Buffer Overflow and the Stack Canary Explained for CISSP
How a buffer overflow overwrites the return address, how a stack canary detects it before the return, and why the fix belongs in the code, not the platform.
THE LIBRARY
Articles
Dual Control vs Separation of Duties: What Is the Difference?
Separation of duties splits a workflow across people and stages. Dual control makes two people act together on one action. The difference is when they act.
End of Life vs End of Support: The Two Dates CISSP Candidates Confuse
What End of Life and End of Support mean, why only the second date is a security cliff, and how CISSP scenarios may test the difference between them.
STRIDE Threat Model Explained: The Six Categories and What They Break for CISSP
STRIDE sorts threats into six categories, each the mirror of a security property it breaks. It finds threats thoroughly but does not rank them.
Need to Know vs Least Privilege: What Is the Difference?
Need to know asks whether you require this specific information. Least privilege asks what the minimum authority for the task is. Clearance settles neither.
Trusted Computing Base Explained: Reference Monitor, Rings and Security Kernel for CISSP
What the trusted computing base includes, where its security perimeter sits, and how the reference monitor, security kernel and protection rings enforce it.
Security Assessment vs Security Audit: What Is the Difference?
An assessment advises the organisation and can be self-performed. An audit gives an outsider a formal opinion, so independence is mandatory.
Business Impact Analysis Explained: The BIA Process and Outputs for CISSP
How a business impact analysis finds critical functions, measures impact over time, maps dependencies, and produces the recovery priorities strategy must meet.
Business Continuity Planning Explained: The BCP Lifecycle and Testing for CISSP
The five phases of the BCP lifecycle, how BCP differs from DRP, who is accountable for the programme, and the six testing methods in order of disruption.
Quantitative Risk Formulas: SLE, ARO and ALE
The five quantitative risk formulas in the order they run, worked end to end from asset value to a funded decision, plus where the method breaks down.
SPF, DKIM and DMARC: Complete Guide for CISSP
Email authentication for the CISSP: what SPF, DKIM and DMARC each check, why forwarding breaks SPF, and how alignment ties a pass to the visible From.
TOCTOU Explained: Time of Check Time of Use Race Conditions for CISSP
How a TOCTOU race condition turns a passed security check into an exploit, why symbolic links make it dangerous, and how to close the window.
Data Security Roles: Owner, Custodian, Controller and Processor for CISSP
What each data security role does, how owner differs from custodian and controller from processor, and why accountability never transfers with the work.
SOC Reports Explained: SOC 1, SOC 2 and SOC 3 for CISSP
What SOC 1, SOC 2 and SOC 3 cover, how Type 1 differs from Type 2, and what a CISSP candidate needs to know about third party assurance.
Disaster Recovery Sites: Hot, Warm, Cold and Cloud
Hot, warm, cold and cloud recovery sites compared. The BIA sets the RTO, and the RTO picks the site. A CISSP insight with a manager mindset.
Due Diligence vs Due Care: What Is the Difference?
Due diligence is finding out. Due care is acting on what you found. A CISSP insight on the prudent person rule and the evidence that proves both.
Fail Safe vs Fail Secure: What Is the Difference?
Fail safe defaults to open and protects people. Fail secure defaults to locked and protects assets. A CISSP insight on matching the default to the risk.
IPsec AH vs ESP: What Is the Difference?
AH authenticates but never encrypts and breaks through NAT. ESP encrypts, authenticates and traverses NAT. A CISSP insight on the IPsec protocol choice.
What Is SAST? Static Application Security Testing
SAST reads source code without running it, catching flaws at the cheapest point in the SDLC. A CISSP insight on its strengths, blind spots and CI/CD role.
Silver Ticket Attack: Forging Tickets Past the KDC
How a stolen service account hash forges a service ticket that never reaches the KDC, why that keeps it out of domain logs, and how to catch it.
Bell-LaPadula: No Read Up, No Write Down (CISSP)
The Bell-LaPadula rules in plain terms: no read up, no write down, and why a subject may write above its clearance but never read there.
Biba Model: No Read Down, No Write Up (CISSP)
The Biba rules in plain terms: no read down, no write up, and why integrity inverts the Bell-LaPadula directions it is confused with.
Chinese Wall Model (Brewer-Nash) Explained
How the Chinese Wall model stops consultant conflicts of interest: conflict classes, access that narrows as you read, and dynamic separation of duties.
Clark-Wilson Model: The Access Triple Explained
How Clark-Wilson protects commercial integrity: the access triple, well-formed transactions, separation of duties, and how it differs from Biba.
Graham-Denning: The Eight Protection Rules
The eight Graham-Denning operations for creating and deleting subjects and objects and transferring access rights, and where Harrison-Ruzzo-Ullman extends them.
Certificate Pinning: What Should You Pin First?
The foundational certificate pinning decision: choosing between certificate fingerprints, public key hashes and chain elements. A CISSP exam insight.
What Is the Difference Between Scoping and Tailoring?
Scoping makes binary yes or no calls on whether a control applies. Tailoring customises how it is implemented. A CISSP insight with a manager mindset.
RPO, RTO, WRT and MTD on One Recovery Timeline
How RPO, RTO, WRT and MTD sit on a single outage timeline, and why MTD is the ceiling the other three have to fit inside.
Kerberoasting: Cracking Service Passwords Offline
How any domain user can request a service ticket for an SPN and crack the service account password offline, and why long managed passwords stop it.
Golden Ticket Attack: Forging a TGT from krbtgt
How a stolen krbtgt hash lets an attacker forge any Kerberos TGT, why no domain controller checks it, and why krbtgt must be reset twice.
Kerberos: The Six-Step Ticket Flow Explained
How Kerberos issues a TGT and then service tickets across six messages, what the AS, TGS and KDC each do, and why clock drift breaks logon.