CISSP Cyber Training Podcast - CISSP Training Program · Shon Gerber, vCISO, CISSP, Cybersecurity Consultant and Entrepreneur

CCT 328: Security Impact for Acquired Software (Domain 8)

·35 min·2 clips

Third-party software can lack visibility, depend on weak supply-chain practices, and require vendor updates.

Sean Gerber opens the show in his teaching mode and greets listeners warmly. He says the goal is to help them pass the CISSP exam and build their cybersecurity knowledge. He starts Domain 8.4 by focusing on different types of software. Before getting into the lesson, he shares a few student questions from his audience. He also mentions that he plans to move away from Video Ask and use Voxer for paid students so names are easier to track. From there, he returns to the core lesson on evaluating software security. He treats platform as a service, infrastructure as a service, and software as a service as different contexts that still need close scrutiny. He stresses that the buyer should look at whether the vendor can monitor and share infrastructure details, demonstrate availability, and explain its compliance strategy. He wants listeners to ask how the vendor handles security features and integration monitoring, and how the vendor builds security into its people and products. When he shifts to software evaluations, he describes cursory testing and binary analysis as useful but limited. Those tools can help spot flaws, but they do not show the full picture. He warns that relying on a tool alone can create a false sense of security. He then pushes listeners to look for a secure development process backed by public documentation. He asks whether the vendor has a vulnerability response process. He also asks whether there are security guides for configurations and code handling. The episode points listeners toward standards such as ISO 27034 and IEC 62443 as signs of mature development practices. That framing turns software procurement into a risk conversation instead of a checkbox exercise. He closes by reminding listeners that the real goal is to protect the company while still building long-term capability. The episode also keeps the focus on practical CISSP preparation, not abstract theory.

As heard by us

A practical CISSP walkthrough of software evaluation and secure development checks.

Sean Gerber keeps the discussion grounded in practical vendor checks for platform as a service, infrastructure as a service, and software as a service.

Read the full review in PlayNext →

Why you'd press play

Before you buy software, know which security checks still matter.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from CISSP Cyber Training Podcast - CISSP Training Program