Disaster Recovery Sites: Hot, Warm, Cold and Cloud
Hot, warm, cold and cloud recovery sites compared. The BIA sets the RTO, and the RTO picks the site. A CISSP insight with a manager mindset.
THE LIBRARY
Articles
Due Diligence vs Due Care: What Is the Difference?
Due diligence is finding out. Due care is acting on what you found. A CISSP insight on the prudent person rule and the evidence that proves both.
Fail Safe vs Fail Secure: What Is the Difference?
Fail safe defaults to open and protects people. Fail secure defaults to locked and protects assets. A CISSP insight on matching the default to the risk.
IPsec AH vs ESP: What Is the Difference?
AH authenticates but never encrypts and breaks through NAT. ESP encrypts, authenticates and traverses NAT. A CISSP insight on the IPsec protocol choice.
What Is SAST? Static Application Security Testing
SAST reads source code without running it, catching flaws at the cheapest point in the SDLC. A CISSP insight on its strengths, blind spots and CI/CD role.
Silver Ticket Attacks: Complete Guide for CISSP Candidates
Silver Ticket attacks for the CISSP exam: forging service tickets with a stolen service account hash, why the KDC bypass hides them, and how to defend.
Bell-LaPadula Model: Complete Guide for CISSP Candidates
Master the Bell-LaPadula model for CISSP exam success. Learn how clearances, No Read Up, and No Write Down keep classified information confidential.
Biba Integrity Model: Complete Guide for CISSP Candidates
Master the Biba model for CISSP exam success. Learn how integrity levels, No Read Down, and No Write Up protect trusted data from corruption.
Brewer and Nash Model: Complete Guide for CISSP Candidates
Master the Brewer and Nash (Chinese Wall) model for CISSP. See how conflict of interest classes and dynamic access controls stop competitor data leaks.
Clark-Wilson Model: Commercial Data Integrity for CISSP
Master the Clark-Wilson model for CISSP. Learn how well-formed transactions, separation of duties, and access triplets protect commercial data integrity.
Graham-Denning Model: 8 Operations for CISSP Domain 3
Master the Graham-Denning model for CISSP. Learn the 8 operations for managing subjects, objects, and access rights, plus ownership and transfer.
Certificate Pinning: What Should You Pin First?
The foundational certificate pinning decision: choosing between certificate fingerprints, public key hashes and chain elements. A CISSP exam insight.
What Is the Difference Between Scoping and Tailoring?
Scoping makes binary yes or no calls on whether a control applies. Tailoring customises how it is implemented. A CISSP insight with a manager mindset.
RPO, RTO, WRT and MTD: Essential Disaster Recovery Metrics for CISSP
Master RPO, RTO, WRT and MTD for CISSP exam success: how the four disaster recovery metrics fit on one timeline, with worked examples and exam tips.
Kerberoasting Attacks: Complete Guide for CISSP Candidates
Master Kerberoasting for the CISSP exam: how any domain user extracts service tickets, cracks service account passwords offline, and how to stop it.
Golden Ticket Attacks: Complete Guide for CISSP Candidates
Master Golden Ticket attacks for the CISSP exam: how attackers forge Kerberos TGTs with the krbtgt hash, why detection is hard, and the double reset fix.
Kerberos Authentication: Complete Guide for CISSP
Master Kerberos for the CISSP exam: the ticket based protocol, the AS, TGS and KDC, the six step flow, and why time synchronisation matters.