CISSP Cyber Training Podcast - CISSP Training Program cover art

CISSP Cyber Training Podcast - CISSP Training Program

CISSP Cyber Training Podcast - CISSP Training Program

By: Shon Gerber vCISO CISSP Cybersecurity Consultant and Entrepreneur
Listen for free

This Season's Biggest Deal | $0.99/mo for 3 months + $20 Audible bonus

Auto-renews at $8.99/mo. after 3 months - terms apply.
Summary

Join Shon Gerber on his weekly CISSP Cyber Training podcast, where his extensive 23-year background in cybersecurity shines through. With a rich history spanning corporate sectors, government roles, and academic positions, Shon imparts the essential insights and advice necessary to conquer the CISSP exam. His expertise is not just theoretical; as a CISSP credential holder since 2009, Shon translates his deep understanding into actionable training. Each episode is packed with invaluable security strategies and tips that you can implement right away, giving you an edge in the cybersecurity realm. Tune in and take the reins of your cybersecurity journey—let’s ride into excellence together! 🚀

© 2026 CISSP Cyber Training Podcast - CISSP Training Program Education
Episodes
  • CCT 378: Two Feeds, Full Backup, And The Generators Never Started (Domain 3)

    CCT 378: Two Feeds, Full Backup, And The Generators Never Started (Domain 3)
    Nov 9 2026
    Send us Fan MailCISSP Domain 3.9 — design site and facility security controls, built on a real data center power failure where every control in the building worked and the building still went dark.Start free: https://www.cisspcybertraining.com/free-cissp-self-study (360 practice questions, a Domain 1 diagnostic, weekly questions by email, and the slides from this episode)In October, a cloud provider's London data center lost its utility power. The batteries picked up the load exactly the way they were supposed to, ran for about five minutes, and then ran out. The generators should have taken over in that window. They never got the signal.Nobody attacked anybody here. There are no bad guys in this one. No ransomware, no intrusion, nothing for incident response to chase. It was a cable fault outside the building and a logic error inside it.HOW THE BUILDING WAS BUILTStart with the design, because the design was good. Two completely independent utility feeds coming in from the power company — they call them A and B. Google's own words for that are a 2N utility power architecture.Now listen to where that label stops. Behind both of those feeds sits one central bank of high-voltage generators, run by a dual-redundant controller, a PLC. Two of the thing coming in. One of the thing that was supposed to save them. And between the utility going away and the generators coming up, a battery system with about five minutes of runtime. That isn't a lot and it isn't supposed to be. It's a bridge.So when somebody tells you a site is 2N, the only honest follow-up is: 2N at which layer?Five days before any of this, they ran a quarterly load test on the generators. A real test, under load. And that test found a problem. So they did the right thing — they scheduled the repair. But to do the repair they had to physically open the breaker on feed B and lock it out, which they did properly: keyed interlock, locked out, tagged out.And that is the moment the building stopped being 2N on the utility side. For several days — Google doesn't publish exactly how many — that site ran on one utility feed. Google's own words for it are a temporary single-feed, 1N, bridged maintenance posture.Then the cable broke. An underground cable out on the utility network, outside the building entirely, developed a fault. And it was on feed A. The only feed that was live.WHY THE GENERATORS NEVER STARTEDThe PLC decides when to start the generators, and it decides it by sensing voltage. If the voltage goes away, start the generators. Simple enough.But those voltage sensors were wired upstream of the feed breakers. On the line side. And feed B — the one that was open for repairs — was still energized upstream, all the way up to that open breaker. The power company was still feeding it. It just wasn't connected to the building anymore.So the PLC looks at its sensor, sees voltage on feed B, concludes that a healthy utility source is available, and never issues a start command.Google's own root cause is this: a misconfiguration of the PLC logic that did not verify both an undervoltage condition and physical breaker position for both utility feeders. It checked whether there was voltage. It never checked whether that voltage was actually connected to anything.And here's the part worth a line in your notes. That PLC was dual-redundant. There were two of them. Both of them were wrong in exactly the same way, because they shared a configuration. Duplicating the box does not duplicate the judgment. That's common-mode failure, and it is the reason a redundancy count is not a resilience measurement.Five minutes later the batteries were done and the data halls went dark.TWO NUMBERS, KEPT APARTAbout ninety minutes with the data halls unpowered. Six hours and eight minutes before the services on top of them were whole again. Both figures are in Google's report and they measure different things. According to The Register, the companies caught in that window included Lloyds, HSBC, Royal Mail and Revolut — Google published no customer list and no customer count.To their credit, Google published the whole thing: the timeline, the wiring, the root cause, and a list of fixes with dates on them. One of those action items is the most honest line in the document. They committed to making PLC code review part of facility commissioning — which tells you it wasn't.THE MANAGER'S TAKEAWAYTwo things, and neither one is "test your generators."They DID test. The quarterly load test is what found the fault in the first place. What nobody did was look at the consequence: fixing that fault meant opening a breaker, and opening that breaker meant the building ran on one feed for days. As far as anybody treated it, that was a maintenance ticket. It wasn't a changed risk posture.And the second one, the one to carry into the exam room: an automatic control is only as good as the thing it can sense. The generator was perfect. The battery was perfect. The logic was asking...
    Show More Show Less
    43 mins
  • CCT 377: 155 Answers, Nobody Broke In, And The Control Nobody Named (Domain 2)

    CCT 377: 155 Answers, Nobody Broke In, And The Control Nobody Named (Domain 2)
    Nov 2 2026
    Send us Fan MailCISSP Domain 2.6 — data security controls, compliance requirements, and the three states of data, built on an AI hosting exposure that encryption could never have reached, because the data was exposed while it was being used.Start free: https://www.cisspcybertraining.com/free-cissp-self-study (360 practice questions, a Domain 1 diagnostic, weekly questions by email, and the slides from this episode)One hundred and fifty-five answers went to the wrong people. Nobody broke in.In late August, Cloudflare launched the GLM-5.3 model on Workers AI. The model advertised a context window of just over one million tokens. The memory pool behind it — the prefill KV cache — held about six hundred and eighty thousand. The pool was smaller than the thing it was advertised to hold.Picture a shared workbench with a scratch pad on it. You sit down, you do your working-out, you get up and leave. In a well-run shop somebody wipes that pad before the next person sits down. That pad is memory, and wiping it is the control.When a request came in too big for the pad, the system marked it rejected, which was correct, and then passed the pad downstream anyway. The next stage read it, found the previous request's working still on it, and handed that back as a successful answer. Not an error. An HTTP 200.155 responses were affected, every one from a prompt over the pool's limit. Cloudflare said only that a small number of customers were involved and published no customer count. It found no evidence of deliberate exploitation. This was an exposure — nothing was taken, nobody broke in — and the misconfigured value and the serving-engine behavior both sat in the hosting stack, not with the model's maker. The advertised context length itself was accurate.Security researcher Gadi Evron of Knostic reported it through HackerOne. Cloudflare began verifying it the next morning and reproduced it from two independent accounts within twenty-five minutes of declaring the incident — and the model was offline about fifteen hours after the report landed. Root cause thirty-five minutes later, corrected configuration seventeen minutes after that. It raised the pool to roughly twice the advertised window, moved retirement of rejected requests to the admission queue before any cache transfer, added a deployment check comparing pool size to context length, and published the whole timeline itself.Now the part that turns it into exam content. Encryption at rest and encryption in transit were never going to touch this one. Not because anything was wrong with them. Because neither one has a single thing to say about data while it is being used.And they knew. Cloudflare knew before launch that the two numbers disagreed. It assumed the engine would handle it cleanly, and what it validated was the status code and the performance — not the answer coming back. The engine said 200 OK, so it looked fine. It was not a secret. It was an assumption nobody had validated, standing in for a control nobody owned.A control is not a control because of what it is called. It is a control because of what fails when it is wrong.In this episode:• The three states of data — at rest, in transit, in use — and why the third is the one you get tested on. At rest and in transit are cryptography questions. In use is an isolation question, and cryptography alone does not reach it. Confidential computing is the exception.• The data-in-use control vocabulary: memory isolation, zeroization between requests, object reuse controls, confidential computing, homomorphic encryption and admission control. Object reuse is the classic ISC2 phrasing for this failure shape.• Scoping and tailoring, and the precision trap. Scoping is not a step before tailoring — it is one of the six tailoring actions NIST SP 800-53B names, and an option that sequences them is the distractor.• Standards selection and baselines: ISO 27001, NIST SP 800-53 and 53B, CSF 2.0, CIS, the Cloud Controls Matrix, PCI DSS and SOC 2, taught by differentiator rather than contents. A baseline is a floor, not a fit.• Data protection methods — DRM, DLP, CASB, tokenization and masking — and why not one of them would have caught this. Every one reads a content flow.• Multi-tenancy and shared responsibility, and the control each side assumed the other already owned.• The crossover, named out loud: "should we accept this?" is Domain 1. "How is it enforced?" is Domain 3. "What does this data require?" is 2.6, and that is this episode.• Four CISSP practice questions and the trap inside each one. Question two is the one that gets people.The line to carry into the exam room: Domain 2.6 does not ask you to list encryption types. It asks which controls this data, in this state, in this environment actually requires — and then whether anybody owns them as requirements.LINKSFree CISSP Essentials:https://www.cisspcybertraining.com/free-cissp-self-studyAll episodes and the written ...
    Show More Show Less
    43 mins
  • CCT 376: Investigation Types and the Device Behind the Television (Domain 1)

    CCT 376: Investigation Types and the Device Behind the Television (Domain 1)
    Oct 26 2026

    Send us Fan Mail

    A company found a concealed recording device in the room where its executives meet. They pulled it, imaged it, reviewed the camera footage, went through the employee's internal tool usage, found a second device in a bag he had left in another room, terminated him and referred the matter to the FBI.

    Every one of those steps was reasonable. And somewhere in the middle of that list, the investigation stopped being theirs.

    This episode is CISSP Domain 1.6 — requirements for investigation types. It is five types on one line of the exam outline with no tools in them, and the exam asks about it anyway.

    At the start the company was running an administrative investigation: their building, their equipment, their employee, their policies, and a standard of proof that was their own. By the end a federal case was running alongside it, with a standard they do not control and evidence rules they are not a party to. Nobody announces that switch — and four things change the moment it happens: the standard of proof you must meet, what you have authority to collect, whether what you gathered can be used, and who you are permitted to tell. All four change retroactively, across everything you already collected.

    In this episode:

    · All five investigation types — administrative, criminal, civil, regulatory, industry standards — and what each one can actually do to you


    · Why the type follows whose AUTHORITY the inquiry runs under, not the conduct and not the severity


    · Burden of proof by type, and why administrative is the one standard the organization sets for itself


    · Chain of custody worked step by step from the real case, including the bag that cannot be un-opened


    · Why a forensic image that produced no readable data is still a finding, and why process produces admissible evidence while content produces a conclusion


    · The five characteristics of evidence, and why only four of them are properties of the evidence


    · Civil preservation: the duty attaches when litigation is reasonably anticipated, not when a complaint is served


    · Regulatory: the regulator sets the scope and can compel production, so your own investigation discharges nothing


    · Industry standards: a contractual obligation, where the contract names who is permitted to do the work


    · What a manager decides before any of it — naming the type out loud, setting the referral trigger in advance, and collecting as though the type will change


    It closes with four scenario questions, spread deliberately across all five types. Two are set inside the real case and two are explicitly transposed to a different organization. Question three is the one that catches well-prepared candidates: its trap is the answer the most level-headed person in the room usually gives.


    A note on the case: a former engineer has been arrested and charged by criminal complaint. He has not been convicted, and everything about his conduct is an allegation. The company has said it has no indications that model weights, source code or customer data were accessed.


    Source: U.S. Department of Justice, Office of Public Affairs press release, October 2026.


    Newsroom: https://www.justice.gov/news


    Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox.


    Go to CISSPCyberTraining.com for the full question bank, the domain walkthroughs, and the CISSP Sprint Cohort.

    Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.

    Join now and start your journey toward CISSP mastery today!
    Show More Show Less
    42 mins
No reviews yet
In the spirit of reconciliation, Audible acknowledges the Traditional Custodians of country throughout Australia and their connections to land, sea and community. We pay our respect to their elders past and present and extend that respect to all Aboriginal and Torres Strait Islander peoples today.