Search & Discovery 2.0
Search the complete Bare Metal Cyber knowledge system with identifier-aware ranking, framework filters, topic discovery, and direct paths into books, podcasts, and Academy learning.
Search results
Least privilege is the security principle of granting a user, application, service, or device only the permissions required to perform its assigned function and no more. Certification exams often present scenarios involving excessive access and ask which control would most effectively limit the resulting risk. An employee who only prepares reports should not have permission to modify payroll records, and a service…
MFA fatigue is an attack in which a threat actor repeatedly sends multifactor authentication prompts to a user after obtaining or guessing the user’s password. Certification questions may describe numerous unexpected approval requests and ask candidates to identify the attack or select the strongest mitigation. The attacker expects the user to approve a prompt accidentally, out of frustration, or because a…
Password spraying is an authentication attack in which an attacker tests one or a small number of commonly used passwords against many different accounts. Certification exams may ask candidates to distinguish this method from a traditional brute-force attack that repeatedly targets one account with many password combinations. By distributing attempts across multiple usernames, the attacker may avoid account-lockout…
Path traversal occurs when an attacker manipulates a filename or directory path to access information outside the location an application intended to expose. Certification exams may describe input containing directory-navigation characters and ask candidates to identify the vulnerability or the most effective control. A vulnerable download function might allow a user to request configuration files, credentials…
Persistence is a technique that allows an attacker to maintain access to a system or environment after the original entry point has been removed, credentials have changed, or a device has restarted. Certification exams may describe unexpected accounts, startup entries, scheduled tasks, modified services, or long-lived tokens and ask which attack objective they support. Attackers establish persistence so they can…
Pretexting is a social-engineering technique in which an attacker invents an identity, relationship, or situation to persuade someone to reveal information or perform an unauthorized action. Certification exams may describe a caller claiming to be a vendor, employee, customer, executive, or support technician and ask which technique is being used. Effective pretexts often include familiar terminology, personal…
Privilege escalation occurs when a user or attacker obtains permissions beyond those originally assigned, allowing access to restricted functions, data, or systems. Certification exams may distinguish vertical privilege escalation, in which someone gains a more powerful role, from horizontal privilege escalation, in which someone accesses another user’s resources at a similar permission level. An attacker might…
QR-code phishing uses a scannable image to conceal a malicious web address or other attacker-controlled destination. Certification exams may describe a QR code placed in an email, poster, document, parking notice, or package and ask why it can bypass normal link inspection. Because the destination is not immediately visible, a user may scan the code with a personal phone and move the interaction outside the…
Residual risk is the portion of risk that remains after security controls have been selected and implemented. Certification exams frequently ask candidates to distinguish residual risk from inherent risk, which exists before controls are applied. For example, encryption, monitoring, access restrictions, and backups may reduce the likelihood or impact of data loss, but they cannot guarantee that loss will never…
Sandboxing is a security technique that runs a file, program, process, or website inside an isolated environment with restricted access to the host system and other resources. Certification exams may ask which control allows analysts to observe suspicious behavior while limiting the potential damage caused by malicious code. A sandbox can record file changes, process creation, network connections, registry…
Separation of duties is a control that divides a sensitive task or business process among multiple individuals or roles so that one person cannot complete every critical step independently. Certification exams may test this principle through scenarios involving financial transactions, system changes, account creation, or access approval. For example, one administrator may request a firewall change, another may…
Session hijacking occurs when an attacker steals, predicts, intercepts, or reuses the token that an application relies on to recognize an authenticated user. Certification exams may test why possession of a session cookie or bearer token can allow access without entering the victim’s password or completing multifactor authentication again. Attackers may obtain session information through malware, insecure…
Smishing is a form of phishing that uses text messages or mobile messaging services to persuade a recipient to open a malicious link, disclose sensitive information, install software, or contact an attacker-controlled number. Certification exams may present delivery notices, account warnings, unpaid invoices, password-reset requests, or urgent workplace messages and ask candidates to identify the social-engineering…
SQL injection occurs when untrusted input changes the structure or meaning of a database command created by an application. Certification exams may describe login forms, search fields, or application programming interfaces that place user input directly into a query and ask candidates to identify the vulnerability or select the strongest defense. An attacker may craft input that reads restricted records, bypasses…
Tailgating occurs when an unauthorized person gains physical access to a restricted area by following an authorized individual through a secured entrance. Certification exams may present a person carrying equipment, claiming to have forgotten a badge, or entering behind an employee and ask candidates to identify the physical social-engineering technique. Once inside, the intruder may access unattended workstations…
Vishing is a form of phishing conducted through telephone calls, voice messages, or internet-based voice services. Certification exams may present a caller who claims to represent a bank, employer, government agency, help desk, or vendor and pressures the victim to disclose credentials, approve a transaction, or install software. Attackers may manipulate caller identification, use stolen personal information, and…
Third-party cybersecurity breaches are rapidly becoming one of the most serious threats facing organizations today. Attackers exploit vendor vulnerabilities, bypassing traditional defenses and compromising critical systems, often undetected. In this episode, we explore practical approaches for uncovering hidden vendor risks, utilizing AI-driven insights and advanced threat detection to proactively manage and…
In this gripping episode of Bulletproof the Cloud, Dr. Jason Edwards, a cybersecurity veteran and cloud resilience expert, takes listeners on a journey into the heart of modern digital infrastructure. As businesses lean harder than ever on cloud computing, the stakes for keeping systems online—through outages, cyberattacks, or unpredictable disruptions—have never been higher. Drawing from his extensive chapter…
In today's episode of the Bare Metal Cyber podcast, we dive deep into an often-overlooked crisis in cybersecurity: analyst burnout in the Security Operations Center. We'll examine why SOC analysts are increasingly overwhelmed by endless alerts, high-stakes decision-making, and relentless workloads—and why relying solely on automation as a cure can sometimes lead to unintended consequences. Then, we'll explore…
In today’s episode, we dive deep into the hidden realm of Shadow IT—those unsanctioned technologies quietly spreading through nearly every modern organization. While they often begin with harmless intentions, these hidden apps and devices can quickly escalate into serious cybersecurity risks, complicate compliance, and introduce vulnerabilities that organizations struggle to see coming. We’ll discuss why employees…
In today's episode, we're tackling one of cybersecurity's biggest challenges: the human factor. Employees, often considered the weakest link in an organization's cyber defenses, don't have to remain vulnerabilities. Instead, they can become powerful cybersecurity allies—transforming from click-happy risks into vigilant cyber warriors. We'll explore how engaging, humor-driven training methods, realistic simulations…
In this episode of BareMetalCyber, we narrate the article Ctrl+Alt+Comply: The Wild World of Cyber Regulations, taking you through the tangled web of international cybersecurity compliance. From the rigid power moves of the EU’s GDPR to the complex demands of China’s PIPL and the legislative chaos of U.S. state laws, we explore how the world governs digital risk—and how organizations are expected to keep up. We…
Insider threats are one of the most underestimated challenges in cybersecurity. These threats arise from individuals within an organization—employees, contractors, or even trusted partners—who misuse their access, either intentionally or accidentally, to compromise systems, data, or operations. In this episode, we explore the complexities of insider threats, breaking down the different types, their motivations, and…
In today's episode, we explore one of the most challenging cybersecurity issues organizations face—the insider threat. Unlike external cyberattacks, these threats emerge from trusted employees, each driven by distinct motivations ranging from personal grievances and financial incentives to outright sabotage. We'll delve deeply into the psychology behind insider threats, recognize digital footprints of betrayal, and…
