x

75% of people globally want unbiased news (Pew Research) but are concerned they're not getting that.

Get balanced coverage with Symby. See how stories are covered across diverse outlets and spot when one side covers a story the other skips.

PODCAST

InfoSec Bites

Welcome to Hello InfoSec, your ultimate hub for all things cybersecurity! Dive into our thrilling podcast series, InfoSec Bites, where we unleash deep dives into Information Security, jaw-dropping Major Security Incidents, cutting-edge Cloud Information Security, crucial Privacy topics, revolutionary Artificial Intelligence, mind-bending Quantum Computing, and so much more! Get ready to geek out with expert insights and stay ahead of the curve—hit that like button, subscribe now, and turn on

technology

All Episodes

01:06:47

AWS Security: An Exhaustive Analysis of its Defense...

InfoSec Bites ·

2025/10/13

The podcast discusses an extensive analysis of the Amazon Web Services (AWS) security architecture, focusing on its implementation of the Defense in Depth (DiD) strategy through a multi-layered framework. It establishes the Shared Responsibility Model as the foundational security principle, clearly separating AWS's responsibility for the "Security of the Cloud" from the customer's accountability for the "Security in the Cloud." The analysis systematically breaks down the

en

00:39:27

HTTP/2 Deep Dive: Architecture, Security,...

InfoSec Bites ·

2025/10/12

The discussion in this podcast provides an extensive analysis of the HTTP/2 protocol, detailing its architectural shift from the text-based HTTP/1.1 to a more efficient binary and stateful framework using features like multiplexing and HPACK header compression. It thoroughly explains how these performance-enhancing changes, which solve application-layer Head-of-Line (HOL) blocking, simultaneously introduce new security vulnerabilities centred on computational amplification and resource exhaustion

en

00:39:34

ISO 27001: Strategic Information Security Framework

InfoSec Bites ·

2025/10/11

The discussion in this podcast provides an extensive overview of the ISO/IEC 27001:2022 standard, which serves as the international framework for an Information Security Management System (ISMS). It explains that the standard is a strategic, risk-driven approach built upon the core principles of Confidentiality, Integrity, and Availability (CIA), rather than a mere technical checklist. It details the operational mechanism of the ISMS, which is mandatorily structured around the Plan-Do-Check-Act

en

00:44:44

AWS ELB, Route 53, and CloudFront Deep Dive

InfoSec Bites ·

2025/10/10

This podcast provides a comprehensive architectural and security analysis of three core AWS global delivery services: Elastic Load Balancing (ELB), Amazon Route 53 (DNS), and Amazon CloudFront (CDN). It explains the foundational mechanics of each service, detailing how ELB leverages the Hyperplane for scaling, how Route 53 uses an Anycast data plane for global resilience, and how CloudFront relies on a multi-tiered Edge and Regional Cache hierarchy for performance. A significant portion of the

en

00:27:38

SolarWind's Supply Chain Espionage: How Sunburst...

InfoSec Bites ·

2025/10/09

The discussion in this podcast provides an extensive analysis of the SolarWinds cyber incident, detailing how the sophisticated, state-sponsored attack leveraged the software supply chain to compromise thousands of customers, including critical U.S. government agencies. The operation, formally attributed to Russia's Foreign Intelligence Service (SVR), involved a meticulous infiltration of SolarWinds’ build environment to inject the SUNBURST backdoor into legitimate software updates. This overview

en

00:49:16

Pillars of Cyber Risk : Vectors, Surface, Appetite,...

InfoSec Bites ·

2025/10/06

The podcast provides a comprehensive discussion on the Governance, Risk, and Compliance (GRC) Nexus, specifically exploring four foundational cybersecurity concepts. It first defines the threat landscape from an attacker’s perspective, distinguishing between an Attack Vector, which is the specific method of exploitation (e.g., phishing), and the Attack Surface, which is the totality of an organization's exposure (e.g., all systems and employees). The second half of the discussion addresses the

en

00:55:05

CISSP Domain-8: Software Development Security

InfoSec Bites ·

2025/10/05

The dicussion in this podcast offers a comprehensive overview of Software Development Security, covering the Software Development Life Cycle (SDLC) and various Development Methodologies. The text systematically explains the phases of the SDLC—including requirements gathering, design, development, testing, and operations and maintenance—while stressing the importance of integrating security at every stage. Furthermore, the discussion contrasts traditional methods like Waterfall with iterative

en

00:26:35

Capital One Cloud Breach: Misconfigured WAF and Least...

InfoSec Bites ·

2025/10/04

The podcast discusses post-mortem analysis of the 2019 Capital One cloud breach, detailing the technical, human, and systemic failures that allowed for the compromise of approximately 106 million individuals' data. It explains that the attack was successful due to a misconfigured Web Application Firewall (WAF) and the violation of the Principle of Least Privilege, which allowed an attacker to steal highly privileged AWS credentials. Furthermore, the analysis emphasizes that the breach was a

en

00:37:12

JFrog Artifactory: DevSecOps, Binary Repository...

InfoSec Bites ·

2025/10/02

The discussion in this podcast provides a comprehensive security overview of JFrog Artifactory, a critical and foundational component acting as a universal binary repository manager within the software supply chain. It explains Artifactory's core architecture, including its server, database, and various repository types (local, remote, virtual), and emphasizes its indispensable role in DevOps and CI/CD pipelines. It highlights that the platform faces significant threats stemming from

en

00:51:58

CISSP Domain-7: Security Operations

InfoSec Bites ·

2025/10/01

The podcast discussions details critical aspects of maintaining an organisation's security posture and operational resilience. The discussion covers security operational controls such as auditing and logging, enforcing least privilege and separation of duties, and implementing change management and configuration management practices to maintain system integrity. A significant portion addresses physical security measures, including defensive perimeters, access controls like locks and surveillance

en

00:48:37

CISSP Domain-6: Security Assessment and Testing

InfoSec Bites ·

2025/09/30

This discussion in the podcast provides an extensive overview of security assessments, testing, and audits, detailing the processes necessary to evaluate an organization's security posture. It explains the differences between vulnerability testing, penetration testing, and formal audits, including various testing methodologies like black box, white box, and gray box approaches. Furthermore, it discusses the importance of security metrics and indicators (such as KPIs and KRIs) for measuring the

en

00:56:21

Australian Privacy Principles: Deep Dive for InfoSec...

InfoSec Bites ·

2025/09/29

The podcast dicussion provides an extensive analysis of the Australian Privacy Principles (APPs), which constitute the core legal framework for data protection under Australia's Privacy Act 1988. It functions as a strategic guide for Information Security (InfoSec) professionals, breaking down the thirteen legally binding principles that govern how most government agencies and private organisations ("APP entities") must manage personal information throughout its lifecycle. Key concepts

en

00:51:37

CISSP Domain-5: Identity and Access Management (IAM)

InfoSec Bites ·

2025/09/28

The dicussion in this podcast provides an extensive overview of Identity and Access Management (IAM) concepts, focusing on the critical phases of identification, authentication, and authorization within secure systems. They detail various authentication methods, including passwords, multi-factor authentication (MFA), and biometrics, explaining the mechanics and weaknesses of each. A significant portion covers different access control models such as Discretionary (DAC), Mandatory (MAC), and

en

00:35:08

ISO 27005: A Strategic Deep Dive into Information...

InfoSec Bites ·

2025/09/27

The discussion in this podcast provides an extensive comparative analysis of two leading information security risk management methodologies: the ISO/IEC 27005 standard and the NIST Risk Management Framework (RMF). It establishes that modern organisations require a proactive, systematic approach to manage persistent cyber threats and details the philosophical differences, with ISO 27005 being a flexible, global standard for enterprise-wide Information Security Management Systems (ISMS), and NIST RMF

en

00:37:45

CISSP Domain-4: Communication and Network Security

InfoSec Bites ·

2025/09/27

The discussion in this podcast provides an extensive overview of networking fundamentals and secure communication channels, primarily focusing on the foundational concepts and technologies within the OSI and TCP/IP models. Key discussions includes the layers of the OSI model (Application, Presentation, Session, etc.) and their functions, as well as a detailed examination of IP addressing (IPv4 and IPv6), routing protocols (distance-vector and link-state), and various network topologies (bus, star,

en

01:17:14

CISSP Domain-3: Architectures, Cryptography, and...

InfoSec Bites ·

2025/09/27

The podcast disucssion offers an expansive overview of various information technology (IT) and operational technology (OT) concepts, covering system architectures, cryptology, and security architecture design principles. The discussion initially details system architectures, explaining multi-tier server-based systems and the security implications of Industrial Control Systems (ICS), where safety is paramount, particularly in SCADA and DCS environments. A significant portion addresses cryptology,

en

00:32:17

CISSP Domain-2: Asset Security

InfoSec Bites ·

2025/09/27

The discussion in this podcast provides a comprehensive overview of asset and data security, focusing heavily on information as an organisation's most valuable asset. The podcast details the data life cycle—from acquisition to destruction—and stresses the critical importance of data classification based on sensitivity and criticality to determine appropriate security controls. Furthermore, the discussion explores the three states of data (at rest, in motion, and in use) and discuss various

en

00:40:56

CISSP Domain-1: Security, Risk, and Compliance...

InfoSec Bites ·

2025/09/27

In this podcast we discuss a comprehensive overview of cybersecurity governance, risk management, and compliance within an organizational context. It explores the foundational concepts of the CIA triad (confidentiality, integrity, and availability), along with authenticity and nonrepudiation, and details the development of an enterprise-wide security program supported by management. Furthermore, it examines various risk management frameworks (RMFs), such as the NIST RMF and ISO/IEC 27005, and

en

00:31:39

AWS GuardDuty: Threat Hunting Beyond Alerts,...

InfoSec Bites ·

2025/09/25

The discussion in this podcast provides a comprehensive analysis of Amazon GuardDuty, an intelligent, fully managed threat detection service within the AWS ecosystem. It explains the service's multi-layered architecture, which combines machine learning, anomaly detection, and curated threat intelligence feeds to monitor core data sources like CloudTrail and VPC Flow Logs. The discussion stresses that GuardDuty functions as a detective control critical to a defense-in-depth strategy, and its true

en

00:47:10

XSS, CSRF, and SSRF Analysis: Web Application Forgeries.

InfoSec Bites ·

2025/09/24

The podcast discussion provides an extensive analysis of three major web application security flaws: Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and Server-Side Request Forgery (SSRF). It explains that these attacks exploit weaknesses in the web's foundational trust relationships, with XSS compromising user trust, CSRF exploiting the website's trust in the browser, and SSRF leveraging a server's internal network trust. It categorizes XSS into three vectors—Reflected, Stored, and

en

137 results

Similar Podcasts

Lead With AI

Tamara Nall

Linux in the Ham Shack

Black Sparrow Media

Data Engineering Podcast

Tobias Macey

Eye On A.I.

Craig S. Smith

Reflections

Livewire Labs