Send us Fan Mail

A company found a concealed recording device in the room where its executives meet. They pulled it, imaged it, reviewed the camera footage, went through the employee's internal tool usage, found a second device in a bag he had left in another room, terminated him and referred the matter to the FBI.

Every one of those steps was reasonable. And somewhere in the middle of that list, the investigation stopped being theirs.

This episode is CISSP Domain 1.6 — requirements for investigation types. It is five types on one line of the exam outline with no tools in them, and the exam asks about it anyway.

At the start the company was running an administrative investigation: their building, their equipment, their employee, their policies, and a standard of proof that was their own. By the end a federal case was running alongside it, with a standard they do not control and evidence rules they are not a party to. Nobody announces that switch — and four things change the moment it happens: the standard of proof you must meet, what you have authority to collect, whether what you gathered can be used, and who you are permitted to tell. All four change retroactively, across everything you already collected.

In this episode:

· All five investigation types — administrative, criminal, civil, regulatory, industry standards — and what each one can actually do to you

· Why the type follows whose AUTHORITY the inquiry runs under, not the conduct and not the severity

· Burden of proof by type, and why administrative is the one standard the organization sets for itself

· Chain of custody worked step by step from the real case, including the bag that cannot be un-opened

· Why a forensic image that produced no readable data is still a finding, and why process produces admissible evidence while content produces a conclusion

· The five characteristics of evidence, and why only four of them are properties of the evidence

· Civil preservation: the duty attaches when litigation is reasonably anticipated, not when a complaint is served

· Regulatory: the regulator sets the scope and can compel production, so your own investigation discharges nothing

· Industry standards: a contractual obligation, where the contract names who is permitted to do the work

· What a manager decides before any of it — naming the type out loud, setting the referral trigger in advance, and collecting as though the type will change

It closes with four scenario questions, spread deliberately across all five types. Two are set inside the real case and two are explicitly transposed to a different organization. Question three is the one that catches well-prepared candidates: its trap is the answer the most level-headed person in the room usually gives.

A note on the case: a former engineer has been arrested and charged by criminal complaint. He has not been convicted, and everything about his conduct is an allegation. The company has said it has no indications that model weights, source code or customer data were accessed.

Source: U.S. Department of Justice, Office of Public Affairs press release, October 2026.

Newsroom: https://www.justice.gov/news

Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox.

Go to CISSPCyberTraining.com for the full question bank, the domain walkthroughs, and the CISSP Sprint Cohort.

Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.

Join now and start your journey toward CISSP mastery today!

Send us Fan Mail

A “boring” GitHub Actions workflow file should never be able to empty your secrets vault, yet that is exactly what the Ghost Action campaign shows. We walk through GitGuardian’s research and the real mechanics of how attackers use stolen but valid developer tokens to add or modify workflow YAML, scrape secret names from your own repo, and exfiltrate CI/CD secrets to an external endpoint. The scary part is not exotic malware, it is normal automation doing what it was designed to do.

From a CISSP Domain 8.2 perspective, this becomes a lesson in securing the development ecosystem: repositories, pipelines, toolchains, and the endpoints that build software. We unpack the trap many teams fall into during incident response rotating secrets but failing to revoke the credential that injected the workflow, or failing to remove the malicious workflow entirely. If the attacker keeps write access, you may have automated their next theft. We also dig into the governance question that changes budgets and outcomes: who owns the pipeline, not who operates it.

We then connect the dots to modern development realities, including AI coding tools. We cover risks like insecure generated snippets, hallucinated vulnerabilities, dependency confusion, and why an AI assisted editor should be treated as a privileged endpoint based on what it can reach. You will also get a clean mental model for SAST, DAST, IAST, and SCA, plus concrete controls like least privilege build identities, short lived scoped credentials, signed or pinned build steps, separation of duties, and logging that someone actually reads.

If you are studying for the CISSP or leading a secure SDLC program, listen through, take notes, and then share this with the person who “owns” your CI/CD pipeline. Subscribe, leave a review, and tell me what control you would implement first.

Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success.

Join now and start your journey toward CISSP mastery today!