This document contains a list of 46 podcasts from the CERT organization covering various topics in cybersecurity. The podcasts are grouped into 10 categories: Forensics, Governing for Enterprise Security, Measuring Security, Privacy, Risk Management and Resilience, Security Education and Training, Software Security, Threat, Tips from the Trenches: Areas of Practice, and Trends and Lessons Learned. Each entry includes the podcast title, category, and brief description of topics covered in the podcast. The podcasts address a wide range of issues organizations may face such as malware analysis, security metrics, software development practices, and more.

1. CERT Podcast Series.xlsx
Rec Seq Category
Title
Description
1 1 Forensics
Characterizing and Prioritizing Malicious Code
In this podcast, Jose Morales discusses how to prioritize malware samples, helping analysts to identify the most
destructive malware to examine first.
2 Forensics
TJX, Heartland, and CERT's Forensics Analysis Capabilities
In this podcast, participants recount complex, distributed, multi‐year investigations of computer crimes using
sophisticated methods, techniques, and tools.
3 Forensics
Computer and Network Forensics: A Master's Level Curriculum
In this podcast, Kris Rush describes how students learn to combine multiple facets of digital forensics and draw
conclusions to support investigations.
4 Forensics
Computer Forensics for Business Leaders: Building Robust Policies and Processes
In this podcast, participants discuss how business leaders can play a key role in computer forensics by establishing
and testing strong policies.
5 Forensics
Computer Forensics for Business Leaders: A Primer
In this podcast, participants discuss how computer forensics is often overlooked when planning an incident
response strategy.
2 6 Governing for Enterprise Security
Why Use Maturity Models to Improve Cybersecurity: Key Concepts, Principles, and Definitions
In this podcast, Rich Caralli explains how maturity models provide measurable value in improving an organization's
cybersecurity capabilities.
7 Governing for Enterprise Security
NIST Catalog of Security and Privacy Controls, Including Insider Threat
In this podcast, participants discuss why security controls, including those for insider threat, are necessary to
protect information and information systems.
8 Governing for Enterprise Security
Public‐Private Partnerships: Essential for National Cyber Security
In this podcast, participants explain that knowledge of software assurance is essential to ensure that complex
systems function as intended.
9 Governing for Enterprise Security
Establishing a National Computer Security Incident Response Team (CSIRT)
In this podcast, participants discuss how essential a national CSIRT is for protecting national and economic security
and continuity.
10 Governing for Enterprise Security
Leveraging Security Policies and Procedures for Electronic Evidence Discovery
In this podcast, John Christiansen explains that effectively responding to e‐discovery requests depends on well‐
defined policies, procedures, and processes.
3 11 Measuring Security
Measuring Operational Resilience
In this podcast, Julia Allen explains that measures of operational resilience should answer key questions, inform
decisions, and affect behavior.
http://www.cert.org/podcasts/index.cfm#securityeducation Page 1 of 5

2. CERT Podcast Series.xlsx
Rec Seq Category
Title
Description
3 11
12 Measuring Security
Getting to a Useful Set of Security Metrics
Well‐defined metrics are essential to determine which security practices are worth the investment.
13 Measuring Security
Using Benchmarks to Make Better Security Decisions
In this podcast, Betsy Nichols describes how benchmark results can be used to help determine how much security
is enough.
14 Measuring Security
Initiating a Security Metrics Program: Key Points to Consider
In this podcast, Samuel Merrell explains that a sound security metrics program should select data relevant to
consumers from repeatable processes.
15 Measuring Security
Building a Security Metrics Program
In this podcast, Betsy Nichols explains that reporting meaningful security metrics depends on topic selection,
context definition, and data access.
4 16 Privacy
Considering Security and Privacy in the Move to Electronic Health Records
In this podcast, participants discuss how using electronic health records bring many benefits along with security
and privacy challenges.
17 Privacy
Integrating Privacy Practices into the Software Development Life Cycle
In this podcast, participants explain that addressing privacy during software development is just as important as
addressing security.
18 Privacy
Electronic Health Records: Challenges for Patient Privacy and Security
In this podcast, Robert Charette explains why electronic health records (EHRs) are possibly the most complicated
area of IT today.
19 Privacy
Protecting Information Privacy ‐ How To and Lessons Learned
In this podcast, Kim Hargraves describes three keys to ensuring information privacy in an organization.
20 Privacy
The Value of De‐Identified Personal Data
In this podcast, participants discuss the complex legal compliance landscape and how de‐identification can help
organizations share data more securely.
5 21 Risk Management and Resilience
Comparing IT Risk Assessment and Analysis Methods
In this podcast, the presenters discuss IT risk assessment and analysis, and comparison factors for selecting
methods that are a good fit for your organization.
22 Risk Management and Resilience
The Electricity Subsector Cybersecurity Capability Maturity Model (ES‐C2M2)
ES‐C2M2 helps improve the operational resilience of the U.S. power grid.
23 Risk Management and Resilience
http://www.cert.org/podcasts/index.cfm#securityeducation Page 2 of 5

3. CERT Podcast Series.xlsx
Rec Seq Category
Title
Description
5 23 Using the Cyber Resilience Review to Help Critical Infrastructures Better Manage Operational Resilience
In this podcast, the presenters explain how CRRs allow critical infrastructure owners to compare their
cybersecurity performance with their peers.
24 Risk Management and Resilience
Managing Disruptive Events ‐ CERT‐RMM Experience Reports
In this podcast, the participants describe four experience reports that demonstrate how the CERT‐RMM can be
applied to manage operational risks.
25 Risk Management and Resilience
Managing Disruptive Events: Demand for an Integrated Approach to Better Manage Risk
In this podcast, Nader Mehravari describes how governments and markets are calling for the integration of plans
for and responses to disruptive events.
6 26 Security Education and Training
How to Become a Cyber Warrior
In this podcast, Dennis Allen explains that protecting the internet and its users against cyber attacks requires more
skilled cyber warriors.
27 Security Education and Training
Software Assurance: A Master's Level Curriculum
In this podcast, participants explain how knowledge about software assurance is essential to ensure that complex
systems function as intended.
28 Security Education and Training
Better Incident Response Through Scenario Based Training
In this podcast, Christopher May explains how teams are better prepared to respond to incidents if realistic, hands‐
on training is part of their normal routine.
29 Security Education and Training
Using High Fidelity, Online Training to Stay Sharp
In this podcast, Jim Wrubel explains how virtual training environments can deliver high quality content to security
professionals on‐demand, anywhere, anytime.
30 Security Education and Training
What Business Leaders Can Expect from Security Degree Programs
In this podcast, participants discuss whether information security degree programs meet the needs of business
leaders seeking knowledgeable employees.
7 31 Software Security
Raising the Bar ‐ Mainstreaming CERT C Secure Coding Rules
In this podcast, Robert Seacord describes the CERT‐led effort to publish an ISO/IEC technical specification for
secure coding rules for compilers and analyzers.
32 Software Security
Cisco's Adoption of CERT Secure Coding Standards
In this podcast, Martin Sebor explains how implementing secure coding standards is a sound business decision.
33 Software Security
How to Develop More Secure Software ‐ Practices from Thirty Organizations
In this podcast, participants discuss how organizations can benchmark their software security practices against 109
observed activities from 30 organizations.
http://www.cert.org/podcasts/index.cfm#securityeducation Page 3 of 5

4. CERT Podcast Series.xlsx
Rec Seq Category
Title
Description
7 34 Software Security
The Power of Fuzz Testing to Reduce Security Vulnerabilities
In this podcast, Will Dormann urges listeners to subject their software to fuzz testing to help identify and eliminate
security vulnerabilities.
35 Software Security
The Role of the CISO in Developing More Secure Software
In this podcast, Pravir Chandra warns that CISOs must leave no room for doubt that they understand what is
expected of them when developing secure software.
8 36 Threat
Using a Malware Ontology to Make Progress Towards a Science of Cybersecurity
In this podcast, Dave Mundie explains why a common language is essential to developing a shared understanding
to better analyze malicious code.
37 Threat
Mitigating Insider Threat ‐ New and Improved Practices Fourth Edition
In this podcast, participants explain how 371 cases of insider attacks led to 4 new and 15 updated best practices
for mitigating insider threats.
38 Threat
Building a Malware Analysis Capability
In this podcast, Jeff Gennari explains that analyzing malware is essential to assessing the damage and reducing the
impact associated with ongoing infection.
39 Threat
Indicators and Controls for Mitigating Insider Threat
In this podcast, Michael Hanley explains how technical controls can be effective in helping to prevent, detect, and
respond to insider crimes.
40 Threat
Protect Your Business from Money Mules
Organized criminals recruit unsuspecting intermediaries to help steal funds from small businesses.
9 41 Tips from the Trenches: Areas of Practice
DevOps ‐ Transform Development and Operations for Fast, Secure Deployments
In this podcast, Gene Kim explains how the "release early, release often" approach significantly improves software
performance, stability, and security.
42 Tips from the Trenches: Areas of Practice
Securing Mobile Devices aka BYOD
In this podcast, Joe Mayes discusses how to ensure the security of personal mobile devices that have access to
enterprise networks.
43 Tips from the Trenches: Areas of Practice
Using Network Flow Data to Profile Your Network and Reduce Vulnerabilities
In this podcast, participants discuss how a network profile can help identify unintended points of entry,
misconfigurations, and other weaknesses.
44 Tips from the Trenches: Areas of Practice
How to More Effectively Manage Vulnerabilities and the Attacks that Exploit Them
In this podcast, Greg Crabb explains how CERT‐RMM can be used to establish and meet resilience requirements for
a wide range of business objectives.
http://www.cert.org/podcasts/index.cfm#securityeducation Page 4 of 5

5. CERT Podcast Series.xlsx
Rec Seq Category
Title
Description
9 45 Tips from the Trenches: Areas of Practice
Why Organizations Need a Secure Domain Name System
Use of Domain Name System security extensions can help prevent website hijacking attacks.
10 46 Trends and Lessons Learned
Cyber Security, Safety, and Ethics for the Net Generation
In this podcast, Rodney Peterson explains why capitalizing on the cultural norms of the Net Generation is essential
when developing security awareness programs.
47 Trends and Lessons Learned
Tackling Tough Challenges: Insights from CERT’s Director Rich Pethia
In this podcast, Rich Pethia reflects on the CERT Division's 20‐year history and discusses its future IT and security
challenges.
48 Trends and Lessons Learned
Climate Change: Implications for Information Technology and Security
In this podcast, Richard Power explains how climate change requires new strategies for dealing with traditional IT
and information security risks.
49 Trends and Lessons Learned
Integrating Security Incident Response and e‐Discovery
In this podcast, Julia Allen explains how responding to an e‐discovery request involves many of the same steps and
roles as responding to a security incident.
50 Trends and Lessons Learned
Virtual Communities: Risks and Opportunities
In this podcast, Jan Wolynski advises business leaders to evaluate risks and opportunities when considering
conducting business in online, virtual communities.
http://www.cert.org/podcasts/index.cfm#securityeducation Page 5 of 5