Loading...

PODCAST

CISSP Cyber Training Podcast - CISSP Training Program

Shon Gerber, vCISO, CISSP, Cybersecurity Consultant and Entrepreneur

Join Shon Gerber on his weekly CISSP Cyber Training podcast, where his extensive 23-year background in cybersecurity shines through. With a rich history spanning corporate sectors, government roles, and academic positions, Shon imparts the essential insights and advice necessary to conquer the CISSP exam. His expertise is not just theoretical; as a CISSP credential holder since 2009, Shon translates his deep understanding into actionable training. Each episode is packed with invaluable security

education courses

All Episodes

37:28

CCT 373: An AI Agent Was Told No and Got In Anyway...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/10/05

Send us Fan Mail An AI agent gets blocked by access controls, then calmly finds another way in anyway and that is the wake-up call. I use a recent Hacker News story about an automated agent bypassing an Australian government health portal to dig into what CISSP Domain 6.2 is really testing: not your ability to recite a list of techniques, but your ability to manage authorization, scope, and rules of engagement so a “test” does not turn into an intrusion. We break down why the portal controls...

en

32:58

CCT 372: Stolen Sessions and Why MFA Never Saw Them...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/09/28

Send us Fan Mail A stolen password is annoying. A stolen session token can be invisible, valid, and instantly profitable. Today we dig into a real warning sign from Okta threat intelligence: infostealer malware lifted live session tokens from browsers, and thousands of Google sessions were still working weeks later. No MFA prompt. No brute force. Just a legitimate session replayed by the wrong person, with real dollar damage through unauthorized usage and credits. We use that story to sharpe...

en

30:20

CCT 371: Secure Communication Channels and Who Is...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/09/21

Send us Fan Mail One video hotline feels like a single, simple conversation until you trace the call path and realise there may be seven companies involved in making it work. That’s the spark for this training-focused breakdown of CISSP Domain 4.3 secure communication channels, using the viral AI “actress hotline” story to show how modern voice and video collaboration really behaves behind the curtain. We start with a practical analogy: you think you’re transacting with the waiter, but your ...

en

38:32

CCT 370: CISSP Cryptography, FIPS Validation, and...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/09/14

Send us Fan Mail A compliance deadline can change your security posture without changing a single bit of your encryption. We start with a simple sticker-on-the-windshield analogy that maps directly to what’s happening with FIPS 140 validations: your VPN can keep encrypting, your database can keep protecting data, and yet an assessor can still mark you down because “working” is not the same as “validated.” We walk through the practical CISSP Domain 3 lesson behind the noise: the difference be...

en

31:46

CCT 369: Security Models Demystified - CISSP Domain...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/09/07

Send us Fan Mail 🔁 REPLAY — this episode originally aired as CCT 278 in September 2025. I'm heads-down finishing a Domain 3 cryptography episode, so I'm re-running one of the strongest episodes in the archive rather than shipping something thin. If you're newer to the show, you haven't heard this one. And if you're studying Domain 3 right now the timing works in your favor — security models are the foundation the rest of the domain sits on, and next week's episode picks up in the same

en

42:56

CCT 368: CISSP Asset Security and Data Classification...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/08/31

Send us Fan Mail Nine million images. No password. No encryption. And the defence was basically: “It wasn’t public because you had to know the URL.” That single line opens up one of the most important CISSP Domain 2 conversations you can have: security through obscurity is not access control, and a hidden address is not a key. We take this real data exposure and translate it into the kind of manager-level reasoning the CISSP exam demands, not memorised trivia. We then zoom out into Asset Sec...

en

42:52

CCT 367: Threat Modeling and the AI Agent That...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/08/24

Send us Fan Mail A rogue AI agent didn’t “hack the future” so much as exploit the oldest security problems in the book: weak boundaries, over-trusted inputs, exposed endpoints, and credentials lying around. We walk through the Hugging Face intrusion story like a CISO briefing a board, step by step, translating a fast-moving AI-red-team narrative into the kind of clear threat modeling logic you need for ISC2 CISSP Domain 1.10 and for real risk decisions. From there, we shift into traini...

en

33:04

CCT 366: Software Supply Chain Security Explained —...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/08/17

Send us Fan Mail A supply chain attack that leaves your Git history spotless should change how you think about “secure code.” We walk through ChainDrop, a worm discovered in the NPM ecosystem that poisoned 444 packages while evading the places defenders usually look. The unnerving twist is that it can trigger without a classic npm install and can hide in the space between your repository and the package archive your CI/CD pipeline actually pulls, which is exactly why code review alone can’t b...

en

25:05

CCT 365: Malicious QR Code Attacks and Digital...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/08/10

Send us Fan Mail One careless QR scan can quietly turn a “private” chat into a live wiretap. We start with a timely threat story: Russian APT-style actors abusing Signal’s linked device flow by pushing phishing links that contain malicious QR codes, so messages can be mirrored to an attacker device in real time. If you use Signal, WhatsApp, or Telegram at work, this is the kind of simple, human-triggered failure mode worth building into your security awareness habits. Then we shift into CISS...

en

46:08

CCT 364: Third Party Risk Management - How One Vendor...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/08/03

Send us Fan Mail A breach can hit your headlines even when your own systems never get touched, and that’s exactly why third-party risk management keeps showing up on the CISSP exam and in real incident reports. We walk through the Vimeo breach tied to its analytics vendor Anodot, where compromised vendor access and authentication tokens gave attackers a clean path to customer data. No video content or payment data was taken, but names, emails, and metadata exposure is still a trust and reputa...

en

44:45

CCT 363: CISSP AI Governance: What Credit Union...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/07/27

Send us Fan Mail One bad AI decision can cost you more than money. It can cost you trust, trigger regulators overnight, and put your name on the hook when the board asks, “Who approved this?” We dig into AI governance through a CISSP lens, using real-world banking and credit union scenarios that show how fast things go sideways when AI tools slip outside your controls. We start with the uncomfortable reality behind modern AI adoption: vendors ship powerful models, teams connect third parties...

en

34:00

CCT 362: Security Assessment Strategies & Abandoned...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/07/20

Send us Fan Mail That forgotten cloud storage you stopped thinking about months ago can become a real attack path today. We start with a simple but dangerous scenario: abandoned AWS S3 buckets and other orphaned cloud storage that can be re-registered, repurposed, and used to serve malicious content to systems that still “trust” the old source. We walk through why this turns into a supply chain-style problem, what signals to look for, and the practical mitigations that matter most: proper dec...

en

32:20

CCT 361: Bad Epoll - Root Access in 6 Instructions

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/07/13

Send us Fan Mail A six-instruction timing glitch in the Linux kernel can be the difference between “low-priv user” and full root control, and that is why we dig into the Bad EPoll vulnerability from a CISSP-ready, manager-first angle. We start by grounding what the Linux kernel EPoll subsystem does, why it is foundational to high-performance I/O, and why “just disable it” is not a real option when you’re dealing with production Linux servers, desktops, cloud workloads, and Android devices. T...

en

23:28

CCT 360: SSA Whistleblower and the Thumb Drive: What...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/07/06

Send us Fan Mail Imagine hearing a claim that the most sensitive identity data in the United States could be sitting on a personal thumb drive. That allegation is still unverified and under investigation, but it gives us a rare chance to see CISSP Domain 2 asset security in real time, with consequences that go far beyond a typical data breach. I walk through what’s being reported about Social Security Administration data access and potential copying, then I put on the Domain 2 lens: data cla...

en

43:08

CCT 359: ShinyHunters vs. Oracle — Supply Chain Risk...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/06/29

Send us Fan Mail A vendor gets breached and suddenly your perimeter does not matter, because the attacker does not need to “hack” you. They just reuse the access you already approved. That’s the core lesson behind the Shiny Hunters campaign targeting Oracle PeopleSoft servers at colleges and universities, where compromised access led to large-scale theft of student data and a messy, high-impact supply chain incident. We walk through what supply chain security really means for modern cybersec...

en

43:02

CCT 358: EDR Bypass Ransomware: The Gentle Killer...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/06/22

Send us Fan Mail Your endpoint tool can be world class and still get taken out first. That’s the unsettling reality behind a new wave of “EDR killer” capabilities being packaged inside ransomware-as-a-service platforms, where affiliates can plug in advanced evasion without building it themselves. When attackers can blind endpoint detection and response before the ransomware payload runs, the old comfort of “we have EDR, so we’re covered” turns into a single point of failure. We unpack the re...

en

32:09

CCT 357: Is Your Encrypted Data Already Stolen?...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/06/15

Send us Fan Mail Someone is stealing encrypted data right now and they are not trying to read it today. They are saving it for later, betting that quantum computing will eventually break the encryption that protects it. I dig into the “Harvest Now, Decrypt Later” strategy, why it matters most for long-term confidentiality, and how security leaders can talk about it as a present-day risk instead of science fiction. From there, I get practical with post-quantum planning: what the NIST post-qua...

en

41:38

CCT 356: Supply Chain Attacks Are Exploding in 2026 —...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/06/08

Send us Fan Mail Your software is only as trustworthy as the dependencies you quietly inherit and attackers know it. Today I break down the NCSC warning on software supply chain security and why open source package ecosystems have become a high-value target for real-world compromises that spread fast through CI/CD pipelines. I walk through the attack patterns that keep showing up in incidents: maintainer account compromise, expired domain takeover, typosquatting, and credential chaining. We ...

en

24:26

CCT 335: Zapier Breach Lessons For Cloud Security and...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/06/04

Send us Fan Mail The breach that takes down a company often does not kick in the front door. It walks in through a “simple” integration you set up months ago, powered by a token no one remembered to rotate. We start with a real-world Zapier-style scenario and unpack how researchers chained together a harmless-looking code block, an AWS Lambda environment, and a misconfigured IAM role to reach private repository files and ultimately an NPM token that could enable a supply chain attack. From t...

en

37:28

CCT 354: Data Security Controls and Compliance...

CISSP Cyber Training Podcast - CISSP Training Program ·

2026/06/01

Send us Fan Mail Your firewall can be patched tomorrow, but what about the place your system hides its real secrets today? We start with a timely warning about a serious Fortinet FortiGate vulnerability and why perimeter devices are still a make-or-break control, then we pivot into the deeper layer most people ignore until it’s too late: memory. We walk through CISSP Domain 3.4 by focusing on what memory protection is actually trying to achieve: confidentiality, integrity, and process isolat...

en

377 results

Similar Podcasts

Les dents et dodo

BFMTV

Daily Facts

Amalia Dupray and Montgomery Jones.

Education Futures

Svenia Busson & Laurent Jolie

Out In The Hall

NHSA

Reading Teachers Lounge

Shannon Betts and Mary Saghafi