Reduce Cyber Risk Podcast - Cyber Security Made Simple

Latest Episodes:

RCR 105: Manage Engineering Secure Design (CISSP Domain 3) Feb 20, 2023

Show notes

Shon Gerber from CISSPCyberTraining.com provides you the information and knowledge you need to prepare and pass the CISSP Exam while providing the tools you need to enhance your cybersecurity career. Shon utilizes his expansive knowledge in cybersecurity from being a Red Team Squadron Commander; Chief Information Security Officer (CISO); and Adjunct Professor providing superior training from his years of experience in educating people in cybersecurity.

In this episode, Shon will talk about the following items that are included within Domain 3 (Security Architecture and Engineering) of the CISSP Exam:

· CISSP / Cybersecurity Integration – Trusted Computing Base (TCB)

· CISSP Training – Manage Engineering Processes Using Secure Design

· CISSP Exam Question – CIA / TPM

BTW - Get access to all my Training Courses here at: https://www.cisspcybertraining.com

Want to find Shon Gerber / CISSP Cyber Training elsewhere on the internet?

LinkedIn – www.linkedin.com/in/shongerber

CISSPCyberTraining.com - https://www.cisspcybertraining.com/

Facebook - https://www.facebook.com/CyberRiskReduced/

LINKS:

ISC2 Training Study Guide

https://www.isc2.org/Training/Self-Study-Resources

Quizlet

https://quizlet.com/87472460/official-isc-cissp-domain-1-security-and-risk-management-flash-cards/

Tech Target

https://searchsecurity.techtarget.com/definition/trusted-computing-base

Wikipedia

https://en.wikipedia.org/wiki/Trusted_computing_base

Wiley

https://testbanks.wiley.com/WPDACE/Quiz

Transcript:

Hey all is Sean Gerber again with reduced cyber risk And I hope you're all having a beautiful day today. It's a gorgeous day here in Wichita Kansas. It's it's just couldn't ask for anything better So it's an awesome day And in Wichita Kansas. Well today we have some great things that we're going to be happening in the CIS S S P training field And we're going to be talking today on our C I S S P is security integration is going to be around trusted computing base, otherwise known as the TCB. Our overall training can be on domain two and we're going to be talking around managing engineering processes, using secure design. And then finally the CISP exam question is going to be focusing on the CIA triad goal and TPM. Trusted platform module I think is what it was Yeah. I think that's what it is There's too many acronyms Can't keep track of them all, but we'll get into that here in just a little bit. But before we do I want to get quick, put a quick shout out about my CIS S P training courses that are available for your purchase. At umami.com and you can catch those up at. you tummy You also can go to reduce cyber risk.com/c I S S P dash training. And you can get access to the UME courses that I have available I have put out there all of the CIS S P courses. Domains one throug

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 104: Data Remanence (CISSP Domain 2) Feb 20, 2023

Show notes

In this episode, Shon will talk about the following items that are included within Domain 2 (Asset Security) of the CISSP Exam:

· CISSP / Cybersecurity Integration – Data Remanence - Rainbow Series

· CISSP Training – Protecting Privacy

· CISSP Exam Question – Sensitive Data / Destroying Hard Drive

BTW - Get access to all my Training Courses here at: https://www.cisspcybertraining.com

Want to find Shon Gerber / CISSP Cyber Training elsewhere on the internet?

LinkedIn – www.linkedin.com/in/shongerber

CISSPCyberTraining.com - https://www.cisspcybertraining.com/

Facebook - https://www.facebook.com/CyberRiskReduced/\

LINKS:

ISC2 Training Study Guide

https://www.isc2.org/Training/Self-Study-Resources

Quizlet

https://quizlet.com/87472460/official-isc-cissp-domain-1-security-and-risk-management-flash-cards/

Misc.:

https://thorteaches.com/cissp-certification-rules-laws-and-regulations-oecd/

OECD

http://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.htm

Rainbow Books

https://fas.org/irp/nsa/rainbow/tg025-2.htm

https://gxait.com/network-security/data-remanence-putting-business-risk/

Transcript:

…Hey all is Shon Gerber again with reduced cyber risk And I hope you're all having a wonderful morning. I'm having a great morning My kids are heading off to, to camp this today So I am extremely excited about that They have, I have five children still at home and they are all going to camp. and it is an exciting exciting time. I don't know if any of you all have children might be living out there, but anytime that you can get away from the kids or the kids can get away from you. It's a wonderful blessing And you think those your lucky stars for having those little blessings Because, yeah it's going to be a super quiet in the house and I'm pretty excited about that because it'll just be my wife and me and the dogs It'll be pretty awesome. so yeah, that's just had to give that a little bit of a tidbit out there about that. So one of the things that we're going to be talking about today a lot of great cybersecurity aspects that are going to be dealing with train

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 103: Compliance Requirements (CISSP Domain 1) Feb 13, 2023

Show notes

In this episode, Shon will talk about the following items that are included within Domain 1 (Security and Risk Management) of the CISSP Exam:

· CISSP / Cybersecurity Integration – HITECH

· CISSP Training – Compliance Requirements

· CISSP Exam Question – Preventive Controls / CIA Triangle

BTW - Get access to all my Training Courses here at: https://www.cisspcybertraining.com

Want to find Shon Gerber / CISSP Cyber Training elsewhere on the internet?

LinkedIn – www.linkedin.com/in/shongerber

CISSPCyberTraining.com - https://www.cisspcybertraining.com/

Facebook - https://www.facebook.com/CyberRiskReduced/

LINKS:

ISC2 Training Study Guide

https://www.isc2.org/Training/Self-Study-Resources

Quizlet

https://quizlet.com/87472460/official-isc-cissp-domain-1-security-and-risk-management-flash-cards/

Tech Target

https://searchsecurity.techtarget.com/quiz/Cybersecurity-risk-management-CISSP-practice-exam

Compliancy Group

https://compliancy-group.com/what-is-the-hitech-act/

Wikipedia

https://en.wikipedia.org/wiki/Arms_Export_Control_Act

Wiley

https://testbanks.wiley.com/WPDA

Transcript:

Hey Alice younger from reduced cyber risk and I hope you're all having a wonderful day in this beautiful state of Kansas I'm having a great day It's 75 degrees is going to be gorgeous today. It can be a little warm which is awesome It's also going to be just a little bit on the cool side in the evening which is even better. And the mosquitoes haven't come out yet That are the size of birds. I saw some small spiders running around which are quite large actually but yeah that's not bad My dog just eats those. But other than that life is good here in Kansas And we are going to be taught about some awesome things as it relates to cybersecurity today on today's podcast. But before we do I wanted to kind of go talk to you a little bit about Ru cyber risk and some great training that I've got out there for you specifically. And this is CIS S P train that you can get through you to me right now It's awesome You can just go to the site You to me and you can search for my name Sean dot Gerber or you can click on the show notes and I've got a great link to it on CISP training at reduced cyber risk. And it wil

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 102: CISSP Salary to Testing Setting Expectations Feb 06, 2023

Show notes

In this episode, Shon will discuss the salaries associated with the CISSP and other cybersecurity roles. Also, he will discuss about setting the expectations as it relates to taking the CISSP exam.

BTW - Get access to all my Training Courses here at: https://www.cisspcybertraining.com

Want to find Shon Gerber / CISSP Cyber Training elsewhere on the internet?

LinkedIn – www.linkedin.com/in/shongerber

CISSPCyberTraining.com - https://www.cisspcybertraining.com/

Facebook - https://www.facebook.com/CyberRiskReduced/

Transcript:

Hey all is Shon Gerber with a C I S S P cyber training and reduce cyber risk podcast I hope you all are doing well This beautiful day. And just say it's great here in Wichita Kansas So I love it It's awesome. So quick question for you We are just today we're…episode five This is the ongoing series around how basically. The CIS S P cyber training got started. And we're just now rolling into this next podcast We're going to be talking a little bit about CISP expectations around salaries and so forth. But before we do we'll kind of talk back about what we did And we, we discussed in the last episode and it was around understanding the CIS S P certification and preparing for the future. One of the points brought up is that it you are certified you do run the the ability to potentially make at least 22% more than being non-certified. Now I've seen that article out there and I I've quoting that but at the end of the day it really comes down to experience So having the cert is extremely valuable. However having the experience is as much if not more So, so just kind of coupling to just consider as you're looking at this. We talked about the CISP and the requirements around it as well as having the experience needed to become a CISP. There's a all the three areas the three concentrations would be your architecture engineering and management. And then we also discussed a little bit around the associate CISP and the additional certifications as it relates to security plus and network plus. So that was just kind of the last podcast and servers are a four And. The ultimate point was just to kind of walk through these different areas and to give you an idea of where we're at. So now as we're dealing with expectations around the CISP and taking the exam, one of the big things that you see I see online quite for. is around the salary as it comes to being in the cyber security. Now there's a lot of things that will break down the salary and I've got training at over at CISP cyber training I've got a an actual training specifically and you might even see it on YouTube Cause I'll put it out there. Where around what can you expect based on the role that you're looking to do? And a lot of things When you start off as a an individual that's trying to get into security into the cyberspace. Your pay can change quite substantially depending upon the role that you actually take. Now I pulled off via C squared They they have uh, an article there on their website and they're the ones

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 101: Understanding the CISSP Certification and Preparing for the FutureRCR 101: Understanding the CISSP Certification and Preparing for the Future Jan 31, 2023

Show notes

This is the first episode of CISSP Cyber Training.com. In this episode, Shon will talk about his background and how he has been successful in cybersecurity.

BTW - Get access to all my Training Courses here at: https://www.cisspcybertraining.com

Want to find Shon Gerber / CISSP Cyber Training elsewhere on the internet?

LinkedIn – www.linkedin.com/in/shongerber

CISSPCyberTraining.com - https://www.cisspcybertraining.com/

Facebook - https://www.facebook.com/CyberRiskReduced/

…Hey y'all Shon Gerber with. CISSP cyber training.com and reduce cyber risk podcast. So how are you all today It's a beautiful day here in Wichita Kansas and it is an amazing amazing place to live in a beautiful country that we live in the United States It's awesome. No…Hey all this Shon Gerber with the CISSP cyber risk. No…Hey y'all is Shon Gerber with the CISSP is P cyber training and they reduce cyber risk podcast. Hope you all are having a wonderful wonderful day to day. So I'm having an awesome day here in Wichita Kansas It just it's amazing It's very nice It's actually the weather it's beautiful to bike 45 degrees So it is a great day. Well I hope you all have had a chance to listen to my other podcasts as it relates to the CISSP. Cyber training And the day this is episode four we're going to understand that the title of this is understanding the CISSP S P certification. And preparing for the future. Now, the last podcast we kind of talked a little bit about what how do you get into cybersecurity What is the training path and so forth? And this is kind of a follow onto that to kind of talk about the CISSP as P and why it's important. Now again a little bit about myself. Shon Gerber I've been in cybersecurity for 20 some years and I've got my CISSP and I've been doing this from a level of going from actually having no experience in cyber all the way up to being a chief information security officer So I understand this path and I've taught hundreds of people how to deal with cybersecurity from both from learning how to be a hacker up to the point of. Getting their CISSP. So I'm here to help you in your path Well, one of the things that comes out of this. is understanding how do you do this? Well, as we talk about how do you get your CISSP a couple things have come up from the conundrum around, how do I get my training How do I get into cyber And we answered that in the last podcast. Around some of the questions they have you know most of my students that I teach in college and I've taught in the past, they really come back and say they have really no idea what are the next steps. And so we went over that in the last podcast What are the next steps in How, what can you do to get past that space that space. The other thing is we had questions from business leaders around how do I find people in find open roles Well again, how do we get there with a train that's tied to that? And what can you do to become successful? And so we walked about that in the last episode but today we're actually now going to talk a little bit about

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 100: Reduce Cyber Risk / CISSP Cyber Training.com Jan 31, 2023

Show notes

This is the first episode of CISSP Cyber Training.com. In this episode, Shon will talk about his background and how he has been successful in cybersecurity.

BTW - Get access to all my Training Courses here at: https://www.cisspcybertraining.com

Want to find Shon Gerber / CISSP Cyber Training elsewhere on the internet?

LinkedIn – www.linkedin.com/in/shongerber

CISSPCyberTraining.com - https://www.cisspcybertraining.com/

Facebook - https://www.facebook.com/CyberRiskReduced/

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 098: CISSP Cyber Training Introduction - Shon Gerber Jan 30, 2023

Show notes

Description:

This is the first episode of CISSP Cyber Training.com. In this episode, Shon will talk about his background and how he has been successful in cybersecurity.

BTW - Get access to all my Training Courses here at: https://www.cisspcybertraining.com

Want to find Shon Gerber / CISSP Cyber Training elsewhere on the internet?

LinkedIn – www.linkedin.com/in/shongerber

CISSPCyberTraining.com - https://www.cisspcybertraining.com/

Facebook - https://www.facebook.com/CyberRiskReduced/

Transcript:

Hey everyone This is Shawn Gerber with CIS. Cyber training.com and reduce cyber risk podcast. I hope you all are having a beautiful day today And I will tell you that it is amazing here in the great state of Kansas in the United States. it is an awesome awesome day Actually It's about 42 degrees and I can't complain 40 degrees Fahrenheit That is so for my friends that are in India, that's a little bit different than what you guys have from a temperature standpoint. but as it relates to the CIS. And studying for the CISSP. I am just bringing forward this podcast I've been in business for a while but I want to talk a little bit about that but I'm bringing forward this podcast to help give you some understanding and training around taking the CISSP exam. So before we get started this is podcast 0 0 1 obviously the first, but you can also check out some of my other podcasts on reduced cyber risk podcast And I'll kind of get into the reason behind both of those but at the end of the day is this is just kind of an intro for those that are starting to listen to my podcast, why I'm doing it and who I am. So a little bit about myself So I am I grew up in a very small town in Iowa So just to state north of where I'm at in Kansas. And I was basically I've been there was there my entire life growing up. So the town was from the folks that I've met around the globe is about 250 people which is extremely small as it relates to a place to be from. Now as I got family that I've got kids that are from China You know obviously the smallest town in China in many cases is like a million people. So out of two hundred fifty, two hundred and fifty people. It's pretty tiny It's about the size of a block. but again I've been based out of the United States and I've lived now in Kansas in Wichita Kansas which is in the middle of the United States. And I'm married to a beautiful wife of 30 years And I am just completely amazed at what that she still sticks with me, but I. have been married for about 30 years to Trish Gerber and she's amazing lady. I have seven children and I am basically a son-in-law and a potential son-in-law that might be happening here in the near future. I have my children as you may Abby asking going. Y seven Yeah Well, I only have three biological that my wife and I produced but we have four adopted kids that are from Uganda. China and. Yeah those those two places So we have three kids from China We have one from Uganda. Now the reason I was had a pause is my potential future Son-in

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 097: CISSP Exam Questions and the CIA Triangle - CISSP Training and Study! Jul 18, 2020

Show notes

Subscribe: iTunes | Goggle Play | Stitcher Radio | RSS

Description:

Shon Gerber from CISSPCyberTraining.com provides you the information and knowledge you need to prepare and pass the CISSP Exam while providing the tools you need to enhance your cybersecurity career. Shon utilizes his expansive knowledge while providing superior training from his years of training people in cybersecurity.

Shon will provide CISSP training and study around the tools you need to better understand what you need to know to be better prepared for the CISSP Exam Questions. His knowledge will provide the skills needed to pass the CISSP Exam.

BTW - Get access to all my Free Content and CISSP Training Courses here at: https://www.cisspcybertraining.com/

CISSP Exam Questions

Question: 165

Steve has found out that the software product that his team submitted for evaluation did not achieve the actual rating they were hoping for. He was confused about this issue since the software passed the necessary certification and accreditation processes before being deployed. Steve was told that the system allows for unauthorized device drivers to be loaded and that there was a key sequence that could be used to bypass the software access control protection mechanisms. Some feedback Steve received from the product testers is that it should implement address space layout randomization and data execution protection.
Which of the following best describes an item the software development team needs to address to ensure that drivers cannot be loaded in an unauthorized manner?
A. Improved security kernel processes
B. Improved security perimeter processes
C. Improved application programming interface processes
D. Improved garbage collection processes

If device drivers can be loaded improperly, then either the access control rules outlined within the reference monitor need to be improved upon or the current rules need to be better enforced through the security kernel processes. Only authorized subjects should be able to install sensitive software components that run within ring 0 of a system.

https://www.brainscape.com/subjects/cissp-domains

------------------------------------

Question: 166

Steve has found out that the software product that his team submitted for evaluation did not achieve the actual rating they were hoping for. He was confused about this issue since the software passed the necessary certification and accreditation processes before being deployed. Steve was told that the system allows for unauthorized device drivers to be loaded and that there was a key sequence that could be used to bypass the software access control protection mechanisms. Some feedback Steve received from the product testers is that it should implement address space layout randomization and data execution protection.
Which of the following best describes Steve’s confusion?
A. Certification must happen first before the evaluation process can begin.
B. Accreditation is the acceptance from management, which must take place before the evaluation process.
C. Evaluat

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 096: CISSP Exam Questions with Confidentiality - CISSP Training and Study! Jul 15, 2020

Show notes

Subscribe: iTunes | Goggle Play | Stitcher Radio | RSS

Description:

BTW - Get access to all my Free Content and CISSP Training Courses here at: https://www.cisspcybertraining.com/

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

RCR 095: Cybersecurity Career - CISSP Training and Study! Jul 13, 2020

Show notes

Subscribe: iTunes | Goggle Play | Stitcher Radio | RSS

Description:

BTW - Get access to all my Free Content and CISSP Training Courses here at: https://www.cisspcybertraining.com/

CISSP Exam Questions

Question: 168

Sarah’s team must build a new operating system for her company’s internal functionality requirements. The system must be able to process data at different classifications levels and allow users of different clearances to be able to interact with only the data that maps to their profile. She is told that the system must provide data hiding, and her boss suggests that her team implement a hybrid microkernel design. Sarah knows that the resulting system must be able to achieve a rating of EAL 6 once it goes through the Common Criteria evaluation process.
Which of the following is a characteristic that this new system will need to implement?
A. Multiprogramming
B. Simple integrity axiom
C. Mandatory access control
D. Formal verification

Since the new system must achieve a rating of EAL 6, it must implement mandatory access control capabilities. This is an access control model that allows users with different clearances to be able to interact with a system that processes data of different classification levels in a secure manner. The rating of EAL 6 requires semiformally verified design and testing, whereas EAL 7 requires verified design and testing.

https://www.brainscape.com/subjects/cissp-domains

------------------------------------

Question: 169

Sarah’s team must build a new operating system for her company’s internal functionality requirements. The system must be able to process data at different classifications levels and allow users of different clearances to be able to interact with only the data that maps to their profile. She is told that the system must provide data hiding, and her boss suggests that her team implement a hybrid microkernel design. Sarah knows that the resulting system must be able to achieve a rating of EAL 6 once it goes through the Common Criteria evaluation process.
Which of the following reasons best describes her boss’s suggestion on the kernel design of the new system?
A. Hardware layer abstraction for portability capability
B. Layered functionality structure
C. Reduced mode transition requirements
D. Central location of all critical operating system processes

A hybrid microkernel architecture means that all kernel processes work within kernel mode, which reduces the amount of mode tran

Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Reduce Cyber Risk Podcast – Cyber Security Made Simple

Related Podcasts

Links

Stay Connected