Last week I found myself among over a thousand nerds and geeks learning the latest techniques to defend a network — yes, it must be a SANS conference. This year I decided to take SEC 504 – Hacker Techniques, Exploits & Incident Handling to better understand the latest attack methodologies and how best to defend against them. I learned a great deal from my first SANS class, SEC 503 – Intrusion Detection In-Depth, so I was very much looking forward to this one and was not disappointed.
My instructor, John Strand, was awesome. Sharp, knowledgeable, and thoroughly engaging, he was one of the best instructors I’ve had. He introduced us to a vast array of computer security tools and configurations to better defend our networks with and I’m really excited to start implementing them in my own corporate network. But what I appreciated the most were the “war stories” from his years of experience performing penetration tests, incident response, and computer forensics. By connecting the theories of the class with real world stories, he brought the material to life and showed just how critical information security is in today’s world. He also never hesitated to go beyond the stated curriculum to answer a question or show us a new tool or technique that he felt would be valuable to us.
For anyone who’s never taken a SANS class or is interested in taking one, I highly recommend SEC 504 with John Strand. Now onto studying for the GIAC Certified Incident Handler (GCIH) certification!
