x

75% of people globally want unbiased news (Pew Research) but are concerned they're not getting that.

Get balanced coverage with Symby. See how stories are covered across diverse outlets and spot when one side covers a story the other skips.

PODCAST

Framework: The Center for Internet Security (CIS) Top 18 Controls

The **CIS Critical Security Controls Audio Course** is a comprehensive, audio-first training series that guides listeners through all eighteen **CIS Controls**, transforming one of the world’s most respected cybersecurity frameworks into clear, actionable learning. Designed for professionals, students, and auditors alike, this series explains each control in practical, plain language—focusing on how to implement, assess, and sustain them in real environments. With eighty-three structured episodes,

technology courses

All Episodes

1:34

Trailer

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

en

12:33

Episode 82 — Safeguard 18.2 – Internal and red team...

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

Safeguard 18.2 extends penetration testing to include internal assessments and red team exercises that emulate an attacker with initial access. Internal testing evaluates how far a threat could move laterally, escalate privileges, and access sensitive data once inside the network. Red team exercises simulate full-scale adversary campaigns, testing detection, containment, and response capabilities across technical and human layers. These exercises reveal not just vulnerabilities, but also

en

10:31

Episode 81 — Safeguard 18.1 – External testing programs

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

Safeguard 18.1 requires organizations to establish and maintain a formal penetration testing program that includes recurring external assessments. External tests simulate real-world attackers operating from outside the enterprise perimeter, probing exposed systems, web applications, and cloud environments for exploitable weaknesses. Unlike automated vulnerability scans, these engagements apply human expertise to chain vulnerabilities, test business logic, and evaluate how well network

en

10:01

Episode 80 — Overview – Why penetration testing...

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

Control 18—Penetration Testing—closes the CIS framework by validating how well all other controls perform under real-world conditions. While vulnerability scanning identifies potential weaknesses, penetration testing goes further by exploiting them to assess the enterprise’s true exposure. These controlled attacks, conducted by skilled professionals, reveal how vulnerabilities chain together, how far an attacker could advance, and whether detection and response mechanisms activate as

en

9:22

Episode 79 — Remaining safeguards summary (Control 17)

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

The remaining safeguards in Control 17 reinforce the full lifecycle of incident response—spanning preparation, communication, testing, and continuous improvement. These include assigning key response roles, defining secure communication mechanisms, conducting post-incident reviews, and establishing thresholds that differentiate normal events from true incidents. Together, these steps ensure that teams can act quickly, share accurate information, and recover efficiently without confusion

en

10:34

Episode 78 — Safeguard 17.2 – Tabletop exercises

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

Safeguard 17.2 emphasizes the importance of testing the incident response plan through structured tabletop exercises. These simulations bring together key personnel—from technical teams to executives—to rehearse decision-making during hypothetical security events. Unlike full-scale technical drills, tabletop exercises focus on communication flow, role clarity, and coordination across departments. Scenarios may include ransomware outbreaks, cloud breaches, insider threats, or supply-chain

en

10:37

Episode 77 — Safeguard 17.1 – IR plan and playbooks

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

Safeguard 17.1 requires organizations to establish and maintain a comprehensive incident response process that defines scope, roles, responsibilities, and communication procedures. This process must include not only the technical elements of response—like containment and remediation—but also compliance reporting, legal coordination, and stakeholder communication. The plan should assign a primary incident manager and designate backups to ensure continuity. Playbooks for common incident

en

11:58

Episode 76 — Overview – Incident response principles

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

Control 17—Incident Response Management—defines how an organization prepares for, detects, responds to, and learns from security incidents. Even the most robust defenses can be breached, and when that happens, success depends on disciplined, preplanned response rather than improvised reaction. The control requires formal policies, documented procedures, and assigned roles to ensure rapid coordination across technical, legal, and communication teams. A well-structured incident response (IR)

en

11:53

Episode 75 — Remaining safeguards summary (Control 16)

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

The remaining safeguards under this control expand beyond coding and testing to address the full ecosystem in which applications live. They include maintaining an inventory of third-party components (a software bill of materials), enforcing trusted and up-to-date libraries, applying secure design principles, separating production and non-production environments, leveraging vetted platform services for identity and logging, and conducting code-level checks, application penetration testing,

en

12:48

Episode 74 — Safeguard 16.2 – Static and dynamic testing

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

This safeguard advances assurance by requiring a structured process to accept and address reported vulnerabilities and by embedding testing that sees both code and behavior. Static analysis inspects source or bytecode without executing it, uncovering issues like injection points, insecure APIs, tainted data flows, or missing sanitization. Dynamic analysis executes the running application to identify problems that only appear at runtime—input validation gaps across parameters, authentication

en

12:37

Episode 73 — Safeguard 16.1 – Secure coding practices

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

This safeguard directs organizations to formalize a secure application development process and set explicit standards for how code is designed, written, reviewed, and released. Secure coding practices begin with consistent patterns that remove entire classes of defects: input validation at all trust boundaries; strict output encoding; centralized, parameterized data access; safe file handling; and default-deny authorization checks enforced server-side. Developers should never implement

en

11:22

Episode 72 — Overview – Secure software lifecycle

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

A secure software lifecycle integrates security activities into every stage of building and operating applications—planning, design, development, testing, deployment, and maintenance—so that weaknesses are prevented early and detected quickly when they occur. In this view, security is not a gate at the end of development but a set of habits and checks embedded alongside feature work. Threat modeling during design clarifies how the application might be attacked and what architectural

en

12:09

Episode 71 — Remaining safeguards summary (Control 15)

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

The remaining safeguards in Control 15 round out a complete third-party risk program by adding structured assessment, continuous monitoring, and secure decommissioning. After building the inventory and embedding security in contracts, organizations must evaluate providers proportionally to their risk classifications, using recognized attestations such as SOC 2, PCI AoC, or ISO 27001 to reduce questionnaire fatigue while still validating control operation. Ongoing oversight should track

en

10:14

Episode 70 — Safeguard 15.2 – Security requirements...

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

Safeguard 15.2 ensures that contracts with service providers explicitly define security expectations and obligations, creating enforceable accountability. Every vendor relationship introduces risk, and legal agreements must formalize how those risks are managed. Security requirements within contracts should address data protection, incident notification, vulnerability disclosure, encryption standards, and compliance with relevant frameworks such as GDPR or HIPAA. These clauses establish

en

11:14

Episode 69 — Safeguard 15.1 – Inventory of service...

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

Safeguard 15.1 requires organizations to establish and maintain a complete inventory of all service providers that store, process, or access enterprise data. This inventory must include vendor classification, assigned business owner, contact information, and review frequency. A clear, current list of service providers allows enterprises to assess cumulative risk exposure and prioritize oversight efforts based on impact. Without it, vendor relationships can proliferate unchecked, creating

en

12:11

Episode 68 — Overview – Third-party and vendor risks

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

Control 15—Service Provider Management—addresses the growing reliance on third-party vendors and the risks that accompany it. In today’s interconnected ecosystems, external partners often handle sensitive data or manage critical business processes, making their security posture an extension of your own. A weak vendor can serve as an attacker’s gateway into the enterprise, as demonstrated by numerous high-profile breaches traced to supply chain vulnerabilities. This control ensures that

en

10:56

Episode 67 — Remaining safeguards summary (Control 14)

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

The remaining safeguards under Control 14 extend awareness beyond general staff by emphasizing continuous reinforcement, contextual learning, and cultural integration. They include training employees to recognize and report missing updates, understand risks of insecure networks, and conduct role-specific awareness sessions. Each safeguard strengthens the organization’s ability to identify, report, and respond to threats proactively. Training users to verify system patch status and notify IT

en

11:00

Episode 66 — Safeguard 14.3 – Role-based training for...

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

Safeguard 14.3 focuses on providing targeted, role-based training to employees whose responsibilities involve elevated privileges or specialized technical duties—such as system administrators, developers, and IT support staff. These roles have direct influence over critical systems and data, making them prime targets for attackers. Role-specific training ensures that individuals understand both general security principles and the unique threats associated with their job functions. For

en

10:56

Episode 65 — Safeguard 14.2 – Phishing simulations

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

Safeguard 14.2 emphasizes the use of phishing simulations to test, measure, and improve employee awareness of social engineering attacks. Phishing remains the most prevalent method for initial compromise, exploiting human curiosity, urgency, or trust. Simulated phishing exercises expose employees to realistic scenarios in a controlled environment, allowing them to practice identifying and reporting malicious messages without real-world consequences. These exercises serve as both diagnostic

en

10:32

Episode 64 — Safeguard 14.1 – Security awareness program

Framework: The Center for Internet Security (CIS) Top... ·

2025/10/18

Safeguard 14.1 requires organizations to establish and maintain a formal security awareness program that educates the workforce on secure behaviors and threat recognition. The program should define clear objectives, training frequency, and content scope. Awareness efforts must extend beyond one-time videos or checklists, evolving into continuous engagement that reinforces the importance of cybersecurity in every role. Key topics include safe internet usage, recognizing phishing, handling

en

83 results

Similar Podcasts

Lead With AI

Tamara Nall

Linux in the Ham Shack

Black Sparrow Media

Data Engineering Podcast

Tobias Macey

Eye On A.I.

Craig S. Smith

Reflections

Livewire Labs