing, interpreting test results, executing backout plans, and scheduling changes during defined maintenance windows. Testing validates whether changes function as intended and identi...

Security is not just a technical concern—it’s deeply intertwined with business processes, especially when it comes to change management. In this episode, we examine key business elements that drive secure change: the approval process, stakeholder roles, ownership, and impact analysis. Every change—whether it's a patch, a network update, or a new vendor integration—should be evaluated for how it af...

Change is inevitable in IT environments, but without structure, even small adjustments can introduce security gaps or operational disruptions. This episode introduces change management as a formalized process for planning, approving, documenting, and verifying changes to systems, configurations, and policies. We discuss why change management is essential to cybersecurity—it ensures that changes ar...

Deception technologies play a unique and powerful role in cybersecurity by proactively misleading, confusing, or delaying attackers while providing valuable insight into their methods and intentions. In this episode, we explore tools such as honeypots, which simulate vulnerable systems; honeynets, which create entire decoy network environments; and honeytokens, which are fake credentials or files...

Physical security remains a vital—if sometimes overlooked—component of cybersecurity, especially when protecting facilities, data centers, and physical access points. In this episode, we explore the essential elements of physical security, including barriers like bollards and fencing, access mechanisms such as badge readers and mantraps, and detection systems like video surveillance, infrared moti...

Security programs are only as strong as their weakest uncovered areas—and that’s where gap analysis and Zero Trust come into play. This episode introduces gap analysis as a structured approach to identifying where an organization’s current security posture fails to meet expected or required standards, often using frameworks like NIST or ISO to benchmark practices. We discuss how gap analysis invol...

Cybersecurity is not only about prevention—it’s also about proof, accountability, and enforcement. In this episode, we examine non-repudiation and the AAA model—Authentication, Authorization, and Accounting—as cornerstones of digital trust. Non-repudiation ensures that users cannot deny actions they’ve taken, supported by mechanisms such as digital signatures, system logging, and secure timestamps...

The CIA Triad—Confidentiality, Integrity, and Availability—forms the foundational model upon which nearly all cybersecurity principles and practices are built. In this episode, we explore each pillar of the triad in detail, beginning with confidentiality, which ensures that sensitive data is accessible only to authorized individuals through controls like encryption, access management, and classifi...

Compensating and directive controls often serve as the bridge between policy and practice, offering essential flexibility and guidance in environments where standard controls may not be viable. This episode explains compensating controls as alternative safeguards—deployed when ideal solutions, such as specific encryption technologies or access enforcement mechanisms, are not available due to techn...

In the second half of our discussion on control types, we explore detective, corrective, compensating, and directive controls—each of which plays a crucial role in identifying and responding to security incidents. Detective controls, such as intrusion detection systems and log monitoring, help uncover ongoing or completed attacks, while corrective controls like system patches or incident response...

Security controls are not only categorized by function, but also by the role they play in the security lifecycle—specifically, whether they are preventive, deterrent, detective, corrective, compensating, or directive. In this first part of a two-part breakdown, we focus on preventive and deterrent controls. Preventive controls are designed to stop threats before they occur, such as through encrypt...

While cybersecurity often emphasizes digital threats, physical security controls are just as vital, forming the first line of defense against unauthorized access to systems, data centers, and critical infrastructure. This episode explores physical security measures such as access control vestibules, security guards, fencing, bollards, surveillance systems, and lighting—all designed to deter, detec...

Security controls can be grouped into several major categories—technical, managerial, and operational—each playing a distinct but complementary role in securing modern enterprise environments. This episode takes a deeper dive into these categories, explaining how technical controls like firewalls and encryption mechanisms enforce security at the system level, while managerial controls such as poli...

Security controls are the foundation of every cybersecurity strategy, providing the rules, tools, and enforcement mechanisms that protect data, systems, and operations from internal and external threats. In this episode, we introduce the concept of security controls and explain their importance in reducing risk, enforcing compliance, and maintaining the overall security posture of an organization....

Domain One sets the tone for the entire Security+ exam, introducing key cybersecurity principles like confidentiality, integrity, and availability. This episode breaks down control types, the CIA triad, authentication models, and concepts like Zero Trust and AAA. You'll also explore the different categories of security controls and see how foundational thinking supports higher-level problem solvin...

Exam day can be nerve-wracking, but this episode prepares you for everything you’ll face—from check-in to the final click of the mouse. We walk through the logistics of both online and in-person testing environments, what documents you’ll need, and how to handle performance-based questions without panicking. You’ll learn pacing techniques and how to interpret result feedback so you know what comes...

In this episode, we tackle the biggest early challenge: how to study for the Security+ exam effectively. We'll guide you through building a realistic, sustainable study plan that adapts to your personal schedule and learning style. From resource selection—books, video courses, flashcards, and labs—to balancing reading, review, and hands-on practice, this episode helps you cut through the noise and...

Understanding the structure of the SY0-701 exam is crucial before you dive into study mode. This episode provides a domain-by-domain walkthrough of the Security+ certification exam layout. We break down the five main domains, explaining the weight each one holds and what it means for your study priorities. From general concepts to security program management, this overview helps you understand not...

This episode kicks off the Certify – Security Plus podcast series by introducing the CompTIA Security+ certification. You’ll learn what this credential is, why it's such a popular choice for cybersecurity beginners, and what makes it a foundational part of many career paths. Whether you're a student, a career switcher, or someone trying to understand where to begin in cybersecurity, this episode l...