Subscribe
Share
Share
Embed
Welcome to The Bare Metal Cyber CISSP Prepcast — your essential guide to mastering the CISSP certification. Whether you're just starting your cybersecurity journey or preparing for exam day, this podcast delivers expert insights, practical strategies, and clear explanations to help you succeed. Designed by professionals who’ve walked the path, each episode helps you build confidence, sharpen your skills, and move one step closer to certification success.
Welcome to The Bare Metal Cyber C I S S P Prepcast. This series helps you prepare for the I S C squared C I S S P exam with focused explanations and practical context.
Let’s face it—the C I S S P exam is not easy. Some of the topics you’ll encounter can seem overwhelming or even abstract at first glance. In this episode, we are going to walk through ten of the most difficult concepts that students regularly struggle with. By the end, you’ll have a clearer understanding of each one and feel more confident when facing them on the exam.
These are the kinds of topics that show up in tricky scenario-based questions or are hidden inside distractor-heavy answers. But when you strip them down to their core ideas, they become manageable and even intuitive. So let’s dive in and demystify the hardest parts of your C I S S P journey.
Let’s begin with the security models—something that causes a lot of confusion. You’ll need to be familiar with the Bell LaPadula model, the Biba model, and the Clark Wilson model. Each of these addresses a different security goal, and keeping them straight will help you eliminate wrong answers quickly on the test.
The Bell LaPadula model is all about confidentiality. It focuses on making sure information does not flow to unauthorized places. Its two core rules are “no read up” and “no write down.” That means a user cannot read data from a higher classification or write data to a lower classification. Think of it as protecting secrets from leaking.
The Biba model, on the other hand, is focused on integrity. It reverses the Bell LaPadula logic with “no read down” and “no write up.” This ensures that data can only be touched by trusted sources and remains uncorrupted. It is especially useful in environments where data integrity is more important than secrecy.
The Clark Wilson model is a little different. It uses a system of well-formed transactions and enforces separation of duties to maintain data integrity. It’s very common in commercial systems, such as financial applications, where you need to make sure that only approved processes can change data, and no single person has too much control.
A quick way to remember them is this: Bell LaPadula means confidentiality, Biba means integrity, and Clark Wilson means business process control. Understand their core purpose, and the exam questions will make a lot more sense.
Now let’s talk about cryptographic concepts—specifically symmetric and asymmetric encryption. These are core to understanding how data is protected in transit and at rest.
Symmetric encryption uses a single key that both encrypts and decrypts data. It is fast and ideal for encrypting large amounts of data. However, the challenge is securely sharing that one key with others. If someone intercepts it, your entire system could be compromised.
Asymmetric encryption solves this by using two keys: one public and one private. Anything encrypted with the public key can only be decrypted with the private key, and vice versa. This allows secure key exchange and enables digital signatures. It is slower but more flexible for things like authentication and confidentiality during communication.
To simplify: symmetric encryption is efficient but risky to share; asymmetric encryption is safer to share but less efficient. In most systems, you use asymmetric encryption to exchange keys and symmetric encryption to handle the bulk of the data. If you remember that pairing, it becomes easier to answer related questions on the exam.
Next is risk management—a topic that often appears straightforward but can get tricky during the test. One key area students stumble on is the difference between qualitative and quantitative risk analysis.
Qualitative risk analysis uses subjective methods. You rank risks as low, medium, or high based on likelihood and impact. This is helpful when you don’t have exact numbers but still need to prioritize what to address first. It’s common in organizations without robust historical data or when a fast assessment is needed.
Quantitative risk analysis, however, is all about numbers. It calculates things like the Single Loss Expectancy, the Annualized Rate of Occurrence, and the Annualized Loss Expectancy. These values help leadership understand risks in financial terms, such as the cost of not acting or the potential benefit of mitigation.
Here’s how to keep it clear: qualitative is about perception and priority, while quantitative is about math and money. Match them to the appropriate scenario, and you’ll navigate exam questions more confidently.
For more cyber related content and books, please check out cyber author dot me. Also, there are other podcasts on Cybersecurity and more at Bare Metal Cyber dot com.
Let’s now move into another advanced topic: Common Criteria and Evaluation Assurance Levels. These often trip up students because they sound formal and bureaucratic, but they actually follow a simple logic.
Common Criteria is an international framework used to evaluate the security of information systems and products. It lets buyers and sellers communicate security features in a consistent, standardized way. The key takeaway is that it provides a common language and method for validating security claims.
Evaluation Assurance Levels—or E A Ls—range from E A L one to E A L seven. E A L one is the most basic, offering some functional testing. E A L seven is the most rigorous, requiring formal design verification and structured testing. Most consumer or commercial products sit around E A L two or E A L three.
To remember this, just associate lower E A Ls with less testing and higher E A Ls with more verification. You won’t need to memorize each level, but you should recognize that Common Criteria helps compare the security capabilities of different products and that E A Ls describe the depth of their evaluation.
Now let’s clarify something that always confuses students—business continuity versus disaster recovery. These are closely related but focus on different parts of the recovery process.
Business Continuity Planning, or B C P, is about keeping the entire business running during and after a disruption. It includes alternate work sites, staff reallocation, supply chain management, and more. The goal is to maintain essential functions no matter what happens.
Disaster Recovery Planning, or D R P, is a subset of B C P. It zeroes in on the I T systems—things like restoring servers, recovering lost data, or spinning up cloud services. D R P is more technical and specific, while B C P is broader and strategic.
On the exam, the trick is knowing the scope. If the scenario is about business functions overall, it’s B C P. If it’s focused on information systems or data recovery, it’s D R P. This distinction is subtle but shows up often in test questions.
Let’s finish with another major topic—cloud service models. These include Infrastructure as a Service, Platform as a Service, and Software as a Service. They show up often in domain four and domain five, and understanding their differences is critical.
Infrastructure as a Service, or I A A S, offers virtualized hardware and storage. You manage everything from the operating system up, including the applications, data, and patches. Think of services like Amazon Web Services or Microsoft Azure when you use virtual machines.
Platform as a Service, or P A A S, provides you with a ready-made platform to build and run your applications. You control the data and code, but the provider handles the underlying servers and operating systems. Examples include Google App Engine and Heroku.
Software as a Service, or S A A S, is where the provider handles everything. You simply log in and use the application. You are responsible for how your users access it and how you manage the data. Think about tools like Google Workspace or Salesforce.
To simplify: I A A S means more control and more responsibility. P A A S gives you some control with shared responsibility. S A A S offers the least control but also the least you have to manage. Picture this as a sliding scale of control to convenience, and you’ll be able to tackle cloud model questions easily.
Thanks for joining us for this episode of The Bare Metal Cyber C I S S P Prepcast. For more episodes, tools, and study support, visit us at Bare Metal Cyber dot com.