How unencrypted website addresses and low PBKDF2 iteration counts undid LastPass's encrypted vaults, and why Security+ objective 1.3 is about matching the cryptographic solution to the requirement. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

In this deep dive

• Why objective 1.3 asks which cryptographic technique fits a requirement, not how to do the math
• The LastPass breach: encrypted passwords, unencrypted website addresses, and PBKDF2 iteration counts as low as one
• Why stolen ciphertext doesn't expire, and weak protection is only a matter of time
• How encryption turns plaintext into ciphertext with an algorithm and a key
• Why integrity, origin and non-repudiation point past encryption to hashing and digital signatures

This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

Links

• CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
• All of Chris Rees's Pluralsight courses
• Watch this lesson on YouTube
• Security+ study guides

Transcript and links: https://www.skillthropic.com/podcast/lastpass-appropriate-cryptography-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=lastpass-appropriate-cryptography-deep-dive

Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com

How HTTPS uses a TLS handshake, a key exchange and symmetric encryption to protect data between systems, and why old SSL and early TLS versions should be out of your environment. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

In this deep dive

• Transport or communication encryption: protecting data in motion between systems
• HTTPS as HTTP protected by TLS, and the handshake where the server presents its certificate
• A key exchange that gives both sides the same session keys without sending them, then symmetric encryption for the session
• TLS 1.3 (RFC 8446) as the current version, and RFC 8996 formally deprecating TLS 1.0 and 1.1 in March 2021
• For the exam: TLS is the default answer for web traffic, and old SSL or TLS 1.0 is a finding

This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

Links

• CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
• All of Chris Rees's Pluralsight courses
• Watch this lesson on YouTube
• Security+ study guides

Transcript and links: https://www.skillthropic.com/podcast/transport-encryption-tls-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=transport-encryption-tls-deep-dive

Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com

What the July 2024 CrowdStrike update teaches about recovery, why a fast revert didn't help machines that had already crashed, and how to choose between backing out and failing forward. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

In this deep dive

• July 19th, 2024: a routine CrowdStrike content update sends Windows machines running the sensor into a crash loop
• Why reverting 78 minutes later only protected machines that hadn't crashed yet, and how BitLocker recovery keys stretched recovery into days
• The staged rollout CrowdStrike moved to: a canary group, early adopters, broad deployment, then everyone
• When backing out is the safer choice, and when failing forward makes more sense
• Finding the point of no return before the change starts

This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

Links

• Microsoft: Helping our customers through the CrowdStrike outage
• CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
• All of Chris Rees's Pluralsight courses
• Watch this lesson on YouTube
• Security+ study guides

Transcript and links: https://www.skillthropic.com/podcast/crowdstrike-backout-vs-fail-forward-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=crowdstrike-backout-vs-fail-forward-deep-dive

Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com

How a harmless-looking certificate swap touches four systems, the four questions an impact analysis asks, and why test results have to reach the approver before a change reaches production. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

In this deep dive

• A certificate replacement that touches a customer portal, an internal API, a load balancer and a mobile app
• The impact analysis questions: who's affected, what depends on it, does it change our security exposure, and what would the business feel
• Why a change can be technically correct and still be a business failure
• Development, test or staging, and production, and why the test environment has to resemble production
• Functional tests, compatibility tests and a security scan, and how the results inform the CAB's approval

This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

Links

• CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
• All of Chris Rees's Pluralsight courses
• Watch this lesson on YouTube
• Security+ study guides

Transcript and links: https://www.skillthropic.com/podcast/impact-analysis-test-results-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=impact-analysis-test-results-deep-dive

Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com

Why one control is never enough, how layers that prevent, detect and respond work together, and a phishing scenario where any one of three layers can stop the attack. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

In this deep dive

• The vocabulary objective 1.1 assumes you already have, and why control categories and control types answer two different questions
• Why a single firewall leaves an attacker relatively unrestricted access once it's bypassed
• Building layers: perimeter firewall, network segmentation, endpoint protection and MFA, all wrapped around the data
• Layers that prevent, detect and respond, and why they shouldn't duplicate the same weakness
• A phished password scenario where MFA, segmentation and monitoring each get a chance to stop the attacker

This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

Links

• CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
• All of Chris Rees's Pluralsight courses
• Watch this lesson on YouTube
• Security+ study guides

Transcript and links: https://www.skillthropic.com/podcast/defense-in-depth-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=defense-in-depth-deep-dive

Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com

An AI model builds hundreds of Linux exploits, Claude Code leaks secrets to GitHub, and stolen AI keys push a bad plugin to 5,000 companies.

In this episode

• GPT-6 Cyber builds 948 Linux exploits while fixes lag: AI is finding serious bugs in mature code faster than the industry is patching them.
• Claude Code's 'don't ask again' leaks secrets to GitHub: Approved commands, passwords included, are being saved to settings files and pushed to public repos.
• Stolen AI keys chain into a plugin hitting 5,000 companies: A breach at one AI provider rippled through a coding tool into thousands of customers.
• Researchers bypass ChatGPT Lockdown Mode: A protection built to stop prompt injection exfiltration was sidestepped before it was patched.
• Claude Code hooks see the checkpoint, not what follows: Agent policy controls judge the request, not the processes and connections it spawns afterward.
• Prompt adware hides in a Codex jailbreak bundle: A jailbreak rewrites an agent's trusted instructions, proving agent config files are an attack surface.
• White House AI accord leaves auditors undefined: 'Independently audited' has no shared definition, so customers have to ask the follow-up questions.

What to do this week

• Hunt for leaked agent secrets. Scan repos for Claude Code settings files and rotate any keys or passwords you find.
• Look past the hook checkpoint. Back agent hooks with endpoint monitoring and track changes to agent config files.
• Get your patch process ready. AI is finding bugs faster than teams fix them. Plan capacity for a bigger patch queue.

Sources

• GPT-6 Cyber builds 948 Linux exploits while fixes lag (CSO Online)
• Claude Code's 'don't ask again' leaks secrets to GitHub (The Hacker News)
• Stolen AI keys chain into a plugin hitting 5,000 companies (The Verge)
• Researchers bypass ChatGPT Lockdown Mode (The Hacker News)
• Claude Code hooks see the checkpoint, not what follows (CIO)
• Prompt adware hides in a Codex jailbreak bundle (The Hacker News)
• White House AI accord leaves auditors undefined (Crypto Briefing)

Transcript and links: https://www.skillthropic.com/podcast/ai-security-brief-2026-11-09?utm_source=podcast&utm_medium=audio&utm_campaign=ai-security-brief-2026-11-09

Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com

Why least privilege applies to users, applications and services, how it limits the damage from a compromised account, and the one planned exception every cloud tenant needs. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

In this deep dive

• Least privilege: only the permissions an identity needs for its legitimate responsibilities
• Why a stolen ordinary account reaches a small area and a stolen admin account reaches almost everything
• Separate standard and admin accounts for administrators, and least privilege for applications and services
• People who move between roles and collect access, and why keeping old access is a least privilege failure
• Break-glass accounts: two cloud-only accounts, excluded from conditional access, protected with FIDO2 keys, alerting on any sign-in and tested on a schedule
• Microsoft's mandatory MFA for its admin portals, and why password-only emergency accounts no longer work there

This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

Links

• CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
• All of Chris Rees's Pluralsight courses
• Watch this lesson on YouTube
• Security+ study guides

Transcript and links: https://www.skillthropic.com/podcast/least-privilege-break-glass-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=least-privilege-break-glass-deep-dive

Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com

An internal AI tool in a $6.3 billion crypto heist, a UK warning on AI-powered ransomware, and malware that ranks victims by value.

In this episode

• Binance heist: internal AI tool helped drain $6.3bn: A fake job interview and an internal AI tool put attackers inside the wallet team's systems.
• NCSC: AI ransomware on UK infrastructure highly likely: The UK's cyber agency expects AI to help attackers find and exploit long-tolerated weaknesses.
• VOLTA infostealer uses AI to rank victims by value: The theft is familiar. Using LLMs to decide which stolen data pays best is the new part.
• Gemini model leads benchmarks for finding and exploiting bugs: Models that find and patch bugs for defenders can find them for attackers too.
• Fake ChatGPT and Claude apps deliver crypto miners: Attackers are using AI brand names and signed executables to get malware installed.
• Lock down AI coding agents with an allowlist: Agent identity and command policy decide how far a hijacked coding agent can reach.
• 40% of security teams now use AI every day: AI agents in the SOC only help if the data and processes underneath are in order.

What to do this week

• Brief engineers on fake job offers. Recruiting scams deliver malware. Lock internal AI tools down like privileged systems.
• Allowlist AI clients and agent commands. Approved desktop clients only. Enforce agent policy in the harness, not the model.
• Shrink your patch window. AI is speeding up bug discovery. Your patch backlog is now a timeline.

Sources

• Binance heist: internal AI tool helped drain $6.3bn (The Guardian)
• NCSC: AI ransomware on UK infrastructure highly likely (The Guardian)
• VOLTA infostealer uses AI to rank victims by value (The Hacker News)
• Gemini model leads benchmarks for finding and exploiting bugs (The Hacker News)
• Fake ChatGPT and Claude apps deliver crypto miners (The Hacker News)
• Lock down AI coding agents with an allowlist (Help Net Security)
• 40% of security teams now use AI every day (The Hacker News)

Transcript and links: https://www.skillthropic.com/podcast/ai-security-brief-2026-11-05?utm_source=podcast&utm_medium=audio&utm_campaign=ai-security-brief-2026-11-05

Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com