Certified: The CISSP Audio Course
This audio course is designed to help cybersecurity professionals master the CISSP certification. It covers the eight domains of the CISSP Common Body of Knowledge with clear, structured lessons. Each episode provides real-world context and exam-focused explanations. The course is intended for study anytime, anywhere, such as during commutes or exercise.
Episodes
Episode 1: What Is the CISSP and Why It Matters
In this foundational episode, we introduce the Certified Information Systems Security Professional—better known as the CISSP. You’ll learn what the certification represents, who it’s designed for, and why it continues to be considered the gold standard for cybersecurity professionals around the world. We explore how the CISSP stands apart from other security credentials, what it proves ab
Episode 2: CISSP vs. Other Certifications: Which One’s Right for You?
Choosing the right cybersecurity certification can shape your career for years to come. In this episode, we compare the CISSP to other well-known certifications including CompTIA Security+, CISM, CRISC, and CEH. We examine how these credentials differ in focus, experience level, and strategic alignment—helping you understand which path fits your background and goals. Whether you're lookin
Episode 3: Career Impact of the CISSP: Roles, Salaries, Growth
The CISSP isn’t just a certification—it’s a powerful career accelerator. This episode breaks down how earning your CISSP can open doors to high-level roles, raise your earning potential, and give you access to new leadership opportunities in the cybersecurity field. We cover the types of positions typically held by CISSP-certified professionals, explore industry data on salary trends, and
Episode 4: How to Study and Pass the CISSP Exam: Resources and Mindset
Success on the CISSP exam requires more than memorizing facts—it takes a strategy, the right materials, and a focused mindset. In this episode, we walk through the most effective ways to prepare for the test, from selecting the right books and practice exams to choosing between self-paced and instructor-led training. We also talk about managing study timelines, pacing your progress, and m
Episode 5: The CIA Triad: Confidentiality, Integrity, Availability
Every cybersecurity professional must understand the CIA triad—confidentiality, integrity, and availability. These three pillars form the core of nearly every security strategy, policy, and control. In this episode, we break down what each term means, how they apply to real-world environments, and why balancing them is critical to risk management. You’ll learn how breaches in confidential
Episode 6: Security Governance Principles: Frameworks and Strategy
Governance gives structure and direction to an organization’s cybersecurity efforts. In this episode, we explore what it means to build a security strategy aligned with business goals, risk appetite, and compliance obligations. You’ll learn about common governance frameworks such as NIST, ISO, and COBIT, and how they guide policy creation, control selection, and program management. We als
Episode 7: Compliance Requirements: Legal, Regulatory, Contractual
Cybersecurity professionals must navigate a complex landscape of compliance obligations. This episode explains the differences between legal, regulatory, and contractual requirements, and how they impact your organization’s security posture. From privacy laws like GDPR and CCPA to industry frameworks such as HIPAA, PCI-DSS, and SOX, we explore what it takes to build and maintain complianc
Episode 8: Organizational Roles and Responsibilities
Security is not the job of a single person or department—it’s a shared responsibility across the organization. In this episode, we examine the roles of executives, managers, security teams, end users, and third-party stakeholders in protecting assets and managing risk. You’ll learn about role-based access, segregation of duties, the function of a CISO, and the interplay between business u
Episode 9: Professional Ethics and (ISC)² Code of Ethics
Ethics are the backbone of trust in the cybersecurity profession. This episode explores the professional responsibilities outlined in the ISC² Code of Ethics, including the duty to protect society, act honorably, provide competent service, and advance the profession. We explain how these ethical canons apply to real-world decision-making and the consequences of ethical violations. As a CI
Episode 10: Risk Management Concepts: Threats, Vulnerabilities, Risk
Risk management is a cornerstone of cybersecurity, and this episode introduces the essential vocabulary and concepts you need to know. We define threats, vulnerabilities, likelihood, impact, and risk—and show how these elements interact in both assessments and real-world decision-making. You’ll also hear how organizations use risk tolerance and acceptance to prioritize controls and alloca
Episode 11: Risk Response and Risk Appetite
Once a risk is identified and assessed, the next critical step is determining how to respond. In this episode, we examine the four primary risk response strategies: risk avoidance, risk mitigation, risk transference, and risk acceptance. We also clarify the concepts of risk appetite and risk tolerance, and how organizations use these to shape their security policies and control decisions.
Episode 12: Business Continuity Planning (BCP) Fundamentals
Business Continuity Planning, or BCP, is essential for maintaining operations during unexpected disruptions. This episode explores the key elements of a successful BCP strategy, including risk identification, business impact analysis, and recovery planning. We discuss how organizations determine critical functions, establish recovery priorities, and ensure that people, systems, and proces
Episode 13: Disaster Recovery Planning (DRP) and Continuity of Operations
Disaster Recovery Planning is a focused component of business continuity that addresses the rapid restoration of IT infrastructure and systems. In this episode, we explore how DRP helps organizations bounce back after major incidents such as natural disasters, cyberattacks, or system failures. You'll learn about recovery time objectives (RTOs), recovery point objectives (RPOs), and differ
Episode 14: Security Policies, Standards, Procedures, and Guidelines
A strong cybersecurity program is built on clear and well-documented policies. In this episode, we break down the four foundational types of documentation: policies, standards, procedures, and guidelines. You'll learn how each plays a role in setting expectations, enforcing controls, and guiding behavior. We also explain who creates these documents, how they’re maintained, and why they ma
Episode 15: Personnel Security: Background Checks, Policies, Termination
People are often the weakest link in cybersecurity, and managing personnel risk is a critical responsibility. In this episode, we discuss best practices for pre-employment screening, including background checks and reference validation. We also explore how organizations use security policies to govern employee behavior and set expectations for acceptable use, confidentiality, and complian
Episode 16: Security Awareness and Training Programs
Even the best technical defenses can fail if employees don’t understand their security responsibilities. This episode focuses on the development and delivery of effective security awareness and training programs. We explore how to tailor content for different roles, choose the right delivery formats, and measure effectiveness through assessments and behavioral monitoring. You’ll also lear
Episode 17: Third-Party Risk Management
Today’s organizations rely heavily on vendors, contractors, and service providers—but each relationship introduces potential risks. In this episode, we cover the principles of third-party risk management, including due diligence, contractual controls, and ongoing monitoring. You’ll learn how to assess a vendor’s security posture, enforce security requirements through service-level agreeme
Episode 18: Supply Chain Risk and Due Diligence
Supply chains extend far beyond traditional logistics—they now include digital components, cloud providers, software dependencies, and more. This episode explores how cyber threats enter through the supply chain and what due diligence processes are needed to prevent compromise. We discuss methods for evaluating supply chain partners, setting clear security expectations, and responding to
Episode 19: Privacy Principles and Data Protection (GDPR, CCPA)
Protecting personal data is not just a compliance requirement—it’s a trust imperative. In this episode, we dive into key privacy principles such as data minimization, purpose limitation, and transparency. You’ll learn how regulations like the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) define privacy obligations and empower individuals with rig
Episode 20: Intellectual Property and Licensing Laws
Cybersecurity professionals must understand how to protect not only data but also intellectual property. This episode unpacks the key types of intellectual property—copyrights, trademarks, patents, and trade secrets—and how they apply in the digital world. We also examine licensing models for software and content, including open-source and proprietary agreements. Understanding the legal l
Episode 21: Legal Systems and Cybercrime Laws Globally
Cybersecurity professionals operate in a legal landscape that spans continents, jurisdictions, and regulatory systems. In this episode, we examine the major types of legal systems—common law, civil law, religious law, and customary law—and how each influences how cybersecurity is enforced. We also explore global cybercrime laws and treaties, including the Budapest Convention, and review h
Episode 22: Security Documentation and Governance Metrics
Effective security governance depends on clear documentation and measurable performance. This episode explains the structure and function of security documentation—including policies, standards, guidelines, and procedures—as well as how to manage these documents over time. We also explore key performance indicators (KPIs) and metrics used to assess the effectiveness of security controls a
Episode 23: Information Lifecycle and Data Classification
Understanding how data flows through its lifecycle is essential for protecting it appropriately. This episode walks through the phases of the information lifecycle: creation, storage, usage, transmission, archival, and disposal. We then examine data classification schemes—such as public, internal, confidential, and restricted—and how classification drives the application of controls. You'
Episode 24: Data Sensitivity and Labeling Requirements
Labeling data according to its sensitivity is one of the most overlooked but powerful techniques in cybersecurity. In this episode, we explore what it means for data to be considered sensitive, how that sensitivity is determined, and how labels communicate handling requirements to users and systems. We also cover how to implement labeling technologies and ensure compliance with both organ
Episode 25: Ownership and Stewardship Responsibilities
Every piece of information in an organization should have an assigned owner and one or more stewards. In this episode, we define what it means to be a data owner—someone accountable for the data’s use, classification, and protection. We also explore the role of stewards—those responsible for managing data quality and integrity on a day-to-day basis. Clarifying these roles strengthens gove
Episode 26: Data Retention and Archival Strategies
Keeping data longer than necessary can increase your risk exposure, but disposing of it too early can create legal and operational gaps. This episode addresses how to build effective data retention and archival strategies that meet legal, regulatory, and business needs. You’ll learn how to define retention periods, implement secure storage solutions for inactive data, and manage transitio
Episode 27: Privacy Protection and PII Handling
Personally Identifiable Information (PII) is one of the most regulated and targeted types of data in cybersecurity. This episode focuses on how organizations identify, handle, and protect PII throughout its lifecycle. We explain what qualifies as PII, the risks associated with its misuse, and the controls needed to ensure confidentiality, integrity, and lawful processing. From consent man
Episode 28: Data Remanence and Secure Disposal Techniques
Even when you delete a file, remnants can linger—posing serious security risks. This episode delves into the concept of data remanence and the techniques used to ensure secure data disposal. You'll learn about data wiping, degaussing, shredding, cryptographic erasure, and the standards that guide their use, such as NIST SP 800-88. We also cover the importance of disposal audits, chain of
Episode 29: Secure Data Handling in Transit and at Rest
Data is constantly on the move—or waiting to be accessed—and must be protected in both states. In this episode, we examine the best practices for securing data at rest (stored on disk or cloud) and data in transit (moving across networks). You'll learn about encryption methods, key management practices, access controls, and monitoring techniques. We also address compliance requirements th
Episode 30: Media Storage and Sanitization Methods
Digital media—whether it’s a hard drive, USB stick, or backup tape—requires special handling to ensure data remains protected throughout its lifecycle. This episode explores how to securely store, track, and sanitize various types of storage media. We discuss media classification, physical protections, encryption, and environmental controls for storage, as well as different sanitization t
Episode 31: Asset Inventory Management
You can’t protect what you don’t know you have. In this episode, we focus on the importance of maintaining a comprehensive and accurate inventory of all information assets—hardware, software, data, and even personnel. Asset inventory management supports effective risk assessments, helps identify gaps in coverage, and is a foundational requirement for many compliance standards. We explore
Episode 32: Data Sovereignty and Jurisdictional Control
In a global digital economy, where your data resides can determine which laws apply to it. This episode explains data sovereignty—the principle that data is subject to the laws of the country in which it’s stored—and how jurisdictional control affects compliance, privacy, and access. We examine common challenges organizations face when storing or processing data across borders, such as co
Episode 33: Secure Use of Cloud Storage and Shared Resources
Cloud services offer scalability and convenience, but they also introduce unique security risks—especially when sharing infrastructure with other tenants. In this episode, we cover best practices for securely using cloud storage, virtualized environments, and shared computing platforms. Topics include encryption, access control, tenant isolation, identity federation, and logging. We also
Episode 34: Backup Controls and Data Recovery
Backup and recovery plans are your insurance against data loss. In this episode, we explore the critical controls necessary to ensure backups are available, secure, and usable when needed. We discuss types of backups (full, incremental, differential), retention policies, storage locations (on-site vs. off-site), and encryption strategies. You’ll also learn about recovery objectives like R
Episode 35: Handling of Sensitive Systems and High-Value Assets
Some systems and data are too critical to treat like everything else. This episode focuses on how organizations identify, secure, and manage sensitive systems and high-value assets (HVAs), such as financial databases, intellectual property repositories, and industrial control systems. We discuss segmentation, access control, system hardening, monitoring, and tailored incident response pla
Episode 36: Logging, Monitoring, and Metadata Retention for Assets
Without visibility, security is just guesswork. In this episode, we explore how logging and monitoring give security teams the information they need to detect, investigate, and respond to incidents. We discuss log types (system, application, network), retention policies, log integrity, and secure storage. Metadata, such as timestamps, source IPs, and user actions, adds context to every al
Episode 37: Secure Design Principles: Defense in Depth, Least Privilege
Designing secure systems isn’t just about applying tools—it’s about embedding principles. This episode introduces two foundational security design concepts: defense in depth and least privilege. Defense in depth layers multiple controls to prevent, detect, and contain threats, while least privilege ensures users and systems operate with the minimum access necessary. We explain how these p
Episode 38: Security Models: Bell-LaPadula, Biba, Clark-Wilson
Security models are theoretical frameworks that help define how systems enforce access control, integrity, and confidentiality. In this episode, we review the three classic models: Bell-LaPadula (focused on confidentiality), Biba (focused on integrity), and Clark-Wilson (focused on well-formed transactions and separation of duties). We explain the core rules behind each model—like “no rea
Episode 39: Architecture Layers: OSI, System, Application
Security must be applied across all layers of a system, from the physical infrastructure to the application interface. In this episode, we explore the layered nature of system architecture—starting with the OSI model’s seven layers, then expanding into how security is applied at the hardware, system, and application levels. You’ll learn how to align controls with each layer’s function, re
Episode 40: Secure Hardware Architecture and TPM
Security isn’t only about software—hardware matters too. This episode introduces key elements of secure hardware architecture, including trusted computing bases, secure boot processes, and hardware root of trust. We also dive into the Trusted Platform Module (TPM), a hardware chip that provides cryptographic key storage, platform integrity checks, and secure identity verification. You’ll
Episode 41: Virtualization and Cloud Infrastructure Considerations
Virtualization and cloud computing are cornerstones of modern IT, but they also introduce unique security challenges. In this episode, we examine the architecture and risks associated with virtual machines, hypervisors, containers, and cloud platforms. You’ll learn how virtual environments increase complexity and expand the attack surface, and what controls are necessary to mitigate these
Episode 42: Secure Baseline and Configuration Management
Systems don’t stay secure by accident—they stay secure through consistent configuration and control. In this episode, we cover the concepts of secure baselining and configuration management. You’ll learn how to establish security baselines, enforce configuration standards, and use automation tools to detect and remediate drift. We also discuss patching, change control, and the role of con
Episode 43: Common Security Flaws in Architecture
Flawed architecture is one of the most serious vulnerabilities in any system. In this episode, we explore common architectural security weaknesses, including insecure defaults, lack of isolation, poor trust boundaries, and insufficient input validation. We explain how these flaws emerge during design and how they can be exploited by attackers. You’ll also learn how to apply secure design
Episode 44: Cryptographic Concepts: Symmetric and Asymmetric
Cryptography is the backbone of digital security, and understanding its core principles is essential. In this episode, we explain the difference between symmetric and asymmetric encryption, along with their real-world applications. You’ll learn how symmetric encryption uses a single key for both encryption and decryption, while asymmetric encryption relies on key pairs for secure key exch
Episode 45: Cryptographic Lifecycle: Algorithms, Strength, Obsolescence
Cryptographic tools aren’t set-and-forget solutions—they require lifecycle management. This episode explores how organizations select, deploy, and eventually retire cryptographic algorithms. We examine how algorithm strength is determined, the impact of key length, and the risks posed by deprecated or broken ciphers like MD5 and SHA-1. You’ll learn how to stay ahead of threats by monitori
Episode 46: Hashing and Message Integrity
Hashing ensures that data remains unchanged during storage or transmission—a core requirement for integrity. In this episode, we explore how cryptographic hash functions like SHA-256 and SHA-3 are used to detect tampering, generate digital signatures, and verify file authenticity. We discuss key properties such as collision resistance, pre-image resistance, and determinism. You'll also le
Episode 47: Key Management and Key Escrow
Cryptographic systems are only as secure as the keys they use—and how those keys are managed. In this episode, we delve into key management principles, including generation, storage, distribution, rotation, and destruction. We also explore key escrow, where a third party securely stores encryption keys for legal or recovery purposes. You’ll learn about hardware security modules (HSMs), ke
Episode 48: PKI, Digital Certificates, and Trust Models
Public Key Infrastructure (PKI) is essential for enabling secure communication and verifying digital identities. This episode breaks down how PKI works, including the roles of certificate authorities (CAs), registration authorities (RAs), and digital certificates. You’ll learn about certificate chaining, revocation, validation protocols like OCSP and CRL, and how trust is established in b
Episode 49: Cryptanalysis and Attacks Against Crypto
No cryptographic system is immune to attack, and CISSPs must understand the methods used to break or weaken them. In this episode, we explore cryptanalysis techniques including brute-force, dictionary attacks, chosen plaintext attacks, and side-channel analysis. We explain how poor implementation, weak keys, and outdated algorithms create vulnerabilities, and how to mitigate those risks t
Episode 50: Security Evaluations: Common Criteria, RMF, ISO/IEC
Security evaluations provide assurance that systems meet defined security requirements. In this episode, we examine key evaluation frameworks including Common Criteria (CC), the NIST Risk Management Framework (RMF), and the ISO/IEC 27000 series. You'll learn how these models define evaluation assurance levels, categorize controls, and guide secure system development. We also discuss how e
Episode 51: Security Boundaries and Isolation Techniques
Security boundaries are essential for creating logical separations between systems, users, and data flows. In this episode, we explore how boundaries are defined and enforced, using both physical and logical mechanisms. You’ll learn about concepts like trust zones, network segmentation, VLANs, virtualization, and sandboxing. We also discuss isolation techniques that prevent lateral moveme
Episode 52: Emerging Technologies and Security Architecture (e.g., IoT, AI)
Technological innovation continues to transform the security landscape. In this episode, we examine how emerging technologies such as the Internet of Things (IoT), Artificial Intelligence (AI), and machine learning are impacting security architecture. We discuss the benefits and vulnerabilities of these systems, including expanded attack surfaces, device sprawl, privacy concerns, and auto
Episode 53: SCADA and Embedded System Security
Supervisory Control and Data Acquisition (SCADA) systems and embedded devices operate some of the most critical infrastructure in the world—from energy grids to transportation systems. This episode explores the unique challenges of securing these environments, including limited resources, outdated firmware, lack of patching, and real-time operational requirements. We cover best practices
Episode 54: Fault Tolerance, Redundancy, and High Availability
Downtime is not an option for mission-critical systems. In this episode, we dive into fault tolerance, redundancy, and high availability—design strategies that ensure continuity despite component failures or unexpected disruptions. You’ll learn the differences between active-active and active-passive configurations, the role of clustering, load balancing, failover mechanisms, and geograph
Episode 55: Network Architecture: LAN, WAN, Internet
Understanding how networks are built and connected is foundational for any security professional. In this episode, we review core network architecture concepts, including the structure and purpose of Local Area Networks (LANs), Wide Area Networks (WANs), and the global Internet. We examine how data moves across these networks and where vulnerabilities may appear, from physical access poin
Episode 56: OSI and TCP/IP Models Refresher
The OSI and TCP/IP models provide a layered approach to understanding how data is transmitted, received, and managed across networks. In this episode, we refresh your understanding of these models and their significance in network security. We explore the function of each layer—from physical cabling to application-level protocols—and explain how attacks and defenses map to specific layers
Episode 57: Secure Protocols: HTTPS, SSH, SFTP, SNMPv3
Secure communication protocols form the backbone of protected digital environments. In this episode, we explore widely used secure protocols like HTTPS, SSH, SFTP, and SNMPv3. You’ll learn how each one provides confidentiality, integrity, and authentication for various types of data exchanges—from web traffic and file transfers to remote administration and device management. We cover prot
Episode 58: Network Segmentation and Microsegmentation
Segmentation limits the spread of attacks and improves control over traffic flows within a network. In this episode, we examine both traditional network segmentation and microsegmentation techniques. You’ll learn how VLANs, firewalls, and subnetting create macro boundaries, while software-defined networking enables granular control over traffic between workloads and devices. We discuss ho
Episode 59: Defense in Depth with Firewalls and DMZs
Layered security—known as defense in depth—is a core concept in cybersecurity architecture. This episode focuses on how firewalls and demilitarized zones (DMZs) serve as essential layers in protecting internal networks. We explore different types of firewalls (packet filtering, stateful, next-gen), the design of DMZs for public-facing services, and how to enforce traffic controls between
Episode 60: Intrusion Detection and Prevention Systems
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are crucial for identifying and stopping threats in real time. This episode explores how these tools work, their deployment strategies, and how they integrate with broader security operations. You’ll learn about signature-based and anomaly-based detection, false positives, evasion techniques, and tuning practices. We
Episode 61: Secure Routing and Switching
Secure routing and switching are foundational elements of network security. In this episode, we explore how routers and switches operate, and how attackers exploit their misconfigurations or weaknesses to gain access or disrupt communication. Topics include route hijacking, ARP poisoning, MAC flooding, and VLAN hopping. You’ll learn best practices for hardening these devices, including ac
Episode 62: VPNs, Remote Access, and Tunneling Protocols
Episode 63: Wireless Network Security (WEP, WPA2/3, 802.1X)
Wireless networks present a unique set of vulnerabilities due to their reliance on open air transmission. In this episode, we examine wireless security protocols and controls, including WEP, WPA2, WPA3, and 802.1X. We explain how authentication frameworks, encryption standards, and access controls protect against threats like rogue access points, packet sniffing, and brute-force attacks.
Episode 64: VOIP and Secure Communication Channels
Voice over IP (VOIP) technologies have replaced traditional telephony in many organizations, but they come with their own set of security concerns. This episode explores the architecture of VOIP systems and the threats they face, including call interception, eavesdropping, spoofing, and denial-of-service attacks. We also cover secure communication protocols such as SRTP, SIPS, and encrypt
Episode 65: Network Address Translation and Proxy Usage
NAT and proxy servers play important roles in hiding internal IP addresses, enforcing access policies, and controlling traffic flow. In this episode, we explore how Network Address Translation (NAT) works to conserve IP space and obscure internal architectures. We also explain how proxies—forward, reverse, and transparent—support web filtering, anonymization, caching, and load balancing.
Episode 66: Network Monitoring and Traffic Analysis
Continuous monitoring and traffic analysis are essential for detecting threats, performance issues, and policy violations. In this episode, we explore tools and techniques used to observe network behavior in real time. Topics include flow monitoring, deep packet inspection, NetFlow, and behavioral analytics. You’ll also learn about the role of Security Information and Event Management (SI
Episode 67: Zero Trust and Software-Defined Networking (SDN)
Zero Trust has emerged as a powerful model for modern cybersecurity, shifting the focus from perimeter defenses to granular, identity-centric control. In this episode, we explain the principles of Zero Trust—never trust, always verify—and how it’s implemented using continuous authentication, microsegmentation, and least privilege access. We also explore Software-Defined Networking (SDN),
Episode 68: Content Delivery Networks and Edge Security
Content Delivery Networks (CDNs) accelerate access to web content by distributing it across global edge nodes, but they also introduce new attack surfaces. In this episode, we discuss how CDNs work, their role in performance optimization, and the security challenges they present, such as cache poisoning, misconfigured access controls, and DDoS targeting. We also explore edge computing sec
Episode 69: Cloud Network Security (CASB, SASE, Virtual Firewalls)
As more organizations move to the cloud, network security must evolve. This episode focuses on cloud-native controls including Cloud Access Security Brokers (CASB), Secure Access Service Edge (SASE), and virtual firewalls. You’ll learn how these tools provide visibility, policy enforcement, data loss prevention, and threat protection across hybrid and multi-cloud environments. We also cov
Episode 70: DDoS Protection and High Availability Networks
Distributed Denial of Service (DDoS) attacks are designed to overwhelm systems and take down critical services. In this episode, we explain how these attacks work—volumetric, protocol, and application-layer—and the techniques used to defend against them. You’ll learn about scrubbing centers, rate limiting, traffic shaping, and the role of content delivery networks in mitigation. We also e
Episode 71: Authentication Factors and Methods
Authentication is the process of verifying identity, and it forms the first line of defense in access control. In this episode, we explore the different authentication factors: something you know (passwords, PINs), something you have (tokens, smart cards), something you are (biometrics), somewhere you are (location), and something you do (behavioral patterns). We also examine common authe
Episode 72: Identity Proofing and Registration Processes
Before you can authenticate someone, you must first establish their identity through a process called identity proofing. In this episode, we cover how identity proofing works—from in-person validation and biometric capture to document verification and knowledge-based authentication. We explain how organizations perform registration, bind credentials, and manage onboarding securely. These
Episode 73: Authorization Techniques: RBAC, ABAC, MAC, DAC
Once a user’s identity is authenticated, the system must decide what they are allowed to do. This episode focuses on common authorization models: Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), Mandatory Access Control (MAC), and Discretionary Access Control (DAC). We explore the rules and policies that govern each model, along with their strengths, weaknesses, an
Episode 74: IAM Lifecycle and Governance
Identity and Access Management (IAM) is not just about technology—it’s a continuous lifecycle that requires strong governance. This episode walks through each stage of the IAM lifecycle: provisioning, access management, auditing, revalidation, and deprovisioning. We also examine governance frameworks that ensure IAM aligns with policy, risk appetite, and regulatory standards. From role de
Episode 75: Password Policy Design and Management
Passwords remain one of the most widely used—but frequently abused—authentication methods. In this episode, we explore how to design and manage effective password policies that balance usability with security. We cover best practices like minimum complexity, reuse prevention, expiration cycles, and password vaulting. You’ll also learn about modern recommendations from NIST that challenge
Episode 76: Biometric Authentication Strengths and Weaknesses
Biometric authentication uses unique physical or behavioral traits—like fingerprints, facial features, or voice—to verify identity. In this episode, we explore how biometrics work, including the concepts of enrollment, matching algorithms, false acceptance rates (FAR), false rejection rates (FRR), and spoofing resistance. We also examine the strengths and weaknesses of different biometric
Episode 77: Federation and SSO: SAML, OAuth, OpenID
Federated identity systems allow users to authenticate across multiple platforms using a single identity, often enabling Single Sign-On (SSO). In this episode, we explain how standards like SAML, OAuth 2.0, and OpenID Connect enable cross-domain authentication. You’ll learn the difference between authentication and authorization, how token exchanges work, and what security concerns arise
Episode 78: Privileged Access Management (PAM)
Privileged accounts have elevated access and are among the most targeted assets in any organization. In this episode, we examine Privileged Access Management (PAM) solutions, including vaulting, session recording, just-in-time provisioning, and approval workflows. We explain how PAM helps enforce least privilege, reduce insider threats, and meet compliance obligations. You'll also learn h
Episode 79: Directory Services: LDAP, Active Directory
Directory services are centralized databases that store and manage user credentials, permissions, and group memberships. In this episode, we explore how Lightweight Directory Access Protocol (LDAP) and Microsoft Active Directory (AD) function as the backbone of identity infrastructure. Topics include directory hierarchies, schema design, authentication flows, and integration with Kerberos
Episode 80: Multi-Factor Authentication and Implementation
Multi-Factor Authentication (MFA) significantly strengthens identity verification by requiring more than one authentication factor. In this episode, we break down the different types of factors—something you know, have, are, do, or where you are—and how they’re combined for robust protection. We explore methods such as SMS codes, authenticator apps, smart cards, biometrics, and physical t
Recommended
صداستان: ساعتی با موسیقی
Becoming: HER with Nikki Spoelstra
Exposing Workplace Bullying
Everyday AI Made Simple - AI For Everyday Tasks
FemTech Focus
Not Too Sensitive - Empowering Highly Sensitive People (HSPs) To Own Their Sensitivity
Mother Daughter Relationship Show
Skin Deep MDs with Dr. Mamina Turegano, Dr. Lindsey Zubritsky and Dr. Jenny Liu
girl talk 🎧🫧
Booked, Blonde & Busy w/ Olivia Ponton
LOVE SOMEONE with Delilah
Classical Christian Education
