CISSP Cyber Training Podcast - CISSP Training Program · Shon Gerber, vCISO, CISSP, Cybersecurity Consultant and Entrepreneur

CCT 324: How Least Privilege, Need-To-Know, And PAM Actually Reduce Real-World Risk

·36 min

Sean starts with holiday banter and a quick teaser about a cybersecurity news item. From there, he moves into the main lesson. The focus is least privilege and need-to-know. He talks through access control mechanisms and brings RBAC into the discussion. ABAC follows, with contextual factors like location and time used to decide whether access should be granted. Sean uses a location mismatch example to show why identity alone is not enough. The point is straightforward: when a request looks off, context should help catch it. Granular permissions come next. He describes them as a way to keep access tied to the smallest practical scope. Micro-segmentation fits the same idea. It helps narrow access inside networks and keeps boundaries tight. Data masking is another piece of the stack. Sean notes that it can live inside tools or come from a third-party product. He uses sensitive identifiers, like social security numbers, to show why only the necessary portion of data should be visible. Zero trust rounds out the control set. He presents it as a steady check on access requests so unnecessary privileges do not pile up. The benefits stay practical. Better security posture matters. So does helping employees focus on what they actually need. Sean keeps coming back to that plain idea. The lesson is not abstract. It is about shrinking exposure and making access deliberate. The tone stays conversational throughout, with a few restarts and asides, but the structure remains clear. The close leans into seasonal good wishes and plugs for his training and consulting services. The central message still lands cleanly. Access should be narrow, contextual, and hard to abuse.

As heard by us

A plainspoken walkthrough of least privilege, need to know, and the controls that make them work.

Sean keeps the focus on least privilege and the controls around it: need to know, RBAC, ABAC, granular permissions, micro segmentation, data masking, and zero trust.

Read the full review in PlayNext →

Why you'd press play

Need a clear refresher on access control, least privilege, and real-world tradeoffs?

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify