Certified: The GIAC GCLD Audio Course
by Jason Edwards
This course teaches you how to secure cloud environments the way real incidents unfold: misconfigurations, over-permissioned identities, weak network boundaries, and data exposure paths that are easy to miss until it’s too late. You’ll build a practical, defensible security posture across compute, containers, storage, and managed services by using hardened baselines, policy enforcement, continuous validation, and clear ownership. Along the way, you’ll learn how to reduce attack surface with immutable deployment patterns, least privilege workload identities, safe sharing defaults, and recovery-focused controls like versioning and lifecycle rules.You’ll also strengthen detection and response by choosing high-signal monitoring that reveals attacker movement, correlating identity abuse across logins, tokens, and privilege changes, and tuning alerts so responders focus on what actually matters. The course includes actionable playbooks for investigating cloud alerts, preventing data leakag
Episodes
-
Welcome to Certified: The GIAC GCLD Audio Course
This course teaches you how to secure cloud environments the way real incidents unfold: misconfigurations, over-permissioned identities, weak network boundaries, and data exposure paths that are easy to miss until it’s too late. You’ll build a practical, defensible security posture across…
more -
Episode 87 — Perform practical cloud security assessments that surface misconfigurations before attackers do
This episode brings the series together by focusing on practical assessments that find misconfigurations and weak governance before they become incidents, aligning with the GCLD expectation that leaders measure reality, not intentions. You’ll learn how to structure assessments around high-impact...
-
Episode 86 — Prepare for cloud audits by aligning logs, configurations, and access reviews to evidence
This episode teaches practical audit preparation as an engineering and governance alignment exercise: logs must exist and be retained, configurations must reflect policy, and access reviews must be performed and documented in a way that produces defensible evidence. You’ll connect the audit goal…
more -
Episode 85 — Map controls to requirements so audits become evidence-driven rather than narrative-driven
This episode explains how to map security controls to requirements in a way that produces objective evidence, which is often what exam questions are really testing when they ask about audit readiness and governance maturity. You’ll learn how to translate requirements into clear control…
more -
Episode 84 — Risk management and compliance: translate cloud risk into defensible business decisions
This episode focuses on turning cloud security risk into decisions leadership can defend, which is central to the GCLD exam’s emphasis on governance, prioritization, and accountability. You’ll define risk in practical terms—likelihood and impact tied to assets, threats, and exposure—and learn how...
-
Episode 83 — Prevent data leakage with monitoring, blocking controls, and tested response playbooks
This episode teaches how to prevent data leakage by combining visibility, preventative enforcement, and response readiness, which is a frequent exam theme because each element fails alone. You’ll learn how monitoring detects early signals such as unusual download patterns, unexpected sharing...
-
Episode 82 — Use sensitive data responsibly by controlling purpose, retention, and minimum exposure
This episode explains responsible data use as a governance discipline that connects directly to GCLD-style questions about reducing risk while still enabling business outcomes. You’ll define purpose limitation as ensuring data is accessed and processed only for approved reasons, then show how...
-
Episode 81 — Store sensitive data safely with encryption, key management, and strict access controls
This episode focuses on the control stack that makes sensitive data storage defensible on the GCLD exam and in real cloud programs: encryption, key management, and tightly scoped access working together. You’ll define encryption at rest in practical terms, then connect it to key management...
-
Episode 80 — Find sensitive data in storage, databases, logs, and object metadata consistently
This episode teaches how to search for sensitive data consistently across the places it often hides, including object storage, databases, application logs, and metadata that reveals meaning even when content is encrypted. You’ll connect this to exam scenarios by focusing on control outcomes:...
-
Episode 79 — Discovering sensitive data: classify what matters and reduce unknown data sprawl
This episode focuses on data discovery as the starting point for meaningful protection, because you cannot secure what you do not know exists, and the GCLD exam expects you to connect classification to practical control decisions. You’ll define sensitive data in operational terms, then learn how...
-
Episode 78 — Control object lifecycle and versioning to support recovery, accountability, and integrity
This episode explains object lifecycle and versioning as governance tools that support recovery and accountability, not just cost management features, and it aligns with exam questions that connect storage controls to resilience outcomes. You’ll define lifecycle controls as policies that manage...
-
Episode 77 — Prevent public bucket mistakes by validating policies, ACLs, and inherited permissions
This episode focuses on one of the most common cloud failure patterns: storage resources becoming public due to misunderstood configuration, rushed changes, or inherited permissions that no one reviewed. You’ll learn how “public” can emerge through multiple mechanisms, including explicit policy...
-
Episode 76 — Protect cloud storage with encryption, access policies, and safe sharing defaults
This episode explains how to secure cloud storage using layered controls that prevent accidental exposure and reduce the impact of credential misuse, which is a recurring theme in cloud leadership exams. You’ll define the three pillars of storage protection: encryption to reduce data disclosure...
-
Episode 75 — Isolate containers using least privilege runtime settings and strong boundary controls
This episode focuses on container isolation as a runtime governance outcome, not a promise implied by “it’s containerized,” and it prepares you for exam items that test boundary thinking and blast radius control. You’ll learn how least privilege applies at runtime through restricted capabilities,...
-
Episode 74 — Enforce image hygiene by scanning, signing, and blocking risky dependencies
This episode explains image hygiene as a set of enforceable practices that reduce exploitable weaknesses before workloads ever run, and it aligns with GCLD questions about preventive controls and scalable governance. You’ll define scanning as identifying known vulnerabilities and insecure...
-
Episode 73 — Containers and cloud storage: secure container builds from source to registry to runtime
This episode teaches the end-to-end container supply chain, emphasizing that container security is not a single scan but a controlled path from source code to build system to registry to runtime. You’ll learn how vulnerabilities and malicious changes can enter at each stage, including compromised...
-
Episode 72 — Secure serverless and managed compute by controlling permissions, triggers, and inputs
This episode focuses on how serverless and managed compute shift risk from host hardening to identity, configuration, and event integrity, which is a common trap in governance-oriented exam scenarios. You’ll define the security control points that matter most: the permissions the function runs...
-
Episode 71 — Apply runtime protections that limit execution, persistence, and privilege inside workloads
This episode explains runtime protections as the controls that operate while workloads are running, not just during build or deployment, and it ties directly to GCLD questions about reducing attacker options after initial foothold. You’ll define runtime protections in practical terms, including...
-
Episode 70 — Validate compute security with baselines, policy enforcement, and continuous posture checks
This episode teaches how to validate that compute security remains true over time by combining baselines, enforceable policies, and continuous checks that detect drift quickly. You’ll define a compute baseline as a measurable standard for configuration, patch level, logging, and exposed services,...
-
Episode 69 — Use immutable infrastructure patterns to shrink the window for persistent compromise
This episode explains immutable infrastructure as a strategy for reducing persistence opportunities by replacing systems instead of repairing them in place, which is a recurring secure-by-design concept in cloud governance. You’ll define immutability as treating deployed compute as disposable,...
-
Episode 68 — Secure compute deployment: harden images, reduce services, and enforce patch cadence
This episode focuses on compute deployment security as a lifecycle discipline, not a one-time configuration, and it supports GCLD questions that test how leaders build sustainable hardening programs. You’ll define image hardening as removing unnecessary components, configuring secure defaults…
more -
Episode 67 — Investigate alerts with cloud context to decide benign behavior versus true compromise
This episode teaches how to investigate cloud alerts using context that turns raw events into a defensible conclusion, which aligns with GCLD expectations for decision-making under uncertainty. You’ll define “cloud context” as identity relationships, resource ownership, environment purpose…
more -
Episode 66 — Tune detections to reduce noise while keeping high-confidence cloud security alerts
This episode focuses on alert quality as a governance outcome, because noisy detections create fatigue, missed incidents, and poor credibility with stakeholders—topics that show up in leadership-oriented exam scenarios. You’ll learn how tuning works by adjusting thresholds, adding context, and...
-
Episode 65 — Detect data exfiltration attempts using volume baselines, destination analysis, and timing
This episode teaches how to detect exfiltration attempts by focusing on measurable behaviors—how much data moves, where it goes, and when it happens—rather than relying on hope that sensitive content will be obvious. You’ll define volume baselines as expected transfer ranges for systems and...
-
Episode 64 — Detect lateral movement by monitoring network flows, service calls, and unusual access paths
This episode explains lateral movement in cloud environments as a combination of connectivity, identity, and service-to-service behavior, and it prepares you for GCLD questions that test how attackers pivot after initial footholds. You’ll learn how to spot movement through abnormal network flows,...
-
Episode 63 — Detect identity abuse by correlating logins, token use, and privilege changes
This episode focuses on identity abuse as a primary cloud attack pattern and shows how correlation across authentication, token activity, and privilege events produces stronger detections than any single log source. You’ll define identity abuse signals such as anomalous sign-in contexts…
more -
Episode 62 — Network security monitoring in the cloud: choose signals that reveal attacker movement
This episode teaches how to select network monitoring signals that actually expose attacker behavior, rather than collecting traffic data that cannot answer investigation questions. You’ll define what “movement” looks like in cloud terms, including unexpected east-west connections, unusual...
-
Episode 61 — Protect administrative network services so management planes stay isolated and controlled
This episode explains why administrative network services are a high-leverage target and how isolating management planes reduces the chance that a single workload compromise turns into full environment takeover. You’ll define what “management plane” means in practical terms, including...
-
Episode 60 — Reduce exposure from load balancers, gateways, and proxies with strong defaults
This episode explains how edge components like load balancers, gateways, and proxies often become the real perimeter in cloud, making their default configuration choices critical for security and exam-ready architecture reasoning. You’ll learn how these components route and terminate traffic…
more -
Episode 59 — Securing cloud networks: prevent misroutes, shadow paths, and accidental trust relationships
This episode focuses on the subtle network failures that create major security problems, including misroutes that send traffic through unintended places, shadow paths that bypass intended controls, and trust relationships that expand without explicit approval. You’ll learn how these issues emerge...
-
Episode 58 — Validate network design continuously by testing intended paths versus actual reachability
This episode teaches how to verify network security outcomes with evidence, not assumptions, by comparing what the design says should happen to what packets can actually do. You’ll define reachability validation as confirming allowed and denied paths across subnets, services, and accounts, then...
-
Episode 57 — Secure DNS and name resolution so attackers cannot redirect trust or hide access
This episode focuses on DNS as a trust system and shows why it becomes both an attack tool and a defense dependency in cloud environments. You’ll learn how name resolution influences where traffic goes, how service discovery works, and why DNS misconfigurations can quietly bypass intended…
more -
Episode 56 — Encrypt network traffic properly across regions, services, and hybrid connections
This episode explains how to ensure confidentiality and integrity for data in transit across complex cloud paths, a topic that appears on the GCLD exam as both a technical control and a governance requirement. You’ll define what “properly encrypted” means beyond a checkbox, including strong...
-
Episode 55 — Design private connectivity patterns that replace public exposure with controlled paths
This episode teaches how private connectivity reduces attack surface by removing unnecessary internet exposure while still enabling required access between services, networks, and environments. You’ll learn how to reason about “private” in cloud terms, including which traffic stays on provider...
-
Episode 54 — Control egress to reduce exfiltration paths and limit command-and-control reachability
This episode explains why outbound traffic control matters in cloud environments and how it changes attacker economics by making exfiltration and command-and-control harder and noisier. You’ll define egress control as limiting where systems can send data, then connect it to exam scenarios…
more -
Episode 53 — Control ingress with security groups, firewalls, and service-specific access policies
This episode focuses on inbound access control as a primary defense layer and shows how the exam expects you to choose the right control for the right exposure point. You’ll compare security groups and firewalls as enforcement mechanisms, then expand into service-specific access policies where…
more -
Episode 52 — Segment networks intentionally to reduce blast radius and limit lateral movement
This episode explains segmentation as a deliberate risk-reduction strategy, not just a diagram exercise, and it connects directly to GCLD questions about architecture, governance, and incident containment. You’ll define segmentation in cloud terms using subnets, routing boundaries, and policy...
-
Episode 51 — Cloud networking technology: understand VPC or VNET primitives and routing behaviors
This episode builds the cloud networking foundation the GCLD exam expects by clarifying what core primitives actually do in practice, including address spaces, subnets, route tables, and the separation between control-plane intent and data-plane behavior. You’ll learn how routing decisions are...
-
Episode 50 — Normalize logs for correlation so patterns emerge across accounts and regions
This episode explains how normalization improves detection and investigation by making diverse log sources comparable, searchable, and correlatable across a large cloud footprint. You’ll define normalization as transforming events into consistent fields, timestamps, identity representations, and...
-
Episode 49 — Set retention intentionally so logs remain useful across incident and audit timelines
This episode focuses on retention as a strategic decision that balances investigation needs, compliance expectations, and operational cost, which is a common governance tradeoff in GCLD-style exam questions. You’ll define retention in terms of time coverage needed to detect slow-moving attacks,...
-
Episode 48 — Protect log integrity using centralized storage, immutability controls, and tight permissions
This episode explains how logs become meaningful evidence only when their integrity is protected, which is directly relevant to exam questions on audit readiness and incident defensibility. You’ll learn why decentralized logs are fragile and how centralization reduces loss, improves correlation,...
-
Episode 47 — Capture data access logs that reveal sensitive reads, writes, deletes, and sharing
This episode focuses on data access logging as a way to detect and prove what happened to sensitive information, which is a recurring theme in cloud leadership and GCLD-style governance scenarios. You’ll learn what data access logs should include, such as object reads and writes, permission...
-
Episode 46 — Capture control-plane logs that show configuration changes and risky administrative actions
This episode explains why control-plane logs are essential for governance, incident response, and exam questions that ask you to reason about configuration change history and administrative intent. You’ll define the control plane as the management layer where resources are created, modified, and...
-
Episode 45 — Capture identity logs that reveal misuse, privilege changes, and suspicious sign-ins
This episode focuses on identity logs as a primary signal for cloud compromise, because many attacks begin and expand through account misuse rather than classic network intrusion. You’ll learn what identity logs should capture, including authentication events, MFA outcomes, token and session...
-
Episode 44 — Cloud Logging Fundamentals: choose log sources that answer real investigation questions
This episode explains how to choose cloud log sources based on the questions you must answer during incidents, audits, and operational troubleshooting, which is a common scenario framing in the GCLD exam. You’ll define logging fundamentals by focusing on intent: determining who did what, where,...
-
Episode 43 — Extend built-in controls consistently across single-cloud and multi-cloud environments
This episode teaches how to maintain consistent security outcomes when environments span one cloud provider or multiple providers with different native capabilities and terminology. You’ll connect exam-relevant governance principles—standardization, control mapping, and measurable evidence—to the...
-
Episode 42 — Operationalize secure landing zones that standardize identity, logging, and network controls
This episode focuses on secure landing zones as the foundational environment where accounts, identity, logging, and network baselines are established before workloads arrive. You’ll define a landing zone as a standardized blueprint that enforces consistent guardrails, enabling the kind of...
-
Episode 41 — Design security-by-default architectures using managed services and least-management surfaces
This episode explains how to design cloud architectures that are secure by default, reducing reliance on constant manual hardening and minimizing the attack surface created by operating system and platform management tasks. You’ll connect the GCLD exam’s governance focus to practical design…
more -
Episode 40 — Frameworks for built-in security: map provider native capabilities into reliable patterns
This episode teaches how to translate provider-native security capabilities into repeatable patterns that teams can adopt consistently, which supports both exam reasoning and real governance outcomes. You’ll define built-in security as the native controls cloud providers offer—identity, logging,...
-
Episode 39 — Automate guardrails that block risky storage, network, and IAM configurations instantly
This episode explains how automated guardrails prevent common cloud incidents by stopping dangerous configurations before they reach production, which is central to secure scaling and exam-driven governance decisions. You’ll define guardrails as enforceable controls that evaluate configurations…
more
About this show
This course teaches you how to secure cloud environments the way real incidents unfold: misconfigurations, over-permissioned identities, weak network boundaries, and data exposure paths that are easy to miss until it’s too late. You’ll build a practical, defensible security posture across compute, containers, storage, and managed services by using hardened baselines, policy enforcement, continuous validation, and clear ownership. Along the way, you’ll learn how to reduce attack surface with immutable deployment patterns, least privilege workload identities, safe sharing defaults, and recovery-focused controls like versioning and lifecycle rules.You’ll also strengthen detection and response by choosing high-signal monitoring that reveals attacker movement, correlating identity abuse across logins, tokens, and privilege changes, and tuning alerts so responders focus on what actually matters. The course includes actionable playbooks for investigating cloud alerts, preventing data leakag
Hosted by
Jason Edwards
Categories