Season's Savings | ₹5/mo for 3 months

₹199/month after first 3 months. Renews automatically. Terms apply.
Byte Sized Security cover art

Byte Sized Security

Byte Sized Security

Written by: Marc David
Listen for free

About this listen
 In a world where cyberattacks are becoming more commonplace, we all need to be vigilant about protecting our digital lives, whether at home or at work. Byte Sized Security is the podcast that provides snackable advice on cybersecurity best practices tailored for professionals on the go. Hosted by information security expert, Marc David, each 15-20 minute episode provides actionable guidance to help listeners safeguard their devices, data, and organizations against online threats. With new episodes released every Monday, Byte Sized Security covers topics like social engineering, password management, multi-factor authentication, security awareness training, regulatory compliance, incident response, and more. Whether you're an IT professional, small business owner, developer, or just someone interested in learning more about cybersecurity, Byte Sized Security is the quick, easy way to pick up useful tips and insights you can immediately put into practice. The clear, jargon-free advice is perfect for listening on your commute, during a lunch break, or working out. Visit bytesizedsecurity.com to access episodes and show notes with key takeaways and links to useful resources mentioned in each episode. Don't let cybercriminals catch you off guard - get smart, fast with Byte Sized Security! Tune in to boost your cybersecurity knowledge and help secure your part of cyberspace.Copyright 2026 Marc David Economics Leadership Management & Leadership Politics & Government
Episodes
  • Ep52: How to Get Into Cybersecurity With No Experience

    Ep52: How to Get Into Cybersecurity With No Experience
    Nov 9 2026

    No degree, no IT background, and every entry-level posting wants three years of experience. Marc lays out the realistic path into cybersecurity: why the market feels jammed even with a talent shortage, what to learn first, which single certification to get (including the end of ISC2's free Certified in Cybersecurity offer), how to build experience with a home lab and public write-ups, the on-ramp jobs that hire beginners, and a 90-day plan you can start this week.

    Chapters

    • 0:00 Cold open: booming field, locked door
    • 0:16 Why right now is a strange time to break in
    • 1:13 Where to start
    • 2:24 Your first certification
    • 4:04 Getting experience when every job wants experience
    • 5:22 The jobs to target first
    • 6:21 Your first ninety days
    • 7:41 Outro and homework

    Sources

    • Full article: How to Get Into Cybersecurity With No Experience
    • BLS Occupational Outlook Handbook: Information Security Analysts
    • ISC2 Certified in Cybersecurity (CC)
    • ISC2 One Million Certified in Cybersecurity program update
    • CompTIA Security+
    • Google Cybersecurity Certificate
    • CISA free cybersecurity training
    • Related: The full cybersecurity career guide, Is the Google Cybersecurity Certificate worth it?, Build cyber proof, not just certs, and Portfolios trump pedigree

    Certification prices as of November 3, 2026. Check the vendor before you buy.
    Show More Show Less
    9 mins
  • Ep51: Polymarket Had a CSP. Here's Why It Didn't Help

    Ep51: Polymarket Had a CSP. Here's Why It Didn't Help
    Oct 30 2026
    Episode Summary:On October 29, 2026, a performance-monitoring script Polymarket loaded from an outside vendor was swapped for code that used logged-in traders' open sessions to sell positions and move funds out. Researchers traced the file to DebugBear, which confirmed a security incident, but Polymarket hasn't named DebugBear and the root cause is unconfirmed. Marc uses the attack to explain one thing: any outside script on your site runs with your users' full access, and a Content Security Policy is the browser rule built to limit that. He covers what a Content Security Policy is, why Polymarket's own policy still let this attack through, and why so few sites use one at all, or use it well.Key Topics Covered:How a page-speed script on Polymarket was swapped and used open sessions to move fundsWhy a third party script runs with the same access as your own codeWhy two-factor authentication doesn't stop code running inside an open sessionWhat a Content Security Policy is, and what it can and can't blockWhy Polymarket's policy allowed every server the malicious script usedHow few sites deploy a Content Security Policy, and how many policies have gapsMain Takeaways:Every outside script on your page runs with your users' full access.A Content Security Policy blocks code and connections to servers not on your list. It trusts every server that is on the list, so keep the list short.Per the HTTP Archive Web Almanac 2025, Content Security Policy adoption reached 21.9%, and about 92% of policies that set script rules include unsafe-inline, which weakens them.Start in report-only mode, list what your site loads today, cut what nobody uses, and keep outside scripts off login, donation, and checkout pages.Timestamps:[0:00] Cold open[0:32] Intro[0:55] What happened at Polymarket[1:56] Why an outside script gets full access[2:49] What a Content Security Policy is[3:28] Would it have stopped this one?[4:19] Few sites use it, fewer use it well[5:12] Your homework[5:59] OutroLoss Estimates by Source (each measured something different):Hudson Rock: about $2.19 million at the script's recipient wallet, from a screenshot, "not a verified total of stolen funds."BleepingComputer: about 28.6 million POL, "valued at roughly $2.57 million," moved to three other wallets.The Record: blockchain firms traced "more than $2.1 million."Polymarket postmortem: returning $3.9M to traders, "the $2.7M plus $1.2M to cover pause-related losses."Tools & Resources Mentioned:Paired guide on the blog: Third Party Scripts: Lessons From the Polymarket Hack (2026)Polymarket status page and postmortemDebugBear on X, incident notice (Oct 29)DebugBear on X, follow-up (Oct 29)Hudson Rock, Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party ScriptOhey, Polymarket wallet drainer served from DebugBear's script CDNBleepingComputer, Polymarket halts trading after crypto-draining script breach, $2.5M tracedThe Record, Polymarket confirms cyberattack on third-party provider after outagesMDN, Subresource IntegrityMDN, Content Security Policy guideMDN, Content-Security-Policy-Report-Only headerW3C, Content Security Policy Level 3HTTP Archive Web Almanac 2025, Security chapter (Content Security Policy adoption and script-src keywords)Weichselbaum, Spagnuolo, Lekies, Janc (Google), CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security Policy, ACM CCS 2016W3C, Subresource IntegrityThis episode's audio was produced with an AI voice clone of Marc, from a script Marc reviewed and approved.---I do hope you enjoyed this episode of the podcast. Here are some helpful resources including any sites that were mentioned in this episode.--Listen and subscribe: https://bytesizedsecurity.show/listen--Support ByteSizedSecurity (501(c)(3)): Donate via GiveLively--Questions or tips: email marc@bytesizedsecurity.show (subject: Byte-Sized Security). TikTok: @bytesizedsecurity
    Show More Show Less
    7 mins
  • Ep50: Arrested in a State She'd Never Visited: The Cash App Account in Her Name

    Ep50: Arrested in a State She'd Never Visited: The Cash App Account in Her Name
    Oct 23 2026
    Episode Summary:In this short episode, Marc covers 404 Media's reporting on Amanda Smith, a Pennsylvania woman arrested on an Arkansas warrant after someone opened a Cash App account with her Social Security number and date of birth and used it to collect $1,000 from a Facebook Marketplace scam. He walks through how investigators tied the account to her, the account details that don't match her, and why Cash App wouldn't share account information with her. The case is ongoing and Smith is presumed innocent. Marc closes with one record you can start keeping this week.Key Topics Covered:The arrest: a warrant from Arkansas, a computer fraud charge, and three nights in jailHow police got to her: a hacked Facebook account, a fake Marketplace sale, and a search warrant to Block, which owns Cash AppThe data that didn't match: a Philadelphia address, an iPhone running a 2022 operating system, and a Verizon connection when she's on AT&TWhere the case stands: Cash App wouldn't share account details with her, she turned down a plea offer, and a hearing is set for NovemberMain Takeaways:Identity theft isn't only a money problem. Stolen identity data can attach your name to someone else's crime.In this case, a Social Security number and date of birth were enough to put Smith's name on a payment app account.The details that didn't line up were the address, the device, and the phone carrier.Write down which accounts are actually yours: your banks and payment apps, your phone number, your carrier, and your devices.Timestamps:[0:00] The hook[0:17] The arrest[0:35] How police got to her[1:06] The data that didn't match[1:27] Where the case stands[1:50] What you can do this weekTools & Resources Mentioned:404 Media, Joseph Cox, "Someone Opened a CashApp In Her Name. She Faces Years in Prison" (Oct 21, 2026): https://www.404media.co/amanda-smith-opened-a-cashapp-in-her-name-she-faces-years-in-prison-cashapp-fraud/FTC IdentityTheft.gov, report identity theft and get a recovery plan: https://www.identitytheft.gov/FTC, Credit Freezes and Fraud Alerts: https://consumer.ftc.gov/articles/what-know-about-credit-freezes-fraud-alertsFTC, What To Know About Identity Theft: https://consumer.ftc.gov/articles/what-know-about-identity-theftEquifax credit freeze: https://www.equifax.com/personal/credit-report-services/credit-freeze/Experian credit freeze: https://www.experian.com/freeze/center.htmlTransUnion credit freeze: https://www.transunion.com/credit-freezeSocial Security Administration, Fraud Prevention and Reporting: https://www.ssa.gov/fraud/Free credit reports: https://www.annualcreditreport.com/This episode's audio was produced with an AI voice clone of Marc, from a script Marc reviewed and approved.Not legal advice. If you're facing criminal charges, talk to a licensed attorney.---I do hope you enjoyed this episode of the podcast. Here are some helpful resources including any sites that were mentioned in this episode.--Listen and subscribe: https://bytesizedsecurity.show/listen--Support ByteSizedSecurity (501(c)(3)): Donate via GiveLively--Questions or tips: email marc@bytesizedsecurity.show (subject: Byte-Sized Security). TikTok: @bytesizedsecurity
    Show More Show Less
    3 mins
adbl_web_anon_alc_button_suppression_t1
No reviews yet