Even before I could have possibly known if it’s the right direction for me.

If you are considering cybersecurity right now, you might be asking yourself:

“Is it too late?”

“Is the field already too crowded?”

“Do I need to be deeply technical?”

“Which certification should I start with?”

Here is my honest answer after working in cybersecurity, earning a Master’s degree in the field, and sitting on both sides of the hiring table:

Cybersecurity is still one of the best career choices you can make.

But only if you stop learning randomly and choose the right path for your background.

The good news? I will help you with that!

1. The Demand Is Real - And the Bar Is Lower Than You Think

Everyone says cybersecurity has millions of unfilled jobs. You have probably seen that statistic so many times it stopped meaning anything.

So let me tell you what I actually see from the hiring side.

Cybersecurity is still a very new field.

Until a couple of years ago, most people only specialized in cybersecurity because someone forced them.

A company needed a security team and moved people across from IT. A developer got assigned to a security project. A compliance person ended up owning risk management by accident.

Very few people on the job market today started their career intentionally as a cybersecurity specialist.

And that changes everything.

For almost any cybersecurity role, it is genuinely difficult to find a candidate with even a minimum skill set. Not an expert. A minimum skill set.

The bar is not as high as the job postings make it look.

Many companies are willing to hire someone and train them. Senior cybersecurity professionals are either too expensive or simply impossible to find. Organizations would rather invest in someone with potential and foundational knowledge than leave a critical role empty for six months.

I have a Master’s degree in cybersecurity, and I am still telling you this.

Not because the degree does not matter. But because the field is so undersupplied, people with the right fundamentals and the right direction are genuinely competitive right now.

If you have the fundamentals, you are already ahead of most candidates applying for the same role.

Did this surprise you? Give me a like so I know I am not alone!

2. The Complexity Is the Point

Most cybersecurity content tries to reassure you that it is not as complicated as it looks.

I am going to tell you the opposite.

It is complex. And that is exactly why it is worth it.

The most important mindset shift you go through when you enter this field is realizing how broad it actually is.

Cybersecurity goes from physical security to software development. From network security to supply chain management. From technical vulnerability assessments to overall business risk management.

Every level of every company is affected by this field.

The person designing the office floor plan needs to think about tailgating attacks.

The developer writing the API needs to think about authentication.

The CFO approving the budget needs to understand what a ransomware attack would cost the business.

That breadth is not a burden. It is a career advantage.

It means you never stop learning. It means your knowledge stays relevant because the field keeps evolving. It means you can move between technical and business roles in a way that almost no other career allows.

Most fields reward specialists who go very deep in one direction.

Cybersecurity rewards people who understand how everything connects.

And once you see it that way, the complexity stops being intimidating.

It becomes the reason you chose this field in the first place.

3. There Is a Path for Every Background

When most people think about cybersecurity careers, they picture one thing.

Someone in a dark room finding vulnerabilities. A penetration tester. A hacker.

That is one path out of five.

And right now, from where I sit, the most underrated and fastest growing paths are GRC and privacy protection.

Here is why.

Everyone is talking about AI.

And yes, AI tools are transforming how security teams work. But the biggest actual increase in demand I am seeing is regulatory. The number of compliance requirements placed on companies from a cybersecurity perspective has grown dramatically. GDPR. NIS2. DORA. AI Act. The list keeps growing.

And AI has made privacy protection significantly harder than it used to be. Organizations are collecting more data. Processing it in more places. Sharing it with more vendors. Ensuring that data is handled correctly is now a genuinely complex operational challenge.

The budgets often do not reflect this yet. But the demand does.

And that gap creates opportunity for people who position themselves in this space now rather than in two years when everyone else catches up.

Here is the full picture of the five paths available to you:

The most important decision you make early in a cybersecurity career is not which certification to get.

It is the path that fits your background.

Get that right and everything else - certifications, skills, entry roles, timeline - becomes much clearer.

Which of the five paths resonates most with you? Comment below - I read every response.

Or better yet: take the free diagnostic and find out which path actually fits your background in just couple of minutes.

Take a Career Quiz

Where Should You Start?

I am not saying cybersecurity is for everyone. It is a demanding field, and if you’re not going to take it seriously, it won’t work.

However, if you are convinced cybersecurity is for you but unsure where to begin, Decoded Security is here to help!

Step 1: Find your path

First, I prepared a quiz to help you figure out which cybersecurity area suits you best. Based on your goals, your interests, and your background.

It will take you about 10 minutes, and as a bonus, you will get a personalized study plan that will help you get started. There is no sign-up, no email required.

You just click the button and take the quiz.

Take a Career Quiz

Step 2: Build your foundation

This is something I am really proud of. Over the years, I put together the top 10 Cybersecurity concepts that you need to know regardless of the area of cybersecurity you choose.

And to make it even better for you, I prepare countless quizzes and challenges for you, which can help you actually apply the concepts rather than just read them!

So, if you will read only one guide from Decoded Security, choose that one.

1200+ downloads, 5-star rating! Numbers that I am actually proud of! If this guide helped you too, let me know in the comments and help me share it to more people.

Download for Free

Step 3: Read the roadmap

And if you’ve already covered the basics and you have at least some idea what area of cybersecurity is interesting for you, it’s time for you to work on your goals!

The Roadmap page tells you how to use the Decoded Security resources and what the whole environment offers.

Articles, community, and, of course, training for specific certification exams.

Decoded Security Roadmap

Final Thought

If I had to start over, I would choose cybersecurity again.

Not because it is easy.

Not because jobs magically appear after one certification.

And not because every beginner should follow the same path.

I would choose it again because the field is still growing, the demand is real, and there are more ways to build a cybersecurity career than most beginners realize.

The opportunity is real.

The only thing that separates the people who break in from the people who stay stuck is having a clear starting point.

This is yours, and I am here to help you start your career!

Talk to you soon,
Erich
Decoded Security!

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!

Let’s learn and grow together!

Then you show them how much that costs.

That’s why I told you about the recovery metrics. MTD, RTO, WRT, RPO. The numbers that tell you what the business actually needs before you touch a single backup tool.

This week, we finish the job and learn about the backup strategies available and their benefits and drawbacks.

CISSP, CC, and Security+ Domain 7 essential. This also happens to be one of the most common interview questions for SOC and GRC roles, so pay attention.

What you’ll learn in this article:

• The real difference between full, incremental, and differential backups (and why restore time is the part everyone forgets)

• The enterprise techniques used for database and always-on systems: electronic vaulting, remote journaling, remote mirroring

• The 3-2-1 rule, and the modern version that actually accounts for ransomware

The Three Backup Methods

Every certification exam expects you to know these. More importantly, so does every hiring manager who’s ever had to explain a bad restore to their boss.

But first, what is a backup method?

A backup method is just the rule that decides what gets copied and how often.

Not where it’s stored, not how fast you can restore it, just the logic behind what data actually gets captured each time a backup runs.

Let’s take a look at what methods are out there.

Do you think you understand backup methods already? Let’s find out!

Take a Free Quiz

1. Full Backup

This one is actually the easiest to understand. You take all the data and back it up. Everything, without a difference. Every file, every byte, every time.

It’s the safest method, but it requires the most resources. And as you know, we always have to balance cost and benefits.

• Frequency: Usually weekly or monthly. It’s big, and it’s slow.

• Restore: One backup set. That’s it. Nothing else needed.

• Trade-off: Simple to restore, expensive to run constantly

2. Incremental Backup

Copies only what changed since the last backup, whether that last backup was a full or another incremental.

• Frequency: Daily, sometimes hourly. Small and fast.

• Restore: You need the last full backup, plus every single incremental since then, applied in order.

• Trade-off: Cheapest to run. Riskiest and slowest to restore.

Remeber: One corrupted incremental in the chain, and everything after it is unusable.

3. Differential Backup

Copies everything that changed since the last full backup (not the last backup, the last full).

• Frequency: More often than full, less often than incremental.

• Restore: Last full backup, plus the most recent differential. That’s the whole chain.

• Trade-off: Bigger than incrementals over time, but restore is fast and doesn’t depend on a fragile chain.

Exam trap: Incremental backs up since the last backup of any kind. Differential backs up since the last full backup only. Mix those two up and you will get this question wrong.

When You’re Backing Up More Than Files

Full, incremental, and differential work fine for file servers. But what happens when the system can’t afford to be down long enough for a traditional restore?

Databases, transaction systems, anything close to real-time.

That’s where three enterprise techniques come in. You’ll see all three on the CISSP exam, usually as a “which one fits this scenario” question.

Electronic Vaulting

Bulk data gets transferred automatically to an offsite location on a schedule. Think of it as a scheduled, automated backup job over a network instead of a tape driving to a warehouse.

The catch: it moves in batches. If disaster hits between transfers, you lose whatever wasn’t sent yet.

Did this article help you understand how data security actually works? Give this article a like and help other people find it.

Remote Journaling

Instead of sending bulk data on a schedule, this transmits the actual transaction logs continuously, in near real time. That gets you point-in-time recovery instead of “whatever we captured at the last batch.”

Remote Mirroring

The most expensive, most complete option. A live, functioning duplicate of your system at another site, updated synchronously or asynchronously.

If your RPO is zero, this is the only option on this list that gets you there. Nothing else does.

Your RPO from last week’s article is what tells you which one you actually need. It is no surprise that the smaller is your RPO, the more expensive it gets.

The 3-2-1 Rule

The 3-2-1 rule is the golden standard, and it's not just theory. It's the baseline that regulations and compliance frameworks expect you to meet, and it's the one backup concept that comes up in almost every audit, exam, and interview.

Luckily for you, it’s actually quite simple!

3-2-1 rule:

• 3 copies of your data (the original plus two backups)

• 2 different types of media (so one failure mode doesn’t take out everything)

• 1 copy stored offsite (so a fire, flood, or local disaster doesn’t take out everything either)

Here’s why each number exists, not just what it is:

• One copy is a single point of failure. A bad drive, and it’s gone.

• Two copies on the same media type share the same failure mode. A firmware bug or a ransomware strain that targets the media wipes both.

• Even three copies fail together if they’re all in the same building. A fire, a flood, or a break-in takes out everything at once.

3-2-1 forces you to remove all three failure points in one move. That's why it stuck around this long, and why it's still the first answer expected in any conversation about backup strategy.

If you’ve made it this far, you now understand backup strategy better than most people who’ve been in IT for years.

Give this a like, it tells me to keep writing the technical deep dives!

Bringing It All Together

Congratulations. If you’re reading this, I am proud of you!

As a reward, I created a short summary to help you remember the most important parts of this article.

1. Start with your RPO and RTO from last week. They’re not optional context, they’re the whole basis for every decision below.

2. Choose your method (full, incremental, differential) based on how much data changes and how fast you need to restore it.

3. If the system is transactional or can’t tolerate any real data loss, layer in journaling or mirroring instead of relying on the method alone.

4. Test it. Untested backups fail exactly when you need them most, which is the entire plot of the story I opened this article with.

And that’s all for today!

Thank you for reading Decoded Security, and see you next week!

Here is what to read next

• RTO, RPO, MTD, WRT Explained

• Recovery Site Strategies

• Testing Disaster Recovery Plans: Why “Having a Plan” Isn’t Enough to Pass CC or CISSP

Frequently Asked Questions

What’s the difference between incremental and differential backups? Incremental backs up everything changed since the last backup of any type. Differential backs up everything changed since the last full backup. Incremental is smaller and faster to run, but the restore depends on every backup in the chain. Differential is bigger over time, but restore only needs the last full plus the latest differential.

Is tape backup obsolete? Not entirely, it still appears in long-term archival use cases and on exams, but disk-to-disk and cloud repositories have replaced it as the default for anything needing a fast restore.

What is the 3-2-1 rule in backup strategy? Three copies of your data, on two different types of media, with one copy stored offsite. It’s a baseline standard, though many organizations now extend it to 3-2-1-1-0 to account for ransomware and to require verified, error-free recovery testing.

What’s the difference between remote journaling and remote mirroring? Remote journaling transmits transaction logs continuously for point-in-time recovery. Remote mirroring maintains a full, live duplicate of the system at another location. Mirroring is faster to recover from but far more expensive.

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!

Let’s learn and grow together!

‼️ Warning: CC, Security+, and CISSP relevant topic!

If you are starting out in cybersecurity, you have probably heard that networking is the foundation.

That is true.

But here is what nobody tells you: knowing the attacks by name is worthless.

Exams describe scenarios. Interviewers describe situations. Log files show patterns. None of them comes with labels.

By the end of this article, you should be able to recognize the top 5 most common network attacks and how to prevent them.

In this article, I will:

• Break down the 5 network attacks you will meet in exams, interviews, and real incident logs

• Show you the one detail that identifies each attack, whether it appears in a scenario question or a log file

• Give you the countermeasure for each one, because recognizing an attack is only half the job

First, Understand the Family: DoS vs. DDoS

Every attack in this article is a denial-of-service attack. The goal is not to steal data. The goal is to make a system unavailable to the people who need it.

There are two main types:

• DoS (Denial of Service): One attacker, one source, flooding a target until it stops responding.

• DDoS (Distributed Denial of Service): The same idea, but the traffic comes from thousands of sources at once. Much harder to block, because there is no single IP to filter.

Now, let’s get into the 5 attacks.

Do you find this article useful? Give it a like and help more people find it!

1. SYN Flood: The Handshake That Never Finishes

This is the most important attack on the list. If you learn only one, learn this one.

Normal TCP connections start with a three-way handshake. The client says SYN. The server answers SYN-ACK. The client confirms with ACK. Connection established.

A SYN flood abuses the politeness of that process.

The attacker sends thousands of SYN packets and never sends the final ACK.

The server, being polite, holds a spot open for each half-finished handshake and waits. And waits.

Eventually, the table of half-open connections is full, and legitimate users get turned away.

The analogy: Imagine a restaurant where callers keep making reservations and never show up. Every table is “reserved.” Real customers stand outside a half-empty restaurant that they cannot enter.

Countermeasure: SYN cookies (the server does not commit resources until the handshake completes), reduced connection timeouts, and rate limiting.

If that finally made the three-way handshake click, give it a like! It tells me these breakdowns are worth writing.

2. Smurf Attack: Turning a Network Against You

The attacker sends ICMP echo requests (pings) to a network’s broadcast address. But here is the trick: the source IP is spoofed to be the victim’s address.

Every device on that network receives the ping and politely replies. To whom? To the victim. One packet from the attacker becomes hundreds of replies flooding the target.

The analogy: Someone sends a letter to an entire apartment building saying “please call this number immediately” and writes your phone number on it. You did nothing, and now your phone will not stop ringing.

Scenario keywords: ICMP, broadcast address, spoofed source.

Cousin to remember: The Fraggle attack is the exact same play, but with UDP traffic instead of ICMP. Exams love testing whether you know the difference. ICMP means Smurf. UDP means Fraggle. That single word decides the question.

Countermeasures: Disable IP-directed broadcasts on routers, and configure devices to ignore ICMP requests sent to broadcast addresses.

Reading an article is one thing, actually understand the concept the other.
Test your knowledge and make sure you can recognize the most common network attacks!

Network attacks - QUIZ

3. Ping of Death: One Packet, One Crash

Not every DoS attack needs a flood. Sometimes one malformed packet is enough.

The Ping of Death sends an oversized ICMP echo request that exceeds the system's maximum. Vulnerable systems try to process it, overflow their buffer, and crash.

The analogy: Mailing someone a package too big to fit through their door, and the door frame collapses when they try to force it through.

Scenario keyword: oversized packet.

Countermeasures: Patching. This attack exploits a bug, not a design flaw, so modern patched systems are largely immune.

4. Teardrop Attack: Fragments That Do Not Fit

Large packets get split into fragments for transmission and reassembled at the destination. The Teardrop attack sends fragments with overlapping offsets, so they cannot be reassembled correctly.

A vulnerable system tries anyway, gets confused by the overlap, and crashes.

The analogy: A jigsaw puzzle where the pieces are cut to overlap each other. The picture is impossible to assemble, but the system keeps trying until it breaks.

Scenario keywords: fragmentation, overlapping fragments, reassembly.

Countermeasures: Patching again. Like Ping of Death, this exploits a bug in TCP/IP reassembly. Firewalls that drop malformed fragments also help.

5. Land Attack: The Packet Addressed to Itself

The attacker crafts a packet where the source IP and port are identical to the destination IP and port. The victim machine receives a packet that appears to come from itself, addressed to itself.

A vulnerable TCP stack processes it, replies to itself, processes the reply, and loops until it freezes.

The analogy: Mailing yourself a letter that says “reply to this letter.” Forever.

Scenario keyword: identical source and destination IP and port. If you see that phrase, the answer is Land attack. Nothing else looks like this.

Countermeasures: Modern systems drop these packets automatically. Firewalls with ingress filtering block spoofed packets claiming to come from inside your own network.

Do you think you can recognize the network attacks now? Let’s find out!
Take the quiz and drop your score below!

Network attacks - quiz

How To Actually Remember These

Do not memorize definitions. Memorize the one detail that makes each attack unique:

• SYN Flood = half-open connections

• Smurf = ICMP to broadcast address (Fraggle = same but UDP)

• Ping of Death = one oversized packet

• Teardrop = overlapping fragments

• Land = source equals destination

Exam scenarios are built around exactly these details. Spot the detail, and the question answers itself.

If you are screenshotting this list, do me one favor first: hit like so the next person studying for their exam actually finds it.

Key Takeaways

Here is what I want you to remember:

• Denial of service is about availability, not data theft. That is the “A” in the CIA triad.

• Understanding network protocols is the first step in understanding network attacks

• DDoS is harder to stop than DoS because there is no single source to block.

• Always act proactively, not reactively. Prepare for these attacks BEFORE they happen, not after.

Great! If you understand these 5 attacks, you are already ahead of most people who claim to be cybersecurity experts. But before you go, I have prepared something else for you!

Test Yourself

Here is a scenario, exam style:

A server becomes unresponsive. Logs show a massive number of connection attempts, each stuck waiting for a final acknowledgment that never arrives.

Which attack is this, and which countermeasure would you deploy first?

Comment your answer below. I read every one, and I will tell you if your reasoning would hold up on exam day.

And if you want to really test your understanding of network attacks, I prepared a CISSP-like cybersecurity quiz for you!

Free Quiz

Take it and drop your score in the comments. I read every single one of the comments!

Leave a comment

‼️ Continue learning ‼️

Here is the truth most beginners miss:

Networking is not one topic in cybersecurity. It is the ground everything else stands on. Firewalls, attacks, monitoring, and incident response. None of it makes sense until the network underneath makes sense.

You just learned 5 attacks. Here is how to build on that, in order:

• Top 5 most important network protocols for cybersecurity beginners

• What are the things that keep our networks alive?

• 7 Networking Questions That Instantly Expose Beginners in Cybersecurity Interviews

• Wi-Fi Security for the CISSP candidates: Here Is What Actually Matters

• The Complete Guide to Firewall Types: From Packet Filters to Next-Gen

And if you are still asking the real question, “out of everything in cybersecurity, what actually matters?”, I answered it in one place.

I put together a free 80-page guide covering the 10 cybersecurity concepts behind 90% of entry-level interview questions. Download it here: Top 10 Cybersecurity Concepts

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!

Let’s learn and grow together!

I spent weeks deep-diving into various networking topics before I figured out what the exam actually tests.

I wasted weeks of valuable time learning something that doesn’t matter for the exam, now you don’t have to, because you have this article.

Keep in mind that the CISSP is a security management exam.

Domain 4 doesn’t test whether you can configure a network.

It tests whether you understand which protocols are secure, which are broken, and which one to choose in a given scenario.

Once I figured that out, everything got easier.

Wi-Fi security is a perfect example.

You don’t need to understand every technical detail of how WPA3 works under the hood. You need to know the progression, the tradeoffs, and when to use what.

If you read this article, you’ll know exactly what the CISSP expects on Wi-Fi security.

You’ll learn:

• How Wi-Fi security evolved from WEP to WPA3

• The difference between TKIP and CCMP

• When to use PSK, SAE, or Enterprise mode

• How to answer scenario-based CISSP questions on wireless security

What Is Wi-Fi Security? (SSID, Encryption, Authentication)

Here is the story that the CISSP exam expects you to know.

Wi-Fi networks are identified by their SSID, the name you see when connecting. It can be up to 32 characters, like “HomeWifi” or “Airport_Guest.”

Once your device finds the network, two things need to happen: authentication and encryption. The protocol the network runs determines how both of those work.

That’s what we’re focused on here.

In other words, every Wi-Fi connection has two separate jobs:

1. Encryption: Encrypt the data traveling between your device and the access point so nobody can read it in transit.

2. Authentication: Proves that your device is allowed to join the network in the first place.

These are handled separately. And that’s exactly why WPA2 or WPA3 alone doesn’t tell you the full picture.

WPA2 and WPA3 define the encryption standard. PSK, SAE, and Enterprise define the authentication method.

This is very important, and you need to be aware of this general concept.

Think of it like a building:

• WPA2/WPA3 is the type of lock on the door.

• PSK, SAE, and Enterprise are the different ways people prove they’re allowed inside.

So the complete description of any Wi-Fi network is always the combination of both.

Here are the possible combinations:

The CISSP will give you a scenario and ask you to pick the right combination. Keep this table in your head.

WEP vs WPA vs WPA2 vs WPA3: What's the Difference?

Each standard replaced the one before it because the previous one had a serious security flaw.

You are expected to understand these flaws and choose the right option in the given scenario.

WEP (Wired Equivalent Privacy)

WEP was the original standard. The goal was to give wireless networks the same security as wired ones. It failed.

Attackers could crack WEP in minutes using freely available tools. It was deprecated in 2004. If you see WEP in a scenario, treat it as no security at all.

CISSP Note: It is never a good idea to use WEP.

WPA (Wi-Fi Protected Access)

WPA replaced WEP as an emergency fix.

It uses TKIP encryption, which was designed to run on existing hardware without requiring replacements.

Better than WEP, but still a patch. Now considered weak.

CISSP note: Used in scenarios where you have no possiblity to replace HW.

WPA2

WPA2 was the real upgrade.

It replaced TKIP with CCMP, which uses AES-128 encryption.

Strong, widely supported, and still running on the majority of networks today.

WPA2 is the minimum acceptable standard.

WPA3

WPA3 is the current best practice. It uses an improved version of CCMP and replaces the older PSK handshake with SAE (Simultaneous Authentication of Equals).

SAE uses the Dragonfly Key Exchange, meaning both parties prove they know the password without ever sending it over the network.

This eliminates offline dictionary attacks and adds forward secrecy, meaning a compromised session key doesn’t expose past sessions.

CISSP shortcut: WEP (broken) → WPA (weak) → WPA2 (current standard) → WPA3. Each replaced the one before it.

PSK, SAE, and Enterprise: Choosing the Right Authentication Method

Now that you understand the encryption standards, here’s how the authentication methods work and when to use each one.

WPA2-PSK (Personal Mode)

PSK stands for Pre-Shared Key. Everyone uses the same shared password to connect.

Simple and widely supported.

But there’s no individual accountability, and a weak password is vulnerable to offline dictionary attacks.

An attacker captures the handshake and runs password guesses against it offline, with no limit and no detection.

CISSP note: Use it only for home-network scenarios and only if there are compatibility limitations in the given scenario.

WPA3-SAE (Personal Mode, Upgraded)

SAE replaces PSK in WPA3-Personal.

Even if an attacker captures the handshake, they can’t run offline attacks against it.

Forward secrecy means past sessions stay protected even if a key is later compromised. No user accounts needed.

Use it for: Secure guest Wi-Fi or personal networks where you want real protection without managing individual credentials.

WPA2/3-Enterprise (802.1X Authentication)

Before explaining this one: 802.1X is not a Wi-Fi protocol. It’s an authentication framework. Here’s how it works:

1. Your device connects to the network

2. The access point blocks all traffic and asks for credentials

3. Your device sends them to a RADIUS server, a backend authentication server

4. The RADIUS server verifies them and grants or denies access

Every user has their own credentials. No shared passwords. Full accountability.

The tradeoff: It requires infrastructure. A RADIUS server, user accounts, and backend configuration. That overhead makes no sense for a guest network. It makes complete sense for a corporate one.

CISSP note: use it for corporate networks where individual accountability is required.

MAC Filtering and Captive Portals: Do They Actually Secure Wi-Fi?

MAC Filtering

Whitelists specific device MAC addresses. If your address isn’t on the list, you can’t connect.

Sounds useful. The problem: MAC addresses travel in cleartext even inside WPA2. Any attacker on the network can read a valid MAC address and spoof it in under a minute.

CISSP note: Layer 2 control. Trivial to bypass. Never a substitute for encryption.

Captive Portals

The page that appears at hotels and airports before you get internet access. You accept terms, authenticate, or pay.

Captive portals sit in front of internet access, not in front of the wireless connection. The Wi-Fi traffic itself is not protected by the portal. If the underlying encryption is weak, traffic is still exposed.

CISSP note: Captive portals = access control. Not confidentiality. Not integrity. Access control only. If a scenario asks how to control who can access the internet on a guest network, a captive portal is a valid option.

Conclusion

Let me give you a couple of shortcuts that served me well during the exam:

• Guest Wi-Fi, no user accounts needed: WPA3-SAE

• Corporate network, individual accountability required: Enterprise/802.1X

• If you need contact information on people who use your network, use the captive portal

• WEP or open network anywhere in the scenario - INSECURE

That’s everything the CISSP expects you to know about Wi-Fi security.

With the knowledge in this article, you will be able to answer most questions on Wifi security without spending weeks going through advanced networking topics.

Keep Learning: Related Articles

If Domain 4 still feels overwhelming, these will help fill in the gaps.

Start Here: The Decoded Security Roadmap
Not sure where to begin? This is the map. It breaks down exactly what to study and in what order, whether you’re going for CISSP, Security+, or a GRC role.

7 Networking Questions That Instantly Reveal Skill Gaps
Before you go deeper into Wi-Fi security, make sure your networking fundamentals actually hold up. These 7 questions show you exactly where the gaps are.

This Is How I Explain DNS to Beginners
Wi-Fi gets your device on the network. DNS is what happens next. If you’ve never had DNS explained in a way that actually clicks, start here.

This Is How I Explain VPNs to Beginners
Wi-Fi security protects the connection to the access point. A VPN protects what happens after that. Here’s the difference, explained without the jargon.

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap
Quiz platform: Test Your Knowledge

Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!

Let’s learn and grow together!

It had no name, no resources, no subscribers, just me preparing for the CISSP exam with a decision to document my journey.

I still remember when I published my first article:

Looking back, it’s terrible. I know a lot about encryption, but I knew nothing about writing a newsletter.

Despite that, I will never delete this article, because it reminds me how much I have improved over time.

As of today, I have 1,304 subscribers, which is far more than I could imagine at the beginning. After all, I had around 30 subscribers after 2 months of publishing.

And I like to think that my articles have gotten a lot better, but that isn’t where I stopped.

What started as a simple newsletter with 1 post a week became a complex environment for people who want to build a career in cybersecurity and pass cybersecurity exams such as CC, CISSP, or Security+.

This is what Decoded Security offers now:

• Quiz platform: Just reading about some concept doesn’t mean you actually understand it. That’s why I publish CISSP-like quizzes that allow you to verify your knowledge.

• Personalized study plan: This allows you to create a plan tailored to your background and goals.

• Gumroad - Guides, Checklists, and other Study resources: Over time, I have published many guides. Here are the most successful ones.

  • Cybersecurity Fundamentals: The 10 Concepts That Get You Through 90% of Interviews (1,145 downloads, 5-star rating)

  • The 90-Day Cybersecurity Job Blueprint (49 sales, 4.8 star rating)

• Decoded Security Certification Hub: Study resources and tips categorized based on different cybersecurity exams: CC, Security+, CISSP.

• Practical labs for people who want to go beyond theory

• And most importantly, a community of people working toward the same goal

Biggest achievements - Decoded Security in numbers

Maybe you can tell that I am the kind of guy who loves stats and numbers.

So let’s take a look.

Here are a few milestones I’m especially proud of:

• Grew Decoded Security from 0 to 1,304 subscribers

• Decoded Security on Facebook - 404 followers

• Decoded Security on Threads - 566 followers

• Decoded Security on Instagram - 192 followers

• Erich Winkler on LinkedIn - 739 followers

• Reached 1,145 downloads for Top 10 Cybersecurity Fundamentals

• Sold 49 copies of the 90-Day Cybersecurity Job Blueprint

But the biggest achievement is not really the numbers. ( Even though I love them)

It’s seeing people use these resources to understand difficult concepts, prepare for exams, make career decisions, and feel less lost in cybersecurity.

Thank you for reading Decoded Security

I appreciate every single one of you for reading Decoded Security and reaching out to me with interesting questions.

However, I would especially like to thank some of the people I “met” on this journey who really helped me grow and improve my newsletter.

Since a simple thank you won’t help them much, I will also share their newsletter, which I find to be one of the best I have found on this platform.

• - One of the most experienced AI and Cybersecurity experts I have had a chance to collaborate with. We had 300 subscribers at the same time.
  Well, got ahead a little! This is my thank-you for our previous collaboration, and I hope we will work on another project together again!

  ToxSec - AI and Cybersecurity

  Security for a world run by machines that lie.

• - Sam runs one of the most interesting and fastest-growing AI newsletters out there. And I can tell it’s no coincidence. If you want a fresh perspective on how to use AI properly, Slow AI is for you!

  Slow AI

  Knowing when to use AI and when to leave it the hell alone.

  By Dr Sam Illingworth

• - Mohib is with me here from the very beginning. He helped me grow and commented on my posts when no one else did. We have had many interesting discussions. Thank you!

  SK NEXUS

  Breaking down Tech for the Mango Man (Aam Aadmi/Regular Person)

  By Saqib Tahir

• - Chris is the guy from practice. While I was describing high-level concepts from textbooks, he always provided insights on how things really work from his experience. If you’re curious about protecting business assets and your privacy, I can only recommend his newsletter!

Stopping the hackers by making cyber security simple

Helping small business owners "Stop the hackers" and be safer online with easy to understand and implement cyber security advice. For entrepreneurs, the self employed, sole traders, and limited companies with one to ten employees.

By Chris #TheAntiVirusGuy Moody

What Comes Next

Decoded Security is still just getting started.

Last year, I was building the concept and the brand.

This year, I’m building the system.

The goal is simple:

To make Decoded Security one of the best places for people who want to understand cybersecurity, prepare for certification exams, and build a real career in the field.

That means more practical explanations of cybersecurity concepts.

More exam-focused resources for CC, Security+, and CISSP.

More quizzes, study plans, labs, and career-focused material.

And more content that connects textbook knowledge with real-world security work.

Because passing an exam is important.

But understanding how to think like a security professional is what actually changes your career.

If you are not sure about your next step in cybersecurity, Decoded Security is here to help.

Thank you for being part of the first year.

The next one will be even better.

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

Let’s learn and grow together!

A ransomware attack hits on a Thursday night. The team triggers recovery. The backup exists. It was running for months. And then someone realizes: the backup was pointing to the same network share that got encrypted.

Three months of data. Gone.

Simply because of a bad backup strategy.

But how did that happen?

Many people think the hard part is knowing how different recovery strategies work.

But that’s actually quite simple. You can learn that in an hour.

The catch is understanding your business well enough to choose the right strategy.

The method doesn’t matter if the requirements are wrong.

In this article, I will walk you through the entire process, from the very beginning to choosing the right backup strategy that fulfills the business requirements at the least cost.

Note: Yes, cybersecurity is all about money. Deal with it :)

What you’ll learn in this article:

• Why recovery metrics come before backup methods

• What MTD, RTO, WRT, and RPO actually mean

• How MTD, RTO, WRT, and RPO Work Together

• How to use them to make the right backup decisions

• BONUS: Printable A4 cheat sheet for certification exams with all the key backup and recovery metrics in one place

The Numbers That Drive Every Backup Decision

As always, people try to skip directly to choosing the backup methods. But remember, a good cybersecurity professional always balances the COST of security controls with their benefits.

So, before you choose a backup method, you need to understand metrics that describe the needs of your company and allow you to choose the right backup strategy.

Trust me, not all systems needs to be backup up every day.

MTD: Maximum Tolerable Downtime

This is the basic deadline. The absolute maximum amount of time a system or process can be down before the consequences become unacceptable. We're talking regulatory violations, financial collapse, reputational damage that can't be undone. Everything else is measured against this number.

If you don’t meet this deadline, you’re done!

RTO: Recovery Time Objective
This metric tells you how long the business can survive without the system.

In other words, the maximum time period within which a mission-critical system must be restored to a designated service level after a disruption.

This defines how fast you need to recover. Some systems are not important and can be out for a week. Some need to be up and running within minutes.

The shorter your RTO, the more expensive and complex your backup solution needs to be.

Remember: RTO < MTD. That’s non-negotiable.

WRT: Work Recovery Time
This is the part most people forget to account for.

The Work Recovery Time is the maximum amount of time available for certifying the functionality and integrity of restored systems and data before they go back into production.

You need to realize here that restoring a database is not the same as confirming the database is working correctly.

WRT is the validation window.

During this window, you check whether all records are intact, the application is functioning correctly, and users can log in.

RTO covers getting the system back. WRT covers confirming it’s safe to use.

RPO: Recovery Point Objective
How much data loss is acceptable?

If your RPO is 4 hours, you can afford to run backups every 4 hours and lose at most 4 hours of data in a disaster.

If your RPO is zero, you need real-time replication.

These are business decisions, not technical ones.

A security professional’s job is to translate them into the right backup architecture.

How They Connect

I know I have covered the connection between the metrics above, but it is so important that I decided to put it in one section.

If you’re preparing for any cybersecurity exam, this section is key to answering most questions about backup strategies (especially for the CISSP)

• MTD sets the ceiling. Nothing can exceed it. This is a number that should come up from your BIA (Business Impact Analysis)

• RTO is the time required to restore the system. RTO < MTD

• WRT is the time to verify that the system is safe to use. It starts the moment all systems are back online. Remember MTD = RTO + WRT.

• RPO determines how often backups run. The tighter the RPO, the more frequent the backup cycle, and the more expensive it gets.

Remember: MTD = RTO + WRT. The total time consumed by recovery and verification must never exceed your hard deadline.

How to Use These Metrics to Make the Right Backup Decision

Now you know the metrics, which means you are further than most people. Trust me, many technically oriented people tend to ignore this despite the fact that it is absolutely essential.

But now is the time to apply them.

Step 1: Start with MTD

Talk to the business.

Let them determine how long this system can be down before the consequences are unacceptable.

This number comes from your Business Impact Analysis.

It's not a technical decision. It's a business one. As a cybersecurity professional, you can help them with the analysis, but they need to be the ones who approve the number.

Step 2: Set your RTO and WRT

Once you have MTD, split it into two windows.

How long will the technical restore take?

That's your RTO.

How long do you need to verify everything works correctly before going live again? That's your WRT.

The two must add up to less than or equal to your MTD.

Step 3: Define your RPO.

Remember: This number comes from BIA.

Now that we know how fast we need to get our systems back and running, it’s time to determine how much data loss the business can tolerate.

One hour? One day? Zero?

This number directly determines how often you need to run backups and how much you’ll spend doing it.

Step 4: Now choose your backup method.

Only at this point does the method question make sense.

• Long RPO, high MTD: a weekly full backup with daily differentials is probably enough.

• Short RPO, low MTD: you need frequent backups, fast restore capability, and possibly real-time replication.

• RPO of zero: no backup method gets you there. You need mirroring.

The method is the last decision, not the first.

Every organization that skips the metrics and starts with the method ends up either overspending on protecting their systems that don’t need it, or underspending on systems that can’t afford to go down.

And that’s why certification exams put so much stress on this topic.

Conclusion

Most people think a backup strategy is a technical problem.

Pick the right method, configure it correctly, and you’re done.

I believe that after reading this article, you’re not like most people.

You understand now where those magical numbers come from and why they are so important for choosing the right backup strategy.

Take these four metrics and use them.

Next time someone asks about backup, don’t start with the methods.

Start with MTD. Ask what the real deadline is. Ask how much data loss the business can actually tolerate.

That’s the thinking. That’s how people will know you know what you’re talking about.

And if you want to know more about data security, here is what you should read next:

• Data Classification

• Data states

• Recovery sites strategies

• Backup strategies in details - NEXT WEEK

Frequently Asked Questions

What is the difference between RTO and RPO?
RTO measures time: how fast must the system be restored? RPO measures data: how much data loss is acceptable? RTO is about recovery speed. RPO is about backup frequency.

What does MTD mean in cybersecurity?
MTD stands for Maximum Tolerable Downtime. It’s the absolute maximum time a system can be unavailable before the consequences become unacceptable to the business. It’s the hard deadline that every recovery plan must be built around.

Is RTO always less than MTD?
Yes. Always. RTO must be less than MTD. MTD = RTO + WRT. If RTO and WRT together exceed MTD, the recovery plan has already failed before anything goes wrong.

Where do these numbers come from?
From the Business Impact Analysis (BIA). These are business decisions, not technical ones. The role of a cybersecurity professional is to help the business define them and then translate them into the right technical solution.

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!

Let’s learn and grow together!

Warning: CC, CISSP - Domain 2, and Security+ essential topic

Data is often the most valuable possession we have. Businesses have their trade secrets, and families have their photos from that vacation that everyone enjoyed.

You can buy a new computer or a new phone, but you won’t buy those pictures again.

In other words, it doesn’t matter who you are, we all have data that we don’t want to lose because they have value for us, financial or emotional - it is an asset for us.

And modern cybersecurity is dedicated to protecting assets.

What can you expect from this article?

In this post, I will:

• Explain the three states of data and what each one actually means

• Show you what attackers target in each state

• Give you the right controls for each state

• Show you why a layered approach is the only one that actually works

But before we move any further, I would like to provide you with more resources on Data Security.

Knowing how to protect data means nothing if you do not know what data you actually have.

Before security controls come data classification (knowing what is sensitive and what is not) and the data lifecycle (understanding how data moves through your organization from creation to destruction).

If you have not read those yet, start there:

• This Is How I Explain Data Classification to a Beginner

• The Data Lifecycle: From Creation to Destruction

This article picks up where those leave off. Now that you know what data you have and where it lives, let’s talk about how to protect it at every stage of its existence.

Do you find this article helpful? Give it a like and help me share it to more people!

The Three States of Data

Lesson to remember: Protecting data at only one state is like putting your cash in a safe, then carrying the safe through a bad neighborhood with the combination written on the side.

There are three states that data can be in. In the following section, I will describe each state and tell you the typical security controls associated with it.

Data at Rest

Data at rest is data that is stored and not currently being processed or moved.

Meaning? Those are all the data that you have saved on your hard drive, your documents in cloud storage, or backups on a tape.

This is the state most people think about first, and for good reason. It is the easiest to picture. Data sitting still, waiting to be used.

What attackers target here: Physical theft of devices, unauthorized access to storage systems, misconfigured cloud buckets, or weak access controls.

How to protect it:

• Full-disk encryption (FDE) using AES

• Database encryption for sensitive records

• File-level encryption for individual documents

• Tokenization for sensitive data fields (credit card numbers, SSNs)

• Access controls that limit who can reach the data in the first place

• Data Loss Prevention (DLP) tools

The goal is simple: even if someone gets physical or logical access to the storage, they cannot read the data without the key.

However, sooner or later, we will need to either use the data or move it somewhere else.

If you find this article helpful, give it a like and help me get this to more people who are interested in cybersecurity!

Data in Transit

Data in transit is data moving from one location to another, typically across a network.

It can be an email traveling across servers, it can be a file being downloaded from a website, or an API call carrying user records.

The sky is the limit. If you’re moving data from one place to another - this is it!

This is where people get caught off guard.

Note: You need to decrypt the data to send it to someone else as you should be the only one who has the keys from the data on YOUR system.

The moment data leaves one system and heads to another, it is exposed to the network. Without the right controls, anyone with access to that network path can intercept it.

What attackers target here: Man-in-the-middle attacks, packet sniffing on unsecured networks, DNS hijacking, rogue Wi-Fi access points.

How to protect it:

• TLS/SSL for web traffic (HTTPS)

• IPsec for network-level encryption

• SSH for secure remote access and file transfer

• SFTP instead of plain FTP

• Firewalls and intrusion detection systems (IDS) at the network layer

The goal: Ensure confidentiality and integrity while the data is moving. No one in the middle should be able to read or tamper with it.

Still reading? Excellent. Decoded Security share all the study resources for free. Give this article a like and help us get it to more people who are serious about cybersecurity!

Data in Use

Data in use is data being actively processed, accessed, or manipulated by a system or application.

It can be anything from data entered into a web form to a file open in a word processor, to calculations running in a spreadsheet, to a query result loaded into an application.

This is the most overlooked state. And it is the hardest to protect.

For data to be processed, it usually has to be decrypted first. That means it exists in a readable state in memory. If an attacker gets access to that memory, the encryption you applied at rest means nothing.

What attackers target here: memory scraping (used in many point-of-sale breaches), process injection, screen-capture malware, and insider threats with legitimate application access.

How to protect it:

• Memory encryption

• Secure enclaves, also called Trusted Execution Environments (TEEs): isolated areas of a processor where sensitive data can be processed without being exposed to the rest of the system

• User access controls that limit what each person can do within an application

• Application security controls and secure coding practices

• Data classification so the system knows how to handle sensitive data differently

• Endpoint Detection and Response (EDR) tools

The goal: minimize the window during which data is exposed and detect any attempt to access it during that window.

Why This Matters Beyond any Exam

Security controls chosen without context are just expensive guesses.

Understanding data states gives you a framework for asking the right question: Where is this data right now, and what is threatening it in that state?

That question changes how you design systems, evaluate vendors, write security policies, and respond to incidents.

It also changes how you communicate risk to non-technical stakeholders. Telling a business leader “we encrypted the database” sounds like a great idea, but as you now know, it is only a third of the whole.

Telling them “we encrypted the database, secured transmission with TLS, and deployed endpoint protection to cover data in use” tells a much more accurate story.

Key Takeaways

• Data exists in three states: at rest, in transit, and in use

• Each state has a different threat profile and requires different controls

• Encrypting storage only protects one state

• A layered, state-aware approach is the only way to cover all three

• For CISSP and Security+: Always identify the data state before selecting a control

Note: This is what you need to remember for the CC, CISSP and Security+ exam!

Conclusion

While this isn’t the most complex topic that you’ll ever see, I find it absolutely crucial for data security.

In a world where everyone uses buzzwords and competes over who knows the “best” encryption algorithm, we need people who see the whole picture.

People who know that the weakest link in the chain determines how well the data is protected.

And there is one more thing. Reading about something is one thing, but actually understanding it and making the right decisions is completely another.

And because helping you understand cybersecurity concepts is Decoded Security's top priority, I prepared a free quiz based on this article, with detailed explanations.

The Three States of Data - FREE QUIZ

Thank you for reading Decoded Security!

Best,
Erich

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!

Let’s learn and grow together!

Warning: CC, CISSP - Domain 2, and Security+ essential topic.

Every company in the world collects data, and for many, it is the most important asset they have.

Customer records, employee contracts, financial reports, internal emails.

Most people assume someone is protecting it properly.

But if there is a good rule to live by for cybersecurity experts: Assumptions kill security.

If you're studying for a cybersecurity cert right now, like this post! You're not alone.

The problem is that the moment you start talking about data protection, everybody starts talking about encryption and tools.

But which tool you are going to use in your organization isn’t that important.

The first question you should focus on is:

Which data actually needs protection, and how much?

That question is what data classification answers.

And if you’re studying for the CISSP, Security+, or just trying to understand how security programs actually work, this concept is something you need to understand deeply.

Here is what you can expect to learn from this article:

• Why data classification exists and what it actually is

• The classification levels used in government and business, and how they differ

• How the whole process of data classification works

• How classification connects directly to access control, compliance, and incident response

• Everything you need to know for the certification exams

If this is something you want to learn more about, just keep reading!

Why Data Classification exists

I like describing concepts with specific examples, because it allows people to tie them down to real situations and imagine them better.

After all, cybersecurity is supposed to solve real-world problems. We are far beyond academic debates that have no real impact.

So, imagine a hospital.

They have patient records. Financial reports. Internal memos. A lunch menu for the cafeteria.

All of that is “data.” But not all of it needs the same level of protection.

If someone leaks the cafeteria menu, no real harm is done.

If someone leaks a patient’s HIV diagnosis, lives can be destroyed, laws are broken, and the organization faces massive consequences.

So the first option would be to protect everything as classified. Well, that would probably mean your business won’t survive. The cost would be too high. The usability of the systems would be very low.

In other words:

Too much protection on everything is expensive and slows everything down. Too little protection on the wrong data leads to breaches, regulatory fines, and reputational damage.

Data classification is the solution. It forces you to think before you protect and spend your money efficiently.

What Data Classification Actually Is

Data classification is the process of categorizing data based on its sensitivity and the potential impact of its loss or unauthorized disclosure.

Simple definition. But the implications are huge.

When you classify data properly, you unlock the ability to:

• Apply the right controls to the right data (not the same controls to everything)

• Meet compliance requirements like GDPR and HIPAA

• Enforce least privilege access: people only see what they need to see

• Respond to incidents faster because you already know what was at risk

• Prevent loss of essential data by understanding what actually matters and implementing the right security controls

Classification is not a technical control. It is a foundational decision that makes all your technical controls work properly.

If you skip classification, your security program has no basis.

Remember: Classify first, then spend money on security controls!

Two Data Types You Must Know

Before we get to classification levels, there are two types of sensitive data that appear constantly in cybersecurity certifications for one simple reason.

Those two types are highly regulated, and if anything goes wrong, your company will pay the price.

So, which data are so special?

Personally Identifiable Information (PII): Any information that can identify a specific individual. Name, social security number, date of birth, biometric records, and home address.

Protected Health Information (PHI): Any health-related information tied to a specific person. This is covered under HIPAA in the US, and mishandling it carries serious legal consequences.

Both are high-sensitivity data by definition. They require the strongest classification levels and the tightest controls.

If you see either of these in an exam question, your brain should immediately think: maximum protection, strict access control, regulatory compliance.

The Classification Levels

Organizations classify data differently depending on whether they operate in the public or private sector. But the underlying logic is the same:

The more damage unauthorized disclosure can cause, the higher the classification level.

Here is how the two scales map against each other:

Remember that non-government organizations can use data classification categories of their own creation, tailored to meet their specific needs.

But these categories are the ones you’ll need for the CISSP exam.

Okay, now you know the levels.

But that is only half the picture. The other half is understanding the process that gets you there.

Most organizations follow four steps:

1. Create classification categories

Define the levels your organization will use. Public, Internal, Confidential, Restricted. Or whatever labels fit your context. The names matter less than having a consistent, documented scheme everyone understands.

2. Determine minimum security requirements per category

For each classification level, define the baseline controls that must be applied. What encryption is required? Who is allowed access? How long is the data retained? This is where classification turns into actionable policy.

3. Classify the data

Go through your data and assign the appropriate label based on sensitivity and potential impact. This step requires input from data owners, not just the security team. The people who create and use the data understand its value better than anyone.

4. Implement security controls

Now you spend money. Apply the controls defined in step two to the data classified in step three. Encryption, access restrictions, DLP policies, monitoring rules. Everything flows from the classification decision made in the previous steps.

The order matters. You do not buy tools and then figure out what you are protecting. You classify first, then implement.

How Classification Connects to Everything Else

Up until now, you might get a feeling that the whole thing is just an administrative exercise.

But it isn’t. It is the foundation of any good security program.

Let me give you a couple of examples:

Access Control: Once data is classified, you can define who is allowed to see it. You cannot enforce least privilege without knowing what you are protecting.

Compliance: Laws like GDPR and HIPAA require you to handle certain data in specific ways. Classification tells you which data falls under which regulations.

Incident Response: When a breach happens, you need to know immediately what was exposed. Classified data means you already have that answer. Unclassified data means you are guessing while the clock runs.

Data Loss Prevention (DLP): DLP tools use classification labels to automatically apply policies. If a file is labeled “Restricted,” the system can block it from being emailed externally. Without labels, DLP cannot do its job.

Audit and Monitoring: Classification tells your monitoring systems which data needs the most attention. You cannot watch everything equally. Classification tells you where to focus.

See? You can’t implement proper security controls if you don’t know what you’re protecting.

Conclusion

I hope that after reading this article, you won’t just remember - Public, Sensitive, and Private…but you will actually take it as an essential part of a security program.

I know that many cybersecurity professionals ignore this step, because it isn’t “technical” enough.

But the reality is that you can’t protect what you don’t know you have. So don’t take it as wasted time, but as an investment that will actually help you implement efficient security controls.

Looking to go deeper on data security? Start with these:

• Cybersecurity Basics: The Data Security Lifecycle

• GDPR Explained: The Privacy Law That Follows Your Data Everywhere

• How I passed the CISSP exam in 3 months!

And if you are still deciding which cybersecurity path makes the most sense for your goals, start with the career path guide.

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!

Let’s learn and grow together!

Well, that’s one way to put it, but if you’re serious about your cybersecurity career, you are going to need more than that.

That’s why I put everything you need to know about VPNs in one place.

Warning: Crucial CC, CISSP and Security+ topics

After reading this article, you will know:

• What a VPN actually is and why it exists

• Why simply using a VPN doesn’t mean you are safe

• Key components of the VPN infrastructure

• The most important VPN protocols (PPTP, L2TP, IPsec)

• Key takeaways - What you need to know as a cybersecurity professional

• Bonus - Decoded Security printable cheat-sheet: One page with the most important information

This is a foundational topic. Let’s build it from scratch.

What Is a VPN?

Let’s start with the simplest possible explanation.

When you connect to the internet from a coffee shop, your traffic travels over a network you don’t control. Anyone on that network could potentially intercept what you’re sending.

A VPN solves this problem by creating an encrypted tunnel between your device and a remote server.

Think of it like this:

Imagine you need to send a confidential letter across a city. Instead of handing it to a random stranger on the street, you put it in a locked tube, send it through a private pipe directly to the recipient, and only they can open it.

That’s a VPN.

The three things a VPN provides:

• Confidentiality: Your traffic is encrypted. Nobody in the middle can read it.

• Authentication: Both sides verify who they’re talking to.

• Integrity: The data hasn’t been tampered with in transit.

Sounds familiar? Those are core security principles. VPNs exist to enforce them over untrusted networks.

What a VPN actually is and why it exists - You know the answer now! ✅

Why Does This Actually Matter?

Today, remote work is standard. Employees connect to company systems from home, hotels, and airports. Without VPNs, every one of those connections is a risk.

A company that doesn’t use VPNs for remote access is exposing internal systems to anyone who can intercept traffic on a public network.

That’s why every serious organization uses VPNs. And that’s why every cybersecurity professional is expected to understand them.

Besides that, people are starting to use different VPN providers for personal use. You have seen the ads, right?
”Connect securely from anywhere in the world..”

Is it a good idea to use a VPN while traveling?

Yes, but before you do, make sure to continue reading! There is one catch that you need to be familiar with!

Why Every VPN Isn’t Safe

When you connect to a VPN, you are not becoming anonymous. You are moving trust.

Before the VPN: your ISP (Internet Service Provider) can see your traffic.

After the VPN: your VPN provider can see your traffic.

You haven’t eliminated the problem. You’ve relocated it.

And if you’re using a free VPN, it gets worse.

Free VPNs are not a service. They are a business. If you’re not paying for the product, you are the product. Your browsing history, location, and behavior patterns get packaged and sold.

Some free VPN providers have been caught injecting ads into user traffic. Others have been linked to data harvesting operations.

You installed a privacy tool, and you handed your data to a stranger.

Even paid VPNs aren’t automatically safe either. The questions that actually matter:

• Do they keep logs of your activity?

• Where are they headquartered, and what laws apply to them?

• Have they been independently audited?

The rule is simple. A VPN is only as trustworthy as the provider running it. Choose carefully.

Why simply using a VPN doesn’t mean you are safe - Checked! ✅

This marks the end of the “users” section. I felt obligated to spread the awareness as I personally know many people who use various VPNs, and it would be better if they didn’t use any at all.

Now we are moving to the part of the article that is crucial for cybersecurity professionals and CISSP candidates!

Key Components of a VPN

Before we get into different protocols, let’s quickly describe what the VPN is actually made of.

VPN Client

The software that is installed on your device. It initiates the connection, handles encryption, and manages the tunnel.

VPN Tunnel

The encrypted path between your device and the VPN server. All your traffic travels through this tunnel, hidden from anyone outside it.

VPN Server

The endpoint on the other side. It receives your encrypted traffic, decrypts it, and forwards it to its destination. In a corporate setup, this sits at the edge of the company network. In a consumer setup, it’s operated by the VPN provider.

Simple, isn’t it?

Each user has a client on their device that handles the connection between their device and the VPN server.

Now..buckle up. Because the next topic is one of the most tested in the certification exams and is actually essential to understand for real cybersecurity work.

Key components of the VPN infrastructure - Great progress! ✅

VPN Protocols

A VPN isn’t a single technology. It’s a concept implemented through different protocols, each with its own approach to encryption, authentication, and performance.

Basically, in this section, we are going to break down how the “tunnel” is created and implemented.

PPTP (Point-to-Point Tunneling Protocol)

PPTP is one of the oldest VPN protocols. You’ll see it mentioned in study materials. You will almost never see it used in practice.

Why? Because it has serious known vulnerabilities. The encryption it uses is weak by modern standards. It was fast, which was important in the 1990s when processing power was limited. That tradeoff no longer makes sense.

I only mention it because it often appears in the certification exam as the least secure protocol.

For the exam: PPTP = fast, obsolete, insecure. Don’t recommend it. Don’t use it.

L2TP (Layer 2 Tunneling Protocol)

L2TP is the next generation. But here’s the catch: L2TP doesn’t provide any encryption on its own.

It creates the tunnel. Nothing more.

That’s why you almost always see it paired with IPsec. Written as L2TP/IPsec.

When properly implemented with IPsec, L2TP/IPsec is considered secure. But it’s a legacy solution at this point. You’ll see it in older enterprise environments and on exam questions.

For the exam: L2TP alone = no encryption. L2TP/IPsec = secure when properly implemented.

IPsec (Internet Protocol Security)

This is the one you really need to understand.

IPsec isn’t a single protocol. It’s a suite of protocols designed to authenticate and encrypt IP packets. It can work as a standalone VPN solution or in combination with L2TP.

IPsec has two main components, and knowing the difference between them is high-probability exam content.

Authentication Header (AH)

AH calculates a cryptographic hash over the entire packet. This provides:

• Integrity: the packet hasn’t been modified in transit

• Authentication: you know who sent it

What AH does NOT provide: encryption. The data is visible. AH just ensures it hasn’t been tampered with.

Encapsulating Security Payload (ESP)

ESP encrypts the payload of the IP packet. This provides:

• Confidentiality: the data is hidden

• Integrity

• Limited authentication

ESP is what actually hides your data. AH confirms the data wasn’t touched. In practice, they’re often used together.

There is much more to the IPsec protocols, but I think this is enough for one day.

The most important VPN protocols (PPTP, L2TP, IPsec) - Checked! ✅

Key Takeaways

Here’s what you need to walk away with.

On the basics:

• A VPN creates an encrypted tunnel between your device and a remote server

• It provides confidentiality, authentication, and integrity over untrusted networks

• A VPN moves trust, it doesn’t eliminate it. Your provider can see everything your ISP used to see

• Never use a free VPN. If you’re not paying for the product, you are the product

On VPN components:

• Client: initiates the connection and manages the tunnel from your device

• Tunnel: the encrypted path your traffic travels through

• Server: receives, decrypts, and forwards your traffic at the other end

On protocols:

• PPTP: fast, obsolete, do not use

• L2TP: no encryption alone, secure when paired with IPsec

• IPsec: the gold standard, used standalone or with L2TP

On IPsec components:

• AH: integrity and authentication, no encryption

• ESP: confidentiality, integrity, limited authentication

• They’re often used together

Bonus - Decoded Security Cheatsheet

Everything for the exam and real-work practice at one page.

Decoded Security Vpn Cheat Sheet

27.4KB ∙ PDF file

Download

Download

Conclusion

VPNs are not complicated once you understand what they’re actually doing.

They exist to solve one problem: how do you communicate securely over a network you don’t trust?

The answer is: build a private tunnel. Encrypt what goes through it. Authenticate who’s on each end. Verify nothing was changed in transit.

Every VPN protocol, every configuration option, every exam question circles back to those fundamentals.

If you got value from this article, give it a like. It helps me understand which topics to cover next and helps other people find it.

And if you want a structured path through all the networking and security fundamentals that actually matter for certifications and job interviews, subscribe to Decoded Security.

Every article is built to move your knowledge forward, one concept at a time.

Looking to go deeper on networking? Start with these:

• This Is How I Explain DNS to Beginners

• This Is How I Explain Subnetting to a Beginner

• What Actually Happens When You Open a Website

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!

Let’s learn and grow together!

Millions of accounts. All passwords are hashed with MD5. No salt. The database was dumped and circulated online, and within days, the majority of passwords had been cracked.

And all the attacker needed was a wordlist and a loop.

But this couldn’t possibly have happened today, right?

Well, I hate to break it to you, but the same mistakes are still being made today. That’s why you need to understand what exactly happened in 2012 and how to prevent it from happening on your systems.

And what better way of learning than actually performing the attack?

Note: This article assumes you understand what hashing is and why it matters. If you are not there yet, read these first:

• Hashing: What It Is and Why It’s Not the Same as Encryption

• Hashing Algorithms: What Any Cybersecurity Specialist Needs to Know

What actually happened in 2012

Most modern systems don’t store passwords in plaintext, but in hashes.

That’s why when the attacker steals the password database, all they can see are hashes.

Once they have the hashes, the goal is quite simple.

To reverse them and figure out what password produced each hash.

But how?

Well, the first option is brute force. Try all possible combinations and sooner or later, you’ll hit the jackpot.

But it can take years.

So they need something more efficient - a dictionary attack.

Take a list of common passwords. Hash each one. Compare the result against the stolen hashes. If there’s a match, the password is cracked.

No magic. Just a list of words and a simple loop.

It works because most people choose predictable passwords.

“password”, “123456”, “password123”.

Variations with numbers at the end. Seasons plus years. The attacker’s wordlist reflects exactly how real humans think.

That’s exactly what happened in 2012. LinkedIn’s database was dumped. The attackers ran a wordlist against 117 million SHA-1 hashes. And because there was no salt and the algorithm was fast, the majority cracked in days.

And with SHA-1? A modern CPU can compute hundreds of millions of SHA-1 hashes per second. A poorly hashed password is cracked before you finish reading this sentence.

What is salting

If you’ve been paying attention, you noticed this sentence: “because there was no salt.”

What does that even mean? Are we worried about our passwords not being tasty enough? Or what?

Well..let’s take a look at it.

A salt is a random string added to a password before it gets hashed.

Without salting, every user who chooses “password” gets the same hash (assuming the same hashing algorithm):

password → 5f4dcc3b5aa765d61d8327deb882cf99

Always. Every time. On every system in the world.

With salting, a unique random string is generated per user and combined with the password before hashing:

password + x7k2mR9q → completely different hash
password + 4mNpQ2rs → completely different hash again

Two users with the same password now have completely different hashes in the database. An attacker who steals the database cannot use precomputed tables. They have to attack each hash individually. That changes the economics of the attack entirely.

And let’s face it, it’s all about the money.

Why MD5 and SHA-1 are dangerous for passwords

Note: If you have no idea what MD5 or SHA-1 means, make sure to read the articles linked above! You won’t regret it!

Both algorithms were designed for speed. Fast hashing is excellent for verifying file integrity or generating checksums. It is catastrophic for password storage.

A modern CPU can compute hundreds of millions of MD5 hashes per second.

A GPU pushes that into billions.

A weak password is cracked before you finish reading this sentence.

Neither algorithm was designed with password storage in mind. Using them for that purpose is a fundamental design mistake, not a configuration issue.

Make sure to remember that for both the real-world scenarios and certification exams!

What do we use instead?

bcrypt was designed specifically for passwords. The key difference is intentional slowness.

It has a cost factor, sometimes called a work factor, that controls how computationally expensive each hash computation is.

The same password takes milliseconds with MD5 and seconds with bcrypt. At scale, that difference makes automated cracking attacks impractical.

A wordlist with 56 passwords takes MD5 a fraction of a millisecond. The same list against bcrypt takes several seconds. Scale that to millions of passwords and the attack stops being viable on normal hardware.

Note: There is an even newer standard, Argon2, but bcrypt is still widely used.

What you are about to do

It’s time to get some hands-on experience.

The lab below uses a real Docker environment, real password hashes, and a real dictionary attack script.

You will crack three passwords in under a second. You will watch one password survive because it is not in the wordlist. You will see bcrypt slow everything down to a crawl.

Theory tells you this happens.

And the biggest benefit? Next time you’re in an interview, you will have a nice personal project to talk about.

Get 14 day free trial

The lab is waiting. Subscribe to access the full step-by-step walkthrough below.

Read more

You feel that urge to do something, but you always end up watching random YouTube videos, downloading Kali Linux, and feeling like you are getting nowhere.

In cybersecurity, a lack of direction is more dangerous than a lack of knowledge.

I am going to be honest with you. I am not a penetration tester. I am a Cybersecurity Manager.

But I have worked alongside pentesters. I have interviewed candidates for offensive security roles. And I have studied this path carefully enough to know exactly what separates the people who break in from the ones who stay stuck.

This is the study plan I would follow if I had chosen this path.

Penetration Testing (Offensive Security)

Penetration testing is one of the 5 cybersecurity paths you can choose.

If you are not familiar with the cybersecurity paths, read this first:

👉 How to Choose the Right Cybersecurity Role Before You Waste Time and Money on the Wrong Certifications

But before you deep-dive into the materials I am about to provide, make sure this path is really for you.

You do not want to waste weeks and months learning things that will not get you any closer to your goal.

It is a great fit if you:

• Enjoy thinking like an attacker - finding weaknesses before others do

• Like structured problem solving with clear objectives

• Are comfortable going deep into technical detail

• Enjoy learning how systems actually work under the hood

• Have patience for long, methodical investigation

Be honest with yourself:

• Penetration testing is not beginner-friendly

• Most entry-level roles require at least some IT or networking background

• You will spend months building foundations before touching offensive tools

• The learning curve is steeper than almost any other cybersecurity path

But don’t get me wrong here. I am not saying it isn’t worth it! All I am saying is you need some IT experience first!

The Decoded Security Penetration Testing Roadmap

This roadmap has three main goals.

First, make sure you understand the cybersecurity fundamentals that underpin everything in offensive security.

Second, make sure you understand how systems and networks actually work, because you cannot attack what you do not understand.

Third, force you to practice in real environments, not just watch tutorials.

What is your target role? Let me know in the comments and let’s discuss your next steps!

Here is the exact roadmap I would follow if I had to start from scratch.

Step 1: Build the Right Foundation

Before you touch a single offensive tool, you need to understand how cybersecurity actually works.

Most beginners skip this step. They download Kali Linux on day one and wonder why nothing makes sense.

Do not make that mistake.

Make sure to understand these especially:

1. Threat ≠ Risk ≠ Vulnerability: Why CISSP Basics Matter More Than You Think

2. Cybersecurity Controls from Zero to Hero

3. The Psychology of Hacking: Why Smart People Fall for Dumb Scams

4. 6 Myths That Are Killing Corporate Cybersecurity

Step 2: Master Networking and Systems

You cannot hack what you do not understand.

Every penetration tester needs a deep understanding of how networks and systems communicate. This is not optional. It is the foundation of everything.

Focus on:

Networking fundamentals

• This Is How I Explain DNS To Beginners

• Top 5 Most Important Network Protocols for Cybersecurity Beginners

• This Is How I Explain Subnetting To a Beginner

• Why Most Beginners Don’t Understand How Networks Actually Work

• 7 Networking Questions That Instantly Expose Beginners in Cybersecurity Interviews

Linux - non-negotiable

• This Is How I Explain Linux To a Beginner

• Top 5 Linux Commands for an Entry-Level Cybersecurity Role

Cryptography basics

• Symmetric vs Asymmetric Encryption

• Digital Signatures Explained

• [This Is How I Explain PKI To a Beginner] - will be published soon!!

Attack techniques

• This Is How I Explain The Man-in-the-Middle Attack To a Beginner

• How Phishing Works in 5 Steps

• The QR Code Trap

Do you struggle with any of these concepts? Comment the one you don’t understand and I will break it down for you.

Step 3: Get Your First Certification

Most people ask the wrong question: “Which certification should I get?”

The right question is: “Which certification fits where I am right now?”

For penetration testing, here is the honest order:

Start here: eJPT (eLearnSecurity Junior Penetration Tester)

Free to study. Practical exam. Actually tests whether you can do the work, not just memorize definitions. This is the most realistic first certification for this path.

Then: CompTIA PenTest+

Widely recognized. Good intermediate step. Bridges the gap between foundational knowledge and hands-on offensive work.

The goal: OSCP (Offensive Security Certified Professional)

The industry standard for senior offensive roles. Do not attempt this first. Attempt it when you are ready - but consider attempting it earlier than you feel comfortable. Passing OSCP before you have extensive experience sends a signal that nothing else on this path does.

Read the full certification breakdown here: 👉 Stop Buying Random Certifications. Here’s Exactly Which One You Need Based on Your Path

Step 4: Practice in Real Environments

Reading about penetration testing will not make you a penetration tester.

You need to practice. Every day. In real environments.

Here are the free platforms I would use:

TryHackMe - Start here. Guided learning paths with real machines. The most beginner-friendly platform on this list. Complete the “Pre-Security” and “Jr Penetration Tester” paths first.

OverTheWire: Bandit - Teaches Linux command line through puzzles. Surprisingly fun. Surprisingly hard. Do this alongside TryHackMe.

HackTheBox - More advanced. Move here once you are comfortable with TryHackMe. The machines are harder and less guided.

The rule: One hour of practice every day beats five hours on weekends. Consistency matters more than intensity.

Do you struggle with any of these platforms? Comment below and I will point you to the right starting point.

Leave a comment

Step 5: Build a Portfolio

This is the step most beginners skip. Do not skip it.

A penetration testing portfolio proves you can do the work before you have a job to prove it.

What to include:

• CTF writeups - document every challenge you solve on TryHackMe and HackTheBox. Explain what you did, why you did it, and what you learned.

• Personal lab - set up a home lab with VirtualBox or Docker. Document your setup.

• A GitHub profile - publish your scripts, notes, and writeups publicly.

• A blog or newsletter - writing about what you learn forces you to understand it deeply. It also makes you visible to recruiters.

Hiring managers for offensive security roles do not just look at your CV.

They look at your GitHub. They look at your write-ups. They look for evidence that you actually do this.

Have you started a portfolio? Comment below and share it. I will give you feedback.

Leave a comment

Conclusion

Most people do not fail in penetration testing because it is too hard.

They fail because they never had a plan.

They download Kali Linux on day one. They watch random YouTube videos. They jump between tools without understanding what they are doing or why.

That is how months turn into years with nothing to show for it.

This roadmap fixes that. It gives you the structure I wish someone had given me when I was learning this field.

It tells you:

• What to learn

• In what order

• And how to actually practice it

You will start thinking like someone who can:

• Understand how systems communicate

• Identify realistic attack vectors

• Build the skills that actually get you hired

You already have the roadmap. Now it is about execution.

See you in the comments.

Thank you for reading Decoded Security!

Erich

Comment your target role and your current level. I will give you your next step.

💬 Which step feels most challenging right now? Comment below - I read every response.

Leave a comment

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!

Let’s learn and grow together!

Without it, the internet as we know it wouldn’t exist.

There would be no way to verify that someone is who they claim to be.

So what can you expect today?

After reading this article, you will understand:

1. What the goals of the Public Key Infrastructure (PKI) are

2. What functions and components PKI has

3. How it fulfills its goals

And as a bonus, I will tell you exactly what you need to know for cybersecurity exams and interviews.

So if you are serious about cybersecurity, make sure to read this!

Warning: CC, Security+, and CISSP relevant topic!

Do you want to build a career in cybersecurity? Take a 2-minute cybersecurity quiz and get a personalized reading list based on your background and goals.

Core Objectives of PKI

Before we deep dive into individual components of the PKI, I want to make sure absolutely clear.

PKI isn’t about encryption!

Does it use cryptographic algorithms? Absolutely.

But it is only one small part of a complicated system.

And if you’ve been reading Decoded Security for a while, you know that everything needs to be tied to the core cybersecurity objectives - CIANA. (If you’re not familiar with the CIANA triad, just read the Core Cybersecurity Objectives - Summary.)

So what are the core objectives of the PKI?

• Authentication: To confirm that users, devices, and applications are who they claim to be.

• Confidentiality: To encrypt data so that only the authorized recipient can read it.

• Data Integrity: To guarantee that information has not been altered or tampered with during transit.

• Non-Repudiation: To provide proof of the origin of data, preventing a sender from denying they sent a message or signed a document.

Excellent, now we know its goals. Let’s dive into how they are achieved.

Are you interested in how PKI works? Give me a like so I know I am not alone!

PKI - Key function

Now that we know what we want to achieve with the implementation of the PKI, let’s take a look at how it’s achieved.

Key function: PKI manages the entire lifecycle of digital certificates, which bind public keys to specific identities (people, organizations, or devices).

Don’t know what a digital certificate is? Don’t worry, we all have been there.
Read this first: What is the digital certificate?

In other words, it allows us to verify that a specific public key really belongs to a person, organization, or any other entity.

Why is it so important?

Imagine I generate a key set - Public and Private key, and then a certificate

I will simply create a website that looks exactly like your bank. Your browser will ask me for a certificate, so I will simply generate it and send it.

Everything seems legit, and you will start entering your credentials, and..I think you can see the problem now.

For this reason, there is an independent entity that both your browser (or you) and the bank trust, called a certification authority.

This entity would sign my certificate, but only after I provide proof that I am really your bank. Since I can’t provide any kind of proof that I am your bank, they wouldn’t sign my certificate, and you wouldn’t trust me.

The attack just failed.

So, here is the key information I want you to take away from this chapter.

The PKI introduces a system that allows us to bind a public key to a specific entity ( e.g., a bank) by signing its digital certificate that includes its public key.

The digital certificate is signed by a CA (Certification Authority) that is trusted by both communicating parties.

Don’t know how asymmetric encryption works and what a public key is? I got you covered: Asymmetric encryption - Introduction

PKI - The Passport Analogy

I know I dropped a lot of terms on you. Today is about getting the main idea.

So let me use an analogy that helped me to understand the whole system a couple of years back!

Think of PKI like a passport system.

When you travel internationally, border control does not know you personally. But they trust your passport because they trust the government that issued it.

PKI works exactly the same way.

Here is the mapping:

Certificate Authority (CA) = the government: The trusted organization that issues and signs digital certificates. Everyone agrees to trust the CA. If the CA says a certificate is valid, everyone accepts it.

Digital Certificate = your passport: A document that proves your identity online. It contains your public key and is signed by a CA to confirm it is legitimate.

Public Key = your identity: Visible to everyone. Just like your name and photo on a passport. Anyone can see it.

Private Key = your fingerprint: Known only to you. The unique proof that you are who you say you are. Cannot be faked or transferred.

The CA’s signature is what makes it all work.

Without a trusted authority vouching for your identity, anyone could create a fake certificate claiming to be your bank, your email provider, or anyone else.

Did this analogy helped you? Give me a like so I know it’s worth creating them!

Key Takeaways

If this all feels confusing, don’t worry, it will all start to make sense.

To fully understand this problem, make sure to understand the following topics:

👉 Certification Authorities: What is it and why do we need it?

👉 Digital Signatures Explained

👉 Symmetric vs Asymmetric Encryption

Once you understand these topics, the whole PKI process becomes clearer. And if it doesn’t, just comment under the post, and I will explain it better!

Did this article help you to understand the basics of the PKI process? Give it a like and help me to share it with more people interested in cybersecurity!

Conclusion

Congratulations! You now understand what PKI actually is and why it exists.

And more importantly, you understand the problem it solves - which is exactly the question the CISSP exam will ask you.

Next time, we will look at how this connects to the real world. Because PKI is only a general system, to really understand how it is used, one piece is still missing: the chain of trust.

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!

Let’s learn and grow together!

📚 Essential CISSP topic

If you’re preparing for the CISSP exam or are serious about your cybersecurity career, make sure to read this.

Because this is one of the topics that distinguishes juniors from senior professionals.

When I hit security models in Domain 3, my instinct was the same as most candidates:

Open the book. Highlight every name. Make flashcards. Hope my brain hangs on until exam day.

Bell-LaPadula. Biba. Clark-Wilson. Brewer-Nash. Graham-Denning. Take-Grant.

Eight names. Multiple rules each. Some protect confidentiality, some protect integrity, and some have weird rules that I don’t understand.

And here’s the uncomfortable truth 👇

The candidates who fail this section aren’t the ones who forgot a definition. They’re the ones who memorized all eight and still couldn’t answer the question.

This article isn’t a textbook dump. It’s a way to compress 30 pages of CISSP content into a mental shortcut you can actually use on exam day.

And it's something that helped me pass the CISSP exam in 3 months!

Warning: This is one of the most tested topics in CISSP Domain 3.

What is a security model?

A security model is just a formal representation of a security policy. It defines:

• Who (Subject) can access what (Object)

• Under what conditions

• Which kind of protection it enforces (confidentiality, integrity, or both)

Note: If you’re not familiar with terms such as Subject and Object, read this first: Access Controls: Who Gets the Keys?

I know, it all sounds boring.

That’s why most candidates default to rote memorization. (Luckily I have a very bad memory, so that wasn’t an option for me)

Then the exam hits them with a question like this:

“A defense contractor needs to prevent classified intelligence from leaking to lower clearance levels. Which model best supports this requirement?”

Notice what the question is not asking:

• It’s not asking for the definition

• It’s not asking who invented it

• It’s not asking which government uses it

It’s asking: What goal needs to be protected, and which model was built for that exact goal?

That’s the whole game.

Security models are just answers to specific real-world problems. Once you know the problem, the model picks itself.

The 2-Question Filter

As I have mentioned, I have a terrible memory. That’s why I created my personal Decoded Security framework to make sure I can choose the right model in any situation.

For every security model question on the exam, I ask:

Q1: What is being protected? Confidentiality or integrity?

Q2: How is information allowed to flow?

If you can answer those two, you’ll get more than 80% of model questions right without remembering a single rule by heart.

Here’s the map.

Models That Protect CONFIDENTIALITY

These models exist for one reason: To ensure confidentiality.

Bell-LaPadula

• Rules:

  • No read up (The simple security rule)

  • No write down (The * property rule).

  • The strong property rule: Subject's clearance and objects classification needs to be equal

• A junior analyst can’t read top secret. A general can’t write classified info into an unclassified channel.

• Built for: U.S. Department of Defense. Multilevel military systems.

• Memory hook: BLP = Block Leakage of secrets properly.

Brewer-Nash (Chinese Wall)

This particular security model is really interesting. Basically, it is a set of rules that say: If you can access A, you can’t access B. And this all happens within one company.

• Rule: You can’t access two datasets that conflict.

• A consultant working with Bank A can’t suddenly access Bank B’s files.

• Built for: Financial firms, law firms, audit firms.

• Memory hook: Brewer = Builds walls between conflicting clients.

Graham-Denning

Note: Not that important for the exam.

• Rule: 8 primitive operations control the creation, deletion, and granting of rights for subjects and objects.

• Built for: Multilevel secure operating systems.

Take-Grant

Note: Not that important for the exam.

• Rule: Rights transfer between subjects via 4 operations: Take, Grant, Create, Remove.

• Built for: Theoretical analysis of how privileges propagate through a system.

Models That Protect INTEGRITY

These flip the script. They don’t care if you read something. They care that you don’t write garbage into critical systems.

Biba

• Rule: No read down (simple integrity axiom). No write-up (*-integrity axiom).

• A low-integrity process can’t pollute high-integrity data. A junior dev can’t push untested code directly into production payments.

• Built for: Systems where data corruption is worse than data exposure.

• Memory hook: Biba = Block Bad data going UP.

Clark-Wilson

• Rule: Users don’t touch data directly. They access it through well-formed transactions.

• Just remember here that the user does not access the data directly, but only through predefined procedures.

• You might get a question about what the “access control triplet” is:

  • It is the relationship between a user and a set of programs that operate on a set of data items.

  • Subjects → transformation procedures (programs) → data (Data items)

• Built for: Banking, accounting, transactional databases.

• This is the model behind every system where you can’t edit a record without a controlled workflow.

Bell-LaPadula vs Biba: The mirror trick

These two are the most tested models on the exam.

The simplest way to keep them straight:

They are literal mirrors of each other.

If you remember one, you can derive the other by flipping the arrows.

I’ll include a clean mirror diagram in the published version. If you want a printable cheat sheet, comment “Cheatsheet” and I’ll send it to you!

Leave a comment

How to apply this on exam day

Read the scenario. Identify two things:

1. What is the threat? Leakage = confidentiality model. Corruption = integrity model.

2. What environment?

   • Military / classified data → Bell-LaPadula

   • Bank / transactional system → Clark-Wilson

   • Consulting / audit / conflict of interest → Brewer-Nash

   • Critical system integrity → Biba

That’s it.

Most questions don’t require you to recite the “star property” or the “discretionary property.” They require you to match a real-world problem to the model that was designed for it.

If you want the deeper foundation behind these models, my earlier article on the 8 Security Principles every CISSP candidate thinks they understand covers the design thinking these models came from.

Key Takeaways

• Don’t memorize models. Memorize what they protect.

• Group them: confidentiality vs integrity.

• Bell-LaPadula and Biba are mirrors. Learn one, and you get both for free.

• Clark-Wilson is the banking model. Brewer-Nash is the consultant model. Bell-LaPadula is the military model.

• Exam questions reward pattern recognition, not definitions.

Conclusion

I know that Security models can sound very abstract at first, but there is a reason the CISSP tests as much as it does.

It allows security professionals to create a general framework and design systems based on the business needs, not the other way around!

I have spent days trying to figure this all out, and I truly hope this will help you get it in under 90 minutes!

Good luck, and thank you for reading Decoded Security!

PS: Here is a printable cheatsheet to make it all easier for you!

Cissp Security Models Cheat Sheet

76.3KB ∙ PDF file

Download

Download

Want the rest of Domain 3 simplified?

Security models are one piece. Domain 3 also covers cryptography, secure design principles, system architecture, and security capabilities of information systems. It’s the heaviest, most technical domain on the exam.

If you want a structured way to master it without losing your mind, I have something just for you:

👉 CISSP Domain 3: Complete Guide

Built the same way: pattern recognition over memorization.

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!

Let’s learn and grow together!

That’s non-negotiable.

If that scares you, I have good news.

Linux is a complex environment. But you don’t need to know everything, at least not for most cybersecurity roles.

You just need to know what actually matters.

And that’s exactly what I am going to tell you today.

The Misconception That Stops Most Beginners (Including Me)

When I used to hear “learn Linux for cybersecurity” I pictured memorizing hundreds of commands.

ls. cd. chmod. grep. awk. sed. netstat. ps. curl. wget.

The list feels endless. (And it is!)

So I tried to avoid it for as long as possible. And of course, I hit the wall.

Here is the truth that I wish someone had told me back then:

You don’t need to know everything about Linux. You just need to understand the general concept and how to read the manual. Everything else will follow.

The Core Idea Of Linux

In Windows, everything has a graphical interface. You click folders, drag files, open menus.

Linux works differently.

In Linux, everything is a file.

Your documents are files. Your settings are files. Your hardware devices are files. Your network connections are files. Even your running processes can be accessed as files.

This is not just a technical detail. It is the model that makes Linux make sense.

Think of it this way:

In Windows, you configure your WiFi through a settings menu with buttons and dropdowns.

In Linux, you can configure your WiFi by editing a text file. Because the network configuration is stored as a file. Like everything else.

This is why Linux is so powerful for cybersecurity. When everything is a file, you can read it, write it, copy it, move it, and automate it with simple commands.

And that is exactly what security professionals do every day.

Top 4 Things You Need Know To Start

Before you learn a single command, you need to understand four foundational concepts. Everything else builds on these.

1. The Linux Filesystem

The Linux filesystem is organized as a single tree starting from the root directory, written as /.

Everything lives somewhere in that tree.

The most important directory for cybersecurity work is /var/log.

This is where system logs live. When something goes wrong or when you are investigating an incident, this is where you look first.

2. Linux Distributions

Linux is not one operating system. It is a family of operating systems built on the same foundation.

Each version is called a distribution.

The ones you will encounter most in cybersecurity:

• Ubuntu - the most beginner-friendly, great for learning

• Kali Linux - built specifically for security testing, comes with hundreds of security tools pre-installed

• Debian - stable and widely used in servers

• CentOS / Rocky Linux - common in enterprise environments

For beginners, start with Ubuntu. Once you are comfortable, explore Kali for security-specific work.

3. Permissions

Linux controls who can do what to every file and directory.

Every file has three permission levels:

• Owner - the person who created the file

• Group - a defined group of users

• Others - everyone else

And three types of permission:

• Read (r) - can view the file

• Write (w) - can modify the file

• Execute (x) - can run the file as a program

When you see something like -rwxr-xr-- in a terminal, that is the permission string. It tells you exactly who can do what with that file.

4. Basic Commands

Once you understand the filesystem and permissions, commands start making sense.

I already wrote a full breakdown of the five commands you actually need for an entry-level cybersecurity role.

If you have not read it yet, start there before anything else:

How To Actually Install and Practice Linux

Reading about Linux is not enough. You need to use it.

Here are the two best options for beginners:

Option 1: Docker (Recommended for complete beginners)

Docker lets you run a Linux environment inside any operating system without changing anything on your computer.

You can spin up a Linux container, practice commands, break things, and delete it when you are done. No risk to your main system.

How to start:

1. Install Docker Desktop on your computer (free)

2. Open your terminal and run: docker run -it ubuntu

3. You now have a full Ubuntu Linux environment to practice in

This is the fastest way to get hands-on with Linux without any setup complexity.

I prepared a complete guide for you: Run Your First Linux Environment in 60 Minutes (FREE)

Option 2: Dual Boot (Recommended when you are ready to go deeper)

Dual booting means installing Linux alongside your existing operating system.

When you start your computer, you choose which one to use.

This gives you a full, native Linux experience. Performance is better than Docker, and you get used to using Linux as your actual working environment.

The tradeoff is that setup takes more time, and there is a small risk of something going wrong during installation if you do not follow instructions carefully.

Use Docker first. Once you are comfortable with the basics, consider dual-booting for a more immersive experience.

Free Practice Platforms

Beyond your own machine, these platforms let you practice Linux in real cybersecurity scenarios:

• TryHackMe - guided learning paths with Linux challenges built in. Perfect for complete beginners.

• OverTheWire: Bandit - a free wargame that teaches Linux commands by making you solve puzzles. Surprisingly fun.

• HackTheBox - more advanced, better suited once you have the basics down

Conclusion

Congratulations! You just made another step in your cybersecurity journey.

But Linux isn’t something you’ll learn through reading, you have to execute!

That’s why I want you to do the following steps RIGHT NOW:

1. Install Docker on your computer

2. Run a Linux Distribution

3. Finish the Free Lab I prepared for you: Run Your First Linux Environment in 60 Minutes

4. Comment on what your biggest problem was under this article - let me help you out!

Leave a comment

Good luck!

- Erich

Where To Go Next

If this article gave you the foundation, the next step is getting practical with the actual commands:

👉 Top 5 Linux Commands for an Entry-Level Cybersecurity Role

And if you want to know which cybersecurity path makes Linux most relevant for your specific goals:

👉 How to Choose the Right Cybersecurity Role

Leave a comment

Want a clear 90-day plan for turning your knowledge into a job offer?

👉 The 90-Day Cybersecurity Job Blueprint - €9.99

4.8 stars. 45 people have used it. 14-day money-back guarantee.

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

A resume that cannot communicate those skills will get you rejected before anyone finds out what you are capable of.

I have spent a long time helping people build cybersecurity knowledge.

Certifications, frameworks, and technical fundamentals. But I can see very often people get passed over for roles they could do in their sleep.

The problem is rarely competence. It is that piece of paper that says: I can do this! Hire me!

I am a Cybersecurity Manager. I sit on the hiring side of this process. And there are four specific things I see on resumes that put candidates in the reject pile before anyone picks up the phone.

None of them is what most resume guides talk about.

One of them will surprise you, because you are probably doing it right now, thinking it makes you look more qualified.

Read more

I have seen SOC analysts study for penetration testing certs because they looked impressive on LinkedIn.

I have spoken to GRC professionals who spent six months on Security+ when they didn’t need it for a single job they applied for.

None of them made a bad decision because they were careless. They made a bad decision because nobody told them the truth:

The certification doesn’t matter. The path does.

So, Path first. Certification second. In that order.

If you are not sure yet which of the five paths fits your background, go back and read the previous article first. Choosing the wrong path makes every certification decision harder.

Path 1: Offensive Security

Target roles: Penetration Tester, Red Team Engineer

This is the path most people romanticize and the one with the steepest entry requirements. Offensive security is not beginner-friendly. Anyone who tells you otherwise is selling you something.

Start here:

eJPT (eLearnSecurity Junior Penetration Tester) is the most realistic first cert for this path. It’s practical, affordable, and actually tests whether you can do the work - not just whether you memorized definitions. It teaches you to think like an attacker on real systems, which is the entire point.

After eJPT, CompTIA PenTest+ is a solid intermediate step that many employers recognize.

Then comes OSCP. The conventional advice is to wait until you have extensive hands-on experience. My take is different.

Attempting OSCP early - even before you feel ready - signals something no other cert on this path does: that you are serious enough to attempt the hardest practical exam in offensive security before you need to.

Passing it early separates you from the hundreds of people who say they want to be a pentester but never commit.

It will be harder without experience. But that difficulty is the point.

What to avoid: CISSP on this path is largely irrelevant until you move into management. Security+ is useful for foundational knowledge but won’t differentiate you for offensive roles.

Path 2: Security Operations (SOC)

Target roles: Security Analyst, Incident Responder

SOC is the most accessible entry point into cybersecurity for people without a deeply technical background. It’s also the path where Security+ actually earns its reputation.

Start here:

CompTIA Security+ is the right first cert for this path. It’s widely recognized, required or preferred in many SOC job postings, and covers the foundational knowledge you need to understand what you’re monitoring. It’s also DoD-approved, which matters if you’re targeting government or defense-adjacent roles.

After Security+, CompTIA CySA+ is the natural next step. It focuses on threat detection, behavioral analytics, and incident response - exactly what SOC analysts do day to day.

ISC2 CC is worth considering before Security+ if you want a free way to prove foundational knowledge while you prepare. It costs nothing to sit and covers the same core concepts.

What to avoid: Jumping to CISSP as a junior SOC analyst is putting the cart before the horse. Build your operational experience first.

Path 3: Security Architecture and Engineering

Target roles: Security Engineer, Cloud Security Engineer, Security Architect

This path splits depending on where you want to specialize - cloud or on-premise. Choose based on where the companies you want to work for actually operate.

If your target is cloud:

AWS Security Specialty or Microsoft SC-900 / AZ-500 are the right starting points, depending on which platform dominates your target market. Cloud security roles are growing fast, and cloud-specific certs signal something generic security certs don’t: That you understand the specific environment where most modern security work actually happens.

If your target is general engineering:

CompTIA Security+ gives you the baseline, then CompTIA CASP+ signals you can operate at a senior level.

For software developers moving into security engineering: look at the CSSLP (Certified Secure Software Lifecycle Professional). It’s underused and directly relevant to your background.

What to avoid: Don’t collect cloud certs across multiple providers before going deep on one. Pick AWS or Azure based on your target companies and commit.

Path 4: Governance, Risk, and Compliance (GRC)

Target roles: Security Auditor, Risk Manager, Compliance Specialist

This is the path I know best. And it’s the path where the certification advice you’ll find online is most consistently wrong.

Start here:

ISC2 CC is free to sit, covers the fundamentals you need, and is backed by the same organization that owns CISSP. For someone with no prior cybersecurity certification, this is your starting point. It costs nothing except study time.

After CC, the path splits based on your specialization:

• Risk management: CRISC is the gold standard. Target it after your first GRC role.

• Governance and management: CISM is the right target for mid-career.

• Compliance and auditing: CISA is what auditors and compliance teams respect most.

CompTIA Security+ works here, too, for beginners who want to validate foundational cybersecurity literacy that GRC employers want to see.

What about CISSP on the GRC path?

Consider attempting it early - even before you feel fully ready. GRC is the path most directly aligned with how CISSP thinks.

The exam is built around risk management, governance, policy, and business decision-making.

That is exactly what GRC professionals do every day.

Passing the CISSP exam early signals that you think at a strategic level before you are even required to. Combined with CC and your first GRC role, it separates you from every other candidate who is still waiting until they feel ready.

What to avoid: Attempting CISSP before you have CC and a good understanding of the fundamentals. Build the foundation first. Then go for it.

Path 5: Management and Leadership

Target roles: Security Program Manager, Security Director, CISO

One cert dominates this path: CISSP.

The conventional advice is to wait until you have five years of experience. My advice is different.

Consider passing it early anyway.

CISSP Associate means you’ve passed the exam before fulfilling the experience requirement. You have six years to complete it afterward.

When a hiring manager sees CISSP Associate on a resume from someone with two years of experience, they don’t think “this person jumped ahead.” They think “this person is serious.”

It won’t replace experience. But it will open doors that a generic technical cert never will.

What to focus on while you build that experience: understanding how security decisions connect to business goals. The exam tests judgment, not just knowledge. Study accordingly.

The honest truth about certifications

A certification will not get you hired on its own.

It opens the door. You still have to walk through it.

What actually gets you hired is showing up to interviews knowing how to think, not just what to memorize. It’s having a resume that tells a coherent story. It’s being able to explain your reasoning clearly when a hiring manager puts a scenario in front of you.

The right certification for your path removes one barrier. It proves you took it seriously enough to invest time and money into a credential that matters for the direction you chose.

That’s it. One barrier removed.

The rest is on you.

Pick your path. Pick your cert. Start this week.

The Certification Tells You What to Study. The Blueprint Tells You What to Do.

Knowing which certification fits your path is only half the answer.

The other half is knowing what to actually do in the next 90 days. Which skills to build first. How to position your background for cybersecurity roles. How to build a resume that gets read. How to walk into interviews and explain your thinking clearly.

That’s what the 90-Day Cybersecurity Job Blueprint covers.

👉 Get the Blueprint - €9.99

4.8 stars. 45 people have used it. 14-day money-back guarantee.

Leave a comment

You feel that urge to do something, but you always end up watching YouTube videos on some random concept, and you feel like you’re getting nowhere.

In cybersecurity, a lack of direction is more dangerous than a lack of knowledge.

I have spent years studying random topics that didn’t get me any closer to my goal.

That’s why I created a study plan, which will help you use your time much more efficiently.

You will no longer focus on “What should I learn?” You will spend your time learning what matters.

GRC (Governance, Risk, Compliance)

GRC (Governance, Risk, Compliance) is one of the 5 cybersecurity paths you can choose.

But before you deep-dive into the materials I am about to provide, make sure this path is really for you.

You don’t want to waste weeks and months learning things that won’t get you any closer to your goal.

It’s a great fit if you:

• Prefer structured thinking over deep technical troubleshooting

• Like understanding how systems, risks, and business decisions connect

• Enjoy analysis, documentation, and decision-making

• Want to work closer to business, strategy, and leadership

It’s especially convenient if you:

• Are you switching from business, law, or management

• Don’t want to spend years becoming deeply technical

As you probably know, GRC is, in general, less technical, but it doesn’t make it any less valuable.

This is where business and cybersecurity meet, and the decisions made at this level influence the whole company.

The Decoded Security GRC Roadmap

This roadmap has three main goals.

First, make sure that you understand the cybersecurity basics that you need for any role in the field.

Second, make sure you understand the basics of cybersecurity GRC.

Third, force you to apply the theoretical knowledge and challenge yourself.

What is your target role? Let me know in the comments and let’s discuss your next steps!

Leave a comment

Here’s the exact roadmap I would follow if I had to start again.

Step 1: Build the right foundation

Before you go deeper into GRC, you need to understand how cybersecurity actually works and be familiar with the fundamentals, which underpin everything.

To make this easier, I put the key concepts into one place.

Make sure to understand these especially:

1. Threat ≠ Risk ≠ Vulnerability: Why CISSP Basics Matter More Than You Think

2. My First Week of CISSP Prep – What I’ve Learned So Far

3. Security Policies, Standards, and Procedures: The Boring Stuff That Actually Saves You

4. Cybersecurity Controls from Zero to Hero

Step 2: Start focusing on GRC topics

Now shift from “what is cybersecurity” → “how companies manage it.”

Focus on:

• Policies vs standards vs procedures

  • Security Policies, Standards, and Procedures: The Boring Stuff That Actually Saves You

• Access Control methods

  • Access Controls: Who Gets the Keys?

• Risk management:

  • Quantitative Risk Analysis: Let The Numbers Do All The Talking

  • How Risk Management Frameworks Keep Systems Secure

  • Risk Management: Managing risks in six steps

  • 3 things that surprise me about CISSP Domain 1: Security and Risk Management

• Data Lifecycle

  • The Data Lifecycle: From Creation to Secure Destruction

  • The Storage Mistake 90% of People Make (Until It’s Too Late)

• Disaster Recovery and Business Continuity

  • Floods, Cybersecurity, and Survival Strategies And the Surprising Link Between Them

• Intellectual Property & Licensing

  • Why We Need to Be Lawyers: Intellectual Property & Compliance in Cybersecurity

• Laws, Legislation and Contracts

  • 15+ Laws Every CISSP Candidate Must Know: The Only Legal Guide You Need

  • Stop Reading SLAs Wrong: The 7 Critical Topics You’re Missing

• (Reality check - optional)

  • 6 Myths That Are Killing Corporate Cybersecurity

Do you struggle with any of these concepts?
Comment the one you don’t understand, and I’ll break it down for you.

Step 3: Try practical examples

There are two articles in which I analyzed a real-world scenario.

• Quantitative Risk Analysis: Let The Numbers Do All The Talking

• Risk Management: Managing risks in six steps

The task is very simple. Let’s use the AI for something useful and tell ChatGPT to create practice scenarios based on my articles.

I will send you feedback, and we can discuss your approach.

Conclusion

Most people don’t fail in GRC because it’s too hard. They fail because they never had a plan.

They jump between random topics, watch endless videos, and confuse activity with progress.

That’s how months turn into years… with nothing to show for it.

The Decoded Security roadmap fixes this. It gives you structure that I wish I had a couple of years back.

It tells you:

• what to learn

• in what order

• and how to actually apply it

You’ll start thinking like someone who can:

• identify real risks

• make informed decisions

• and bring value to a business

And that’s what this field is really about.

You already have the roadmap. Now it’s about execution.

See you in the comments!

Thank you for reading Decoded Security!

Erich

Comment your target role + your current level. I’ll give you your next step.

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!

Let’s learn and grow together!

📘 Essential for anyone preparing for the ISC2 CC or CISSP exam

I’ve spoken with many people who passed the ISC2 exams, and I've also spoken with many who failed. And every time I meet someone who failed, I take notes.

And for some reason, this topic comes up very often. Even though it isn’t anything complex, it is absolutely essential in real-world practice.

That’s why I decided to include it in my materials and make sure that no one reading Decoded Security will fail this topic ever again.

Testing Disaster Recovery Plans

You studied disaster recovery. You know what RTO (Recovery Time Objective) and RPO (Recovery Point Objective) mean.

You understand backups, the data security lifecycle, and you can tell the difference between a hot site and a warm site.

If you’re not familiar with those terms, you can find links to my previous articles explaining all of those topics at the end of this article.

You feel ready to answer all disaster recovery questions that might come up in the ISC2 exams.

And you still might fail. And you wouldn’t be the first, nor the last.

People are usually so focused on creating disaster recovery plans and business impact analysis that they forget one crucial part.

A plan is useless unless it’s regularly tested.

And this is exactly where exam questions are designed to catch you.

Because in both the ISC2 Certified in Cybersecurity (CC) and CISSP, one principle shows up again and again:

A plan that hasn’t been tested cannot be trusted.

The hierarchy of disaster recovery testing

Both for the exams and the real-world practice, you need to know two things.

1. Different types of exercises to test DR plans

2. How to balance the assurance with the cost

As always, the more thorough you are, the more money it costs. And stakeholders won't like that.

Let’s take it from the least expensive to the most.

1. Checklist Test

Purpose
Validate that the disaster recovery plan is complete and up to date.

How it is performed

• The DR plan is distributed to functional managers

• Each manager reviews their section independently

• They verify:

  • Contact details

  • Roles and responsibilities

  • Procedures

• Feedback is collected and consolidated

• The plan is updated accordingly

Benefits

• Easy and fast to perform

• Identifies missing steps or outdated information

• Low cost, no operational impact

Drawbacks

• No real execution

• No validation of actual recovery capability

• Gives a false sense of security

When to use

• Early stages of DR planning

• Regular reviews (e.g., quarterly updates)

• Before more advanced testing

Exam insight: This is the weakest form of testing, but it is conveninent as it can be perform regularly without operational impact.

2. Structured Walkthrough

Purpose
Validate logical flow and completeness of the plan as a group.

How it is performed

• Key stakeholders meet in a structured session

• The plan is reviewed step by step

• A facilitator walks the group through:

  • Sequence of actions

  • Dependencies between teams

• Participants discuss:

  • What happens next

  • What might be missing

• Gaps and conflicts are documented and resolved

Benefits

• Identifies inconsistencies and gaps

• Improves team understanding

• Encourages collaboration across departments

Drawbacks

• Still theoretical

• No real system or process validation

When to use

• After checklist review

• When updating or improving the plan

• Before running simulations

3. Tabletop Exercise

Purpose
Simulate decision-making during a disaster scenario.

How it is performed

• A realistic scenario is introduced (e.g., ransomware, data center outage)

• Participants assume their real roles

• A facilitator drives the scenario forward in phases

• Teams explain:

  • What actions they would take

  • Who they would contact

  • How decisions are made

• Injects (new developments) are added to simulate pressure

• Observers record gaps and decision issues

Benefits

• Tests roles and responsibilities

• Improves communication and coordination

• Reveals gaps in procedures and escalation paths

Drawbacks

• No real technical execution

• Does not validate recovery time or system restoration

When to use

• Training teams

• Testing incident response + DR coordination

• Preparation for more advanced tests

Exam trap: Remember that nothing is actually executed in this type of testing!

4. Simulation Test

Purpose
Test actual execution of disaster recovery procedures in a controlled scenario.

How it is performed

• A specific disaster scenario is defined

• Teams execute actual recovery procedures:

  • Restore systems

  • Recover data

  • Activate DR processes

• Real tools and systems are used

• Activities are monitored and timed

• Issues (failures, delays, confusion) are recorded

• Results are analyzed after the exercise

Benefits

• Validates processes and responsibilities

• Reveals real operational issues

• Provides measurable insights (time, errors, gaps)

Drawbacks

• Requires coordination and effort

• May impact operations if not controlled

When to use

• After tabletop exercises

• When validating readiness of teams and processes

5. Parallel Test

Purpose
Validate recovery capability by running systems at an alternate site alongside production.

How it is performed

• Systems are restored or activated at the alternate site

• Data is replicated or restored to that environment

• The alternate system runs in parallel with production

• Processing is performed and results are compared

• Performance and consistency are validated

• Production systems remain active throughout

Benefits

• Tests the infrastructure and data replication

• No disruption to live operations

• High level of confidence without full risk

Drawbacks

• Resource-intensive

• Doesn’t fully simulate real failure conditions

When to use

• When testing alternate sites

• Before conducting full interruption tests

• In mature DR environments

6. Full Interruption Test

Purpose
Validate complete disaster recovery by switching all operations to the alternate site.

How it is performed

• Production systems are intentionally shut down

• Operations are switched entirely to the alternate site

• All business processes run from the recovery environment

• Users interact with the DR systems as if it were real production

• Recovery time and performance are measured

• After testing, systems are restored back to normal operations

Benefits

• Highest level of assurance

• Fully tests systems, people, and processes

• Provides real recovery metrics

Drawbacks

• High risk

• Operational disruption

• Expensive and complex

When to use

• Mature organizations with strong DR capabilities

• Critical systems requiring full validation

• Infrequently (e.g., annually)

Exam insight: This provides the strongest validation and should be used only if the highest level of assurance is required.

Printable cheat sheet - perfect for the exam.

Decoded Security Dr Testing Cheat Sheet

24.1KB ∙ PDF file

Download

Download

Conclusion

This is everything you need to correctly answer disaster recovery testing questions on the ISC2 Certified in Cybersecurity (CC) and CISSP exams, and more importantly, to choose the right level of assurance in real-world practice.

I have one last tip for you. Always complete the previous level before moving to the next. Each level builds on the previous one.

• You review before you simulate

• You simulate before you execute

• You execute before you fully interrupt

Skipping levels doesn’t make you efficient. That’s a common trick in the exam.

Thank you for reading Decoded Security!

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!

Let’s learn and grow together!

Disaster Recovery and Business Continuity - Study resources

Most “entry-level” cybersecurity jobs don’t actually exist.

I know, you don’t believe me right now.

There are many roles, such as Junior SOC Analyst, Entry-Level Security Engineer, and Associate Cybersecurity Specialist

Well, there are. However, there is one crucial misunderstanding.

“Entry-level” doesn’t mean entry into tech, it means entry into security

They’re designed for people who already have:

• basic IT experience

• understanding of systems and networks

• strong theoretical knowledge of cybersecurity

• some exposure to real-world environments

Does it mean you should give up?

NO!

It only means you need to change your strategy. And I will show you exactly how.

Remember: The stronger the entry-level barrier, the more of a benefit it becomes once you break it!

Why You Should Continue Reading

If you’re new to cybersecurity, there’s a hard truth you need to face:

The game is stacked against you at the beginning.

You need experience to get an “entry-level” job.

Which sounds impossible.

But here’s the good news:

Demand for cybersecurity professionals is still growing.

Despite all the talk about AI replacing jobs, companies are struggling to protect their systems.

And without security, their business doesn’t survive.

Which means:

This is still one of the best fields you can enter, if you approach it the right way.

So instead of guessing…

Let me show you exactly what to do instead.

Why You’re Not Getting Hired

If the first answer that comes to your mind is you’re not smart enough..just stop!

It’s not because you’re not smart enough.

It’s not because cybersecurity is “too difficult.”

It’s because you’re competing against people who are already closer to the field than you are.

From an employer’s perspective, the choice is obvious:

Hire someone who can contribute immediately, or someone who still needs months of training.

And cybersecurity is not a field where companies like to take risks.

So how do we help you get closer to the field and convince employers to see what you can bring to the table?

You actually need only one thing: STRATEGY.

What People Call “Strategy”

Most people respond to this the wrong way.

They try to “fix” the problem by:

• collecting more certifications

• buying and watching more expensive courses

• waiting until they feel “ready”

How do I know? Because I’ve been there.

And I know spending money and watching videos feels productive.

But it doesn’t move you closer to getting hired.

At least not if you’re doing it without a clear direction.

You need to build an image that you are capable of doing something in the real environment.

Get Direction FIRST

That was enough theory and general fluff.

Let’s answer the most important questions:

1. What is it you need to do to break that entry-level barrier?

2. How do you build that image, saying I am useful and suitable for the role?

The first step is this:

Know exactly which role you’re aiming for.

Without that, nothing else works.

Because if you don’t know where you’re going:

• you learn random things

• you collect irrelevant certifications

• you build skills that don’t align with any real job

And from an employer’s perspective?

You look unfocused.

Because your entire strategy depends on that answer.

If you’re not sure yet, start here:

(This will give you the clarity most people skip and pay for later.)

3 Specific Steps You Should Focus On

Great, now you have the direction. And honestly, this is where most people stop.

They understand the problem, but they don’t do anything about it.

In this section, I’ll break down the exact 3-steps you should take to get a job in cybersecurity.

Read more

How do you prove someone is who they claim to be?

Because if you get this wrong, nothing else matters.

It doesn’t matter how well your whole system is set up if you can’t be sure who you are talking to.

That’s why the process of authentication is so widely tested during all cybersecurity exams, including the CC, CISSP, and Security+.

Not familiar with the methods of authentication yet? Read this First!

Today, we are going to focus on a method that is treated as the gold standard.

But just because this method is better than asking for a password, that doesn’t make it automatically secure.

And be sure that the exam will test you on that.

Let’s get to it!

Biometric authentication

Definition: Biometrics verifies an individual’s identity by analyzing a unique personal characteristic.

That sounds pretty clear, doesn’t it?

You simply take anything that you can reliably analyze and is based on unique personal characteristics and uses instead of a dumb password.

Well, there is a catch. But before I tell it to you, let’s add more definitions to make sure you know everything you need.

There are two types of biometric authentication:

1. Physiological: Uses physical attributes unique to an individual

   1. Fingerprints

   2. Retina / Iris (Note: Privacy issues - PHI)

   3. Facial structure

   4. Hand geometry

2. Behavioral: Uses patterns of behavior unique to an individual

   1. Signature dynamics

   2. Keystroke dynamics

   3. Voice patterns

Why is this so important?

Because behavioral characteristics can change over time. We are not machines, and we don’t always do things the same way.

Make sure to keep it in mind!

“The Catch” - Errors

Exam tip: This is what you actually need to know

Remember how I mentioned “the catch”?

Here it is:

Biometric authentication doesn’t always work as expected.

With passwords, it’s simple:

• 100 % Match → access granted

• No match → access denied

It’s 100% or nothing.

But biometrics don’t work like that.

You never get a perfect match.

Instead, the system asks:

“Is this close enough to be the same person?”

And that’s where problems start.

Because now, two things can happen:

1. False Rejection Rate (FRR)

Event: The system rejects a legitimate user.

FRR Definition: The percentage of times a biometric system incorrectly rejects a legitimate user.

Example: Your fingerprint is valid, but the system doesn’t recognize it.

2. False Acceptance Rate (FAR)

Event: An attacker is accepted as a legitimate user.

Definition:
The percentage of times a biometric system incorrectly accepts an unauthorized user.

Which one is better?

Well, that depends on the system.

If you make the system stricter:

• FAR ↓ (more secure)

• FRR ↑ (more users get blocked)

If you make it more lenient:

• FRR ↓ (better usability)

• FAR ↑ (less secure)

  

Without changing the biometric mechanism, you can only decide which mistake you prefer.

Great. Now you understand the main problem with biometric authentication and its sensitivity.

Now there is one more question to answer: How do we compare biometric systems?

Because every system has FRR and FAR.

And depending on the configuration, you can tune one… but worsen the other.

So which one matters more?

FRR or FAR? And at what setting?

This is exactly why we use the Crossover Error Rate (CER).

Crossover Error Rate (CER)

Definition:
The point at which the False Rejection Rate (FRR) equals the False Acceptance Rate (FAR).

In other words, it’s the point where the system makes equal mistakes on both sides.

It is a single number to compare biometric systems.

• Lower CER → fewer total errors → better system

• Higher CER → more errors → worse system

And that’s it! You can now compare two biometric systems!

Additional Information (Exam Notes)

• Biometrics are based on probability, not certainty

• Threshold setting determines system sensitivity (strict vs lenient)

• Lower threshold → higher FAR, lower FRR

• Higher threshold → lower FAR, higher FRR

• False Acceptance Rate (FAR) is a bigger security risk than FRR

• False Rejection Rate (FRR) mainly affects usability

• Crossover Error Rate (CER) is used to compare systems

• Lower CER = better overall accuracy

• Physiological biometrics are generally more stable than behavioral ones

• Some methods raise privacy concerns (e.g., retina scan → PHI)

• Processing speed matters (slow systems reduce adoption)

• BIOMETRIC SYSTEMS ARE EXPENSIVE!

Conclusion

Congratulations! After reading this article, you are ahead of most people.

You now understand that biometrics isn’t just about scanning fingerprints.

You understand both its benefits and its drawbacks, including the errors involved.

We also covered how to prioritize error types based on system sensitivity and how to compare biometric systems.

With all of that, you are more prepared than 95% of people claiming to be cybersecurity experts.

Thanks for reading Decoded Security!

— Erich

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out: