Search & Discovery 2.0
Search the complete Bare Metal Cyber knowledge system with identifier-aware ranking, framework filters, topic discovery, and direct paths into books, podcasts, and Academy learning.
Search results
Apply GV.SC-03 to achieve this CSF 2.0 outcome: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes.
Apply GV.RR-01 to achieve this CSF 2.0 outcome: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
Apply GV.OC-03 to achieve this CSF 2.0 outcome: Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed.
Apply GV.SC-09 to achieve this CSF 2.0 outcome: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
Use GV.OC to manage mission, stakeholders, dependencies, and obligations that shape cybersecurity risk decisions within the Govern Function.
Apply GV.OC-01 to achieve this CSF 2.0 outcome: The organizational mission is understood and informs cybersecurity risk management.
Apply GV.SC-10 to achieve this CSF 2.0 outcome: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
Apply GV.OV-01 to achieve this CSF 2.0 outcome: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction.
Apply GV.RR-03 to achieve this CSF 2.0 outcome: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies.
Apply GV.RR-02 to achieve this CSF 2.0 outcome: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
Apply PR.AT-02 to achieve this CSF 2.0 outcome: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind.
Apply GV.OC-02 to achieve this CSF 2.0 outcome: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood.
Apply GV.RM-06 to achieve this CSF 2.0 outcome: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated.
Apply GV.RM-07 to achieve this CSF 2.0 outcome: Strategic opportunities — positive risks — are characterized and are included in organizational cybersecurity risk discussions.
Apply GV.SC-05 to achieve this CSF 2.0 outcome: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
Apply GV.SC-02 to achieve this CSF 2.0 outcome: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally.
This Bare Metal Cyber episode is all about building a security champion program—think of it as your in-house cybersecurity cheerleaders spreading vigilance across teams like dev, sales, or HR. We explore how empowering non-security staff to spot risks, push best practices, and liaise with IT shrinks breaches, boosts compliance with stuff like GDPR, and builds a culture where everyone’s a defender. It’s about…
Cryptography is the quiet power behind every secure digital transaction, message, and connection we trust. In this episode, we explore how encryption, hashing, and digital signatures uphold confidentiality, integrity, and authenticity—the three timeless pillars of cybersecurity. You’ll learn how symmetric and asymmetric encryption work together, how hash functions act as digital fingerprints, and why even brilliant…
Defense in depth is a simple idea that quietly shapes strong cybersecurity for real organizations. Instead of trusting one perfect barrier, defense in depth stacks several ordinary protections so mistakes stay small. A beginner might hear about firewalls, antivirus, passwords, and backups as separate topics, without seeing how they support each other. The defense in depth mindset connects these pieces into layers…
At the expert tier, cybersecurity isn’t a toolbox—it’s an ecosystem. This episode shows how real resilience comes from integration: people, processes, and technology orchestrated around business priorities. We connect encryption to identity, MFA to segmentation, testing to supply chain assurance, and monitoring to response so there are no gaps for attackers to slip through. You’ll see how layered defense and zero…
In this episode of Dot One, we dive into the world of Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)—the silent guardians of cybersecurity. These systems play a crucial role in identifying and stopping malicious activities before they can compromise networks. We explore how IDS monitors and alerts security teams to suspicious activity, while IPS takes a more proactive approach by blocking…
In this episode of Dot One, we dive into Privileged Access Management (PAM), the cybersecurity MVP that locks down those all-powerful accounts—like admin or service credentials—that can make or break your systems. PAM isn’t just about tech; it’s about controlling who gets the keys to your digital kingdom, stopping insiders from going rogue or hackers from cashing in on stolen access. We’ll unpack how it slashes…
In this episode of Dot One, we dive into penetration testing, the art of launching fake cyberattacks to expose and fix security holes before the bad guys can pounce. It’s proactive cybersecurity at its finest—think black box tests from an outsider’s view, white box deep dives with all the keys, or gray box blends of both, plus checks on networks, apps, and even human slip-ups. We’ll explore how it beats just…
In this episode of Dot One, we shine a spotlight on cyber threat intelligence, the crystal ball of cybersecurity that turns raw data into a playbook for outsmarting attackers. It’s about digging into tactics—like phishing or ransomware tricks—and spinning that into actionable know-how to spot threats early, react fast, and toughen up your defenses. We’ll explore why it’s a game-changer, bridging firefighting to…
