Home Podcasts CISSP Cyber Training Podcast - CISSP Training Program
CISSP Cyber Training Podcast - CISSP Training Program

CISSP Cyber Training Podcast - CISSP Training Program

Shon Gerber, vCISO, CISSP, Cybersecurity Consultant and Entrepreneur 360 Episodes Oct 12, 2026

Join Shon Gerber on his weekly CISSP Cyber Training podcast, where his extensive 23-year background in cybersecurity shines through. With a rich history spanning corporate sectors, government roles, and academic positions, Shon imparts the essential insights and advice necessary to conquer the CISSP exam. His expertise is not just theoretical; as a CISSP credential holder since 2009, Shon translates his deep understanding into actionable training. Each episode is packed with invaluable security strategies and tips that you can implement right away, giving you an edge in the cybersecurity realm.

Episodes

CCT 374: They Had Backups, They Could Not Reach Them. (CISSP Domain 7.10)
CCT 374: They Had Backups, They Could Not Reach Them. (CISSP Domain 7.10) Oct 12, 2026 2291 Send us Fan Mail495 organizations woke up and could not get to their servers. Railways. A prefectural police force. A food logistics company that could not receive or ship goods. All on the same cloud provider, all locked out at once. Then the provider said this, in writing: "At this time, our view is that data restoration will only be possible from backup data held by the customer themselves
CCT 373: An AI Agent Was Told No and Got In Anyway (CISSP Domain 6.2)
CCT 373: An AI Agent Was Told No and Got In Anyway (CISSP Domain 6.2) Oct 5, 2026 2248 Send us Fan MailAn AI agent gets blocked by access controls, then calmly finds another way in anyway and that is the wake-up call. I use a recent Hacker News story about an automated agent bypassing an Australian government health portal to dig into what CISSP Domain 6.2 is really testing: not your ability to recite a list of techniques, but your ability to manage authorization, scope, and rules o
CCT 372: Stolen Sessions and Why MFA Never Saw Them (CISSP Domain 5.6)
CCT 372: Stolen Sessions and Why MFA Never Saw Them (CISSP Domain 5.6) Sep 28, 2026 1978 Send us Fan MailA stolen password is annoying. A stolen session token can be invisible, valid, and instantly profitable. Today we dig into a real warning sign from Okta threat intelligence: infostealer malware lifted live session tokens from browsers, and thousands of Google sessions were still working weeks later. No MFA prompt. No brute force. Just a legitimate session replayed by the wrong pers
CCT 371: Secure Communication Channels and Who Is Really On Your Call (Domain 4.3)
CCT 371: Secure Communication Channels and Who Is Really On Your Call (Domain 4.3) Sep 21, 2026 1820 Send us Fan MailOne video hotline feels like a single, simple conversation until you trace the call path and realise there may be seven companies involved in making it work. That’s the spark for this training-focused breakdown of CISSP Domain 4.3 secure communication channels, using the viral AI “actress hotline” story to show how modern voice and video collaboration really behaves behind the curt
CCT 370: CISSP Cryptography, FIPS Validation, and Post-Quantum (Domain 3)
CCT 370: CISSP Cryptography, FIPS Validation, and Post-Quantum (Domain 3) Sep 14, 2026 2312 Send us Fan MailA compliance deadline can change your security posture without changing a single bit of your encryption. We start with a simple sticker-on-the-windshield analogy that maps directly to what’s happening with FIPS 140 validations: your VPN can keep encrypting, your database can keep protecting data, and yet an assessor can still mark you down because “working” is not the same as “vali
CCT 369: Security Models Demystified - CISSP Domain 3.2 (Replay of CCT 278)
CCT 369: Security Models Demystified - CISSP Domain 3.2 (Replay of CCT 278) Sep 7, 2026 1906 Send us Fan Mail🔁 REPLAY — this episode originally aired as CCT 278 in September 2025.I'm heads-down finishing a Domain 3 cryptography episode, so I'm re-running oneof the strongest episodes in the archive rather than shipping something thin.If you're newer to the show, you haven't heard this one. And if you're studyingDomain 3 right now the timing works in your favor — se
CCT 368: CISSP Asset Security and Data Classification (Domain 2)
CCT 368: CISSP Asset Security and Data Classification (Domain 2) Aug 31, 2026 2576 Send us Fan MailNine million images. No password. No encryption. And the defence was basically: “It wasn’t public because you had to know the URL.” That single line opens up one of the most important CISSP Domain 2 conversations you can have: security through obscurity is not access control, and a hidden address is not a key. We take this real data exposure and translate it into the kind of manage
CCT 367: Threat Modeling and the AI Agent That Breached Hugging Face (CISSP Domain 1.10)
CCT 367: Threat Modeling and the AI Agent That Breached Hugging Face (CISSP Domain 1.10) Aug 24, 2026 2572 Send us Fan MailA rogue AI agent didn’t “hack the future” so much as exploit the oldest security problems in the book: weak boundaries, over-trusted inputs, exposed endpoints, and credentials lying around. We walk through the Hugging Face intrusion story like a CISO briefing a board, step by step, translating a fast-moving AI-red-team narrative into the kind of clear threat modeling logic you need
CCT 366: Software Supply Chain Security Explained — CISSP Domain 8 (ChainDrop Case Study)
CCT 366: Software Supply Chain Security Explained — CISSP Domain 8 (ChainDrop Case Study) Aug 17, 2026 1984 Send us Fan MailA supply chain attack that leaves your Git history spotless should change how you think about “secure code.” We walk through ChainDrop, a worm discovered in the NPM ecosystem that poisoned 444 packages while evading the places defenders usually look. The unnerving twist is that it can trigger without a classic npm install and can hide in the space between your repository and the pa
CCT 365: Malicious QR Code Attacks and Digital Forensics Techniques Every CISSP Should Know [REPLAY]
CCT 365: Malicious QR Code Attacks and Digital Forensics Techniques Every CISSP Should Know [REPLAY] Aug 10, 2026 1505 Send us Fan MailOne careless QR scan can quietly turn a “private” chat into a live wiretap. We start with a timely threat story: Russian APT-style actors abusing Signal’s linked device flow by pushing phishing links that contain malicious QR codes, so messages can be mirrored to an attacker device in real time. If you use Signal, WhatsApp, or Telegram at work, this is the kind of simple, human-tri
CCT 364: Third Party Risk Management - How One Vendor Breach Exposed 119,000 Users
CCT 364: Third Party Risk Management - How One Vendor Breach Exposed 119,000 Users Aug 3, 2026 2768 Send us Fan MailA breach can hit your headlines even when your own systems never get touched, and that’s exactly why third-party risk management keeps showing up on the CISSP exam and in real incident reports. We walk through the Vimeo breach tied to its analytics vendor Anodot, where compromised vendor access and authentication tokens gave attackers a clean path to customer data. No video content
CCT 363: CISSP AI Governance - What Credit Union Examiners Are Really Asking
CCT 363: CISSP AI Governance - What Credit Union Examiners Are Really Asking Jul 27, 2026 2685 Send us Fan MailOne bad AI decision can cost you more than money. It can cost you trust, trigger regulators overnight, and put your name on the hook when the board asks, “Who approved this?” We dig into AI governance through a CISSP lens, using real-world banking and credit union scenarios that show how fast things go sideways when AI tools slip outside your controls.We start with the uncomfortabl

Recommended