CISSP Cyber Training Podcast - CISSP Training Program · Shon Gerber, vCISO, CISSP, Cybersecurity Consultant and Entrepreneur

CCT 318: APIs To End Of Life (EOL) and End of Service (EOS) - CISSP Domain 2.5

·37 min

1. CISSP Cyber Training Podcast - CISSP Training Program focuses on Domain 2.5, “Ensuring Appropriate Asset Retention,” with end-of-life and end-of-support as the central topics. 2. Sean Gerber hosts the episode as the CISSP Cyber Training presenter, and he says the show exists to help people pass the CISSP exam and grow cybersecurity knowledge. 3. The episode asks what security professionals should do when APIs, AI agents, and older systems like Windows 95 move toward EOL, EOS, and retention deadlines. 4. Sean starts with a SecurityWeek-style concern that weak authentication and misconfigurations remain major exploitation vectors for APIs. 5. He says shadow and undocumented APIs continue to proliferate, especially when employees connect systems without really knowing how the integrations work. 6. He describes agentic AI as adding autonomous activity to APIs and increasing the “volatile attack surface” that security teams must monitor. 7. He explains Model Context Protocol, or MCP, as a standardization layer that lets AI models securely interact with tools such as APIs and other data sources. 8. He says MCP creates challenges around over-permissioned tools, visibility, attribution, and auditability for security and audit teams. 9. He recommends continuous discovery, behavioral analytics, contextual-driven access controls, and API gateways as practical controls for modern API environments. 10. He moves from APIs into end-of-life systems, using a Windows 95 example to show why decommissioning and asset inventory matter. 11. He defines end of life as the stage when a product is no longer produced, sold, or supported by the vendor. 12. He says end-of-life planning should include asset identification, an updated list of assets and lifecycle status, and a structured sunset plan. 13. He gives data migration and continuity planning as part of that sunset plan, because organizations still need to move or preserve the data before shutdown. 14. He warns that end-of-life systems kept in production remain vulnerable and can create negligence problems if they appear in an asset inventory during an investigation. 15. He recommends isolation techniques such as network segmentation and strict access controls when old systems must stay online temporarily. 16. He describes secure disposal as wiping or destroying data and keeping detailed destruction records to demonstrate compliance and reduce leakage risk. 17. He defines end of support as the point where vendors stop updates, patches, or technical assistance, which leaves systems as high-risk targets. 18. He says retention decisions should consider business continuity, regulatory compliance, legal hold, and audit needs, not just technology convenience. 19. The tone is instructional and repetitive by design, with Sean pausing to restate key terms like legal hold, audit trails, and retention schedules. 20. Security professionals, CISSP candidates, and managers handling old infrastructure would find the episode useful, while listeners wanting a short, low-detail overview may skip it.

As heard by us

A plainspoken CISSP lesson on retiring assets with documented follow-through.

Sean Gerber treats asset retention as more than housekeeping, making it clear that security and legal responsibility continue through the full lifecycle.

Read the full review in PlayNext →

Why you'd press play

You want a straight Domain 2.5 walk-through of asset retention.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify