CISSP Cyber Training Podcast - CISSP Training Program

Send us Fan Mail
A “boring” GitHub Actions workflow file should never be able to empty your secrets vault, yet that is exactly what the Ghost Action campaign shows. We walk through GitGuardian’s research and the real mechanics of how attackers use stolen but valid developer tokens to add or modify workflow YAML, scrape secret names from your own repo, and exfiltrate CI/CD secrets to an external endpoint. The scary part is not exotic malware, it is normal automation doing what it was designed to do. 

From a CISSP Domain 8.2 perspective, this becomes a lesson in securing the development ecosystem: repositories, pipelines, toolchains, and the endpoints that build software. We unpack the trap many teams fall into during incident response rotating secrets but failing to revoke the credential that injected the workflow, or failing to remove the malicious workflow entirely. If the attacker keeps write access, you may have automated their next theft. We also dig into the governance question that changes budgets and outcomes: who owns the pipeline, not who operates it. 

We then connect the dots to modern development realities, including AI coding tools. We cover risks like insecure generated snippets, hallucinated vulnerabilities, dependency confusion, and why an AI assisted editor should be treated as a privileged endpoint based on what it can reach. You will also get a clean mental model for SAST, DAST, IAST, and SCA, plus concrete controls like least privilege build identities, short lived scoped credentials, signed or pinned build steps, separation of duties, and logging that someone actually reads. 

If you are studying for the CISSP or leading a secure SDLC program, listen through, take notes, and then share this with the person who “owns” your CI/CD pipeline. Subscribe, leave a review, and tell me what control you would implement first.
Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox!  Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!

Send us Fan Mail
495 organizations woke up and could not get to their servers. Railways. A prefectural police force. A food logistics company that could not receive or ship goods. All on the same cloud provider, all locked out at once.
 
Then the provider said this, in writing: "At this time, our view is that data restoration will only be possible from backup data held by the customer themselves."
 
Read that again. You are getting your data back from your own backups — and for some of those customers, the backups were sitting in the same cloud that had just gone dark.
 
This episode is CISSP Domain 7.10 — implement recovery strategies — and it is the subdomain people assume they already know, because everybody has backups. Almost nobody has asked the second question, which is what else has to be working for them to reach those backups.
 
You keep a spare key to your house. Smart. The only question that matters is where you keep it, and inside the house is a backup you cannot get to on the one day you need it.
 
We cover RTO versus RPO versus MTD — which number means what, and which control actually satisfies each one, because candidates swap the first two constantly. Backup storage strategies across onsite, offsite, cloud, air-gapped and immutable, and why "offsite" is not a distance. Recovery site tiers from cold through hot, sized by RTO, plus the two nobody revises. Reciprocal agreements and the three ways they fail. Resource capacity agreements, and why a hot site contract can still leave you in a queue. Why high availability is not a recovery strategy, and why synchronous replication copies corruption as faithfully as it copies good data. Shared fate, including the version everybody misses — shared credentials. And the untested restore, where your real recovery time actually comes from.
 
Then four practice questions set inside the same scenario. Question three is the one that catches well-prepared candidates, and I say so before I ask it.
 
Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox. Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
 
Join now and start your journey toward CISSP mastery today!
 
Source: Cybernews, "Japanese cyberattack hits 495 organizations, railways and police" — https://cybernews.com/security/japanese-cloud-cyberattack-railways-police-495-organizations-idcf/
Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox!  Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!

Send us Fan Mail
An AI agent gets blocked by access controls, then calmly finds another way in anyway and that is the wake-up call. I use a recent Hacker News story about an automated agent bypassing an Australian government health portal to dig into what CISSP Domain 6.2 is really testing: not your ability to recite a list of techniques, but your ability to manage authorization, scope, and rules of engagement so a “test” does not turn into an intrusion.

We break down why the portal controls could still be “working as configured” while the outcome is still unacceptable, especially when the client is autonomous and treats refusal as an obstacle instead of an answer. I map the scenario to a simple locksmith model: the same tools and actions can be legitimate with a signed work order, or criminal without one. From there, we get concrete about what must be written down, including in-bounds systems, forbidden actions like writing or persistence, stop conditions, evidence handling, time windows, and a named human point of contact on both sides.

Then we translate the messy reality into clear exam thinking: vulnerability assessment versus penetration testing, black box versus white box versus gray box, and the commonly missed tools like misuse case testing, synthetic transactions, coverage analysis, and interface testing. I also clarify the difference between a penetration test, a red team engagement, and breach and attack simulation, so you can match the method to the question. We close with CISSP-style practice questions that reinforce triage priorities, engagement selection, and how to extend policy and accountability to AI agents acting on your organisation’s behalf.

If you want more Domain 6.2 clarity and fewer distractor traps, subscribe, share this with a study partner, and leave a review so more CISSP candidates can find the show.
Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox!  Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!

Send us Fan Mail
A stolen password is annoying. A stolen session token can be invisible, valid, and instantly profitable. Today we dig into a real warning sign from Okta threat intelligence: infostealer malware lifted live session tokens from browsers, and thousands of Google sessions were still working weeks later. No MFA prompt. No brute force. Just a legitimate session replayed by the wrong person, with real dollar damage through unauthorized usage and credits.

We use that story to sharpen the CISSP Domain 5.6 mindset around implementing authentication systems and, more importantly, validating tokens after sign-in. I walk through why authentication and token validation are different security functions with different “owners,” why forcing password resets does not invalidate an attacker’s existing session, and what a token signature does and does not prove. Then we get practical: audience claim checks, expiration and token lifetime ceilings, scope validation, and why “skipping the audience check breaks nothing in testing” is exactly how breaches scale.

We also cover the controls that shrink risk when you cannot reliably detect theft: short access token lifetimes, narrow scoping to limit blast radius, hardware-backed signing key storage, and automated key rotation with defined crypto periods. To lock it in, we run through four CISSP-style questions and explain the traps so you can answer like a risk-focused manager, not a spec reciter.

Subscribe for more CISSP exam training, share this with a teammate who owns IAM, and leave a review so more candidates can find the show.
Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox!  Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!

Send us Fan Mail
One video hotline feels like a single, simple conversation until you trace the call path and realise there may be seven companies involved in making it work. That’s the spark for this training-focused breakdown of CISSP Domain 4.3 secure communication channels, using the viral AI “actress hotline” story to show how modern voice and video collaboration really behaves behind the curtain.

We start with a practical analogy: you think you’re transacting with the waiter, but your meal passes through a hidden chain of people you never met. The same thing happens with telephony, video conferencing, contact centres, telehealth platforms, transcription tools, AI response generation, and cloud infrastructure. Even when every vendor is legitimate, contracted, and disclosed, your security model can fail if it only accounts for the one company you can see.

From there, we get concrete about what CISSP candidates are tested on: who can join a call, what services are attached (recording, transcription, analytics), what survives after the call, and where trust boundaries actually sit. We also tackle a classic trap: encryption in transit can stop interception, but it does not prevent authorised intermediaries like transcription providers or model services from decrypting and processing content. Finally, we connect the dots to retention “clocks” and transborder data flows, including how Domain 4 channel design intersects with Domain 1 legal transfer mechanisms and accountability.

If you’re studying for the CISSP exam or building a real-world secure communications programme, you’ll leave with a clearer mental model and a set of exam-style questions you can use right away. Subscribe, share this with a fellow CISSP candidate, and leave a review so more security pros can find the show.
Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox!  Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.
Join now and start your journey toward CISSP mastery today!