x

75% of people globally want unbiased news (Pew Research) but are concerned they're not getting that.

Get balanced coverage with Symby. See how stories are covered across diverse outlets and spot when one side covers a story the other skips.

PODCAST

Certified: The CISSP Audio Course

Dr. Jason Edwards

Welcome to The Bare Metal Cyber CISSP Audio Course—your comprehensive companion for mastering the Certified Information Systems Security Professional (CISSP) certification. Built for serious cybersecurity professionals and aspiring leaders alike, this Audio Course transforms the eight domains of the CISSP Common Body of Knowledge into clear, structured, and engaging lessons you can learn anytime, anywhere. Each episode blends real-world context, expert insight, and exam-focused explanations to help

education courses

All Episodes

10:58

Episode 98: Metrics and KPIs for Security Performance

Certified: The CISSP Audio Course ·

2025/06/23

What gets measured gets managed—and security is no exception. This episode focuses on security metrics and key performance indicators (KPIs) that help organizations evaluate the effectiveness of their controls and programs. We cover types of metrics (operational, compliance, risk-based), how to design meaningful KPIs, and how to avoid common pitfalls like vanity metrics. You'll also learn how to tie metrics to business objectives and use them in dashboards and reports. CISSPs must

en

11:06

Episode 97: Reporting Assessment Results Effectively

Certified: The CISSP Audio Course ·

2025/06/23

The value of a security assessment is only realized when the results are communicated clearly. In this episode, we discuss how to structure, write, and deliver effective reports for vulnerability scans, penetration tests, audits, and more. You'll learn how to prioritize findings by risk, provide context for business stakeholders, and recommend actionable remediation. We also explore visualizations, executive summaries, and post-report follow-ups. Strong reporting bridges the gap between

en

11:08

Episode 96: Threat Hunting and Red Team Exercises

Certified: The CISSP Audio Course ·

2025/06/23

Proactive threat hunting involves searching for signs of compromise that automated tools may miss. In this episode, we explain how threat hunters use hypothesis-driven analysis, threat intelligence, and behavioral indicators to uncover hidden risks. We also explore red team exercises—simulated attacks designed to test detection and response capabilities. You'll learn about attack frameworks like MITRE ATT&CK and how to coordinate purple teaming to maximize value. These offensive

en

11:09

Episode 95: Log Analysis for Forensics and Compliance

Certified: The CISSP Audio Course ·

2025/06/23

Logs are a goldmine of insight—but only if you know how to analyze them effectively. This episode dives into log collection, normalization, and correlation to support both forensic investigations and compliance reporting. We cover log sources such as firewalls, IDS/IPS, servers, applications, and cloud services, as well as how to identify anomalies, detect patterns, and preserve evidence. We also discuss the use of SIEM tools and log retention policies. CISSPs must understand how to

en

10:43

Episode 94: Compliance Auditing and Evidence Collection

Certified: The CISSP Audio Course ·

2025/06/23

Audits provide assurance that an organization is following its security policies and regulatory obligations. In this episode, we explore how compliance audits are structured, conducted, and evaluated. You’ll learn how to collect evidence, prepare audit trails, manage interviews, and handle audit scope creep. We also cover the role of internal vs. external auditors and discuss popular frameworks like ISO 27001, SOC 2, and PCI DSS. For CISSPs, knowing how to support audits with accurate

en

11:19

Episode 93: Risk Assessment and Gap Analysis

Certified: The CISSP Audio Course ·

2025/06/23

Risk assessments help prioritize security controls by identifying vulnerabilities, evaluating threats, and estimating potential impacts. In this episode, we break down how to conduct both qualitative and quantitative assessments, including risk matrix construction, asset valuation, and likelihood estimation. We also explain gap analysis—comparing current security posture against frameworks, regulations, or internal standards to find missing controls. CISSPs must be able to interpret these

en

11:03

Episode 92: Test Coverage and Measurement

Certified: The CISSP Audio Course ·

2025/06/23

How do you know your security testing is thorough? In this episode, we examine test coverage metrics and how they help evaluate the effectiveness and completeness of assessments. We explain different forms of coverage—such as code path coverage, requirement coverage, and risk-based coverage—and how to map test cases to threat models and control objectives. You'll also learn how to interpret results and identify coverage gaps. Effective measurement allows CISSPs to ensure that testing

en

11:17

Episode 91: Security Test Data and Environment...

Certified: The CISSP Audio Course ·

2025/06/23

Security testing requires careful control over both the test environment and the data used within it. In this episode, we explore how to create and manage dedicated testing environments that accurately simulate production systems without risking real assets. We cover the importance of data masking, synthetic data generation, and environment segmentation. You'll also learn how to prevent test environments from becoming security liabilities. CISSPs must understand how to manage test data in

en

10:38

Episode 90: Code Review and Static/Dynamic Testing

Certified: The CISSP Audio Course ·

2025/06/23

Code is a frequent source of vulnerabilities, and reviewing it is essential for secure software development. In this episode, we discuss secure code review techniques—both manual and tool-assisted. We explain how static application security testing (SAST) scans source code before runtime, while dynamic application security testing (DAST) analyzes behavior during execution. You’ll also learn about interactive testing, false positives, secure development lifecycles, and DevSecOps integration

en

10:58

Episode 89: Security Control Testing: Manual vs....

Certified: The CISSP Audio Course ·

2025/06/23

Security controls are only effective if they’re working as designed. In this episode, we explore how to test those controls using both manual and automated methods. We compare control validation techniques such as checklists, code reviews, synthetic transactions, vulnerability scanners, and red team exercises. You’ll learn when human judgment is needed, when automation scales better, and how to combine the two for comprehensive testing. As a CISSP, knowing how to assess the effectiveness of

en

10:15

Episode 88: Planning a Security Assessment

Certified: The CISSP Audio Course ·

2025/06/23

Security assessments must be planned thoroughly to be effective, safe, and actionable. This episode walks through the planning phase of an assessment project, including goal setting, scope definition, timeline management, and stakeholder communication. We explain how to assess organizational readiness, gain necessary approvals, and avoid disrupting operations. You’ll also learn about risk categorization, asset selection, test environment configuration, and the importance of documentation

en

10:34

Episode 87: Assessment Types: Vulnerability Scans,...

Certified: The CISSP Audio Course ·

2025/06/23

Security assessments come in many forms—each with a specific purpose. In this episode, we compare and contrast vulnerability scanning, penetration testing, and formal security audits. We cover the methodologies, tools, scope definitions, and reporting standards associated with each type. You’ll learn how to select the right assessment based on business goals, risk tolerance, and compliance requirements. We also examine legal considerations and rules of engagement for ethical hacking. For

en

9:53

Episode 86: Threats to IAM: Replay, Pass-the-Hash,...

Certified: The CISSP Audio Course ·

2025/06/23

Identity systems are high-value targets, and attackers use increasingly sophisticated techniques to exploit them. This episode examines key IAM-related attack vectors, including replay attacks, pass-the-hash, credential stuffing, brute-force, and phishing-based compromise. We explain how these attacks work, the conditions that enable them, and the defenses needed to detect and prevent them. Controls discussed include session binding, MFA, rate limiting, password hygiene, and advanced

en

11:22

Episode 85: Session Management and Timeout Policies

Certified: The CISSP Audio Course ·

2025/06/23

Controlling user sessions is a critical part of maintaining secure access. In this episode, we examine how session tokens are issued, maintained, and terminated—along with techniques to prevent hijacking and session fixation attacks. We explore timeout policies, inactivity limits, reauthentication triggers, and secure logout practices. You’ll learn how session management differs across web applications, VPNs, and enterprise software. By enforcing proper session controls, CISSPs can prevent

en

10:39

Episode 84: Access Recertification and Review

Certified: The CISSP Audio Course ·

2025/06/23

Access permissions tend to accumulate over time, creating a significant security risk if not reviewed regularly. This episode focuses on access recertification—the process of periodically validating that users still need the permissions they’ve been granted. We explain how to plan, automate, and document access reviews, and how to manage exceptions and approvals. You’ll also learn how access governance tools integrate with identity platforms to support audits and compliance. CISSPs play a

en

10:57

Episode 83: Access Control Lists and Capability Tables

Certified: The CISSP Audio Course ·

2025/06/23

Access control mechanisms determine who can access what—and how. In this episode, we compare two classic models: Access Control Lists (ACLs) and capability tables. ACLs associate permissions with objects, while capability tables associate them with subjects. We examine their strengths, limitations, and real-world implementations in file systems, network devices, and operating systems. You’ll also learn about how these mechanisms enforce discretionary and mandatory access controls, and how

en

9:12

Episode 82: Credential Management and Recovery

Certified: The CISSP Audio Course ·

2025/06/23

Managing credentials securely is critical to preventing unauthorized access and ensuring business continuity. This episode explores techniques for secure credential issuance, storage, expiration, and revocation. We discuss the lifecycle of credentials across devices, users, and systems, including integration with password managers, key vaults, and enterprise authentication platforms. You'll also learn about secure recovery mechanisms such as self-service portals, identity proofing, and

en

8:44

Episode 81: Identity-as-a-Service (IDaaS) and Cloud IAM

Certified: The CISSP Audio Course ·

2025/06/23

Identity-as-a-Service (IDaaS) provides centralized identity and access management capabilities from the cloud. In this episode, we explore the architecture and benefits of IDaaS solutions, including scalability, simplified administration, and integration with cloud-native applications. You’ll learn how IDaaS supports federated identity, multi-factor authentication, and compliance through managed platforms. We also cover risks such as vendor lock-in, data privacy concerns, and API exposure

en

9:13

Episode 80: Multi-Factor Authentication and...

Certified: The CISSP Audio Course ·

2025/06/23

Multi-Factor Authentication (MFA) significantly strengthens identity verification by requiring more than one authentication factor. In this episode, we break down the different types of factors—something you know, have, are, do, or where you are—and how they’re combined for robust protection. We explore methods such as SMS codes, authenticator apps, smart cards, biometrics, and physical tokens. You’ll also learn how to implement MFA in various environments, manage usability challenges, and

en

9:23

Episode 79: Directory Services: LDAP, Active Directory

Certified: The CISSP Audio Course ·

2025/06/23

Directory services are centralized databases that store and manage user credentials, permissions, and group memberships. In this episode, we explore how Lightweight Directory Access Protocol (LDAP) and Microsoft Active Directory (AD) function as the backbone of identity infrastructure. Topics include directory hierarchies, schema design, authentication flows, and integration with Kerberos. We also discuss common attacks on directories—like privilege escalation and replication abuse—and how

en

138 results

Similar Podcasts

Science Talk

Albert Einstein College of Medicine

五分钟心理学

柠檬心理

Daily Facts

Amalia Dupray and Montgomery Jones.

Les dents et dodo

BFMTV

Veterinary Clinical Podcasts

The Royal Veterinary College