CISSP Cyber Training Podcast - CISSP Training Program · Shon Gerber, vCISO, CISSP, Cybersecurity Consultant and Entrepreneur

CCT 320: OT Attacks And CISSP Domain 6.4 Essentials

·41 min·2 clips

M&A creates hidden external exposure because you inherit the other company’s “dead bodies.”

1. CISSP Cyber Training Podcast episode CCT 320 focuses on OT attacks and Domain 6.4 analysis of test output and generating results. 2. Sean Gerber hosts CISSP Cyber Training and frames the topic as exam preparation plus practical cybersecurity work. 3. The episode asks how vulnerability findings become reports, priorities, remediation plans, and exception decisions. 4. Sean opens with an OT example involving an Iranian-linked crew, custom cyber weapons, and gas-station PLCs. 5. He says the group uses a custom backdoor over Linux-based IoT systems from vendors such as Hikvision, Red Lion, Phoenix Contact, and Teleconica. 6. He describes MQTT and DNS over HTTPS as part of the attack path and notes the ability to execute, self-delete, and port scan. 7. Sean argues that OT attacks can be psychological operations because shutting down gas pumps changes public behavior. 8. He then moves into security scan reporting as a way to communicate vulnerability findings to technical teams. 9. He says reports may be generated automatically, hand-built, or passed in from a third party. 10. He recommends a summary section with critical findings, risk levels, impacted systems, CVE numbers, CVSS scores, and exploitability. 11. Sean says trend analysis matters because month-to-month scans show whether remediation is actually happening. 12. He gives the example of month one and month two remediation, then asks whether progress has leveled off. 13. He says recurring vulnerabilities can point to inadequate patch programs or work that is still manually driven. 14. Sean explains that reporting frequency can be monthly, quarterly, after significant change, or ad hoc after a high-profile incident. 15. He says audience matters because CIOs, CEOs, auditors, and technical teams need different levels of detail. 16. He recommends a cover sheet or summary page so auditors do not need to ask what the report means. 17. The tone is instructional, conversational, and highly repetitive, with frequent analogies and side examples. 18. The format is a solo teaching segment with a news-style OT example at the start and exam-focused explanation afterward. 19. People studying CISSP Domain 6.4 and OT risk management will get the most value. 20. Listeners wanting a tight, technical briefing without digressions may skip it.

As heard by us

Domain 6.4 is treated as practical housekeeping: clear easy risks quickly, then use internal scans to find what matters inside the environment.

Sean Gerber frames Domain 6.4 as practical maintenance, with an emphasis on clearing smaller issues quickly and on using internal scans to surface misconfigurations, outdated software, and vulnerabilities inside internal systems.

Read the full review in PlayNext →

Why you'd press play

Need a practical pass through Domain 6.4 and internal scans?

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from CISSP Cyber Training Podcast - CISSP Training Program