I had six weeks between passing my GWAPT exam and attending SEC 503 at the SANS Network Security 2013 so for the first time in the past fourteen months I took a break from studying and certifications. I still spent some time setting up a VM and building a python web scrapping app but nothing worth blogging about.
For the second year in a row I was able to attend SANS Network Security in Las Vegas and for the second year in a row it was well worth it. I got back home last week and thought I’d type up a few quick thoughts on the conference since it’s been over a month since I’ve posted here.
In addition to seeing people that I wish I got to see more often I also got to meet some great new people that I look forward to talking more with in the future.
I (of course) attended the DFIR talk put on by Alissa Torres, Chad Tilbury, Lenny Zeltser and Rob Lee. It was a great talk and gave a sneak preview of each class and a nice overview of how they all fit together. That talk was followed by Jason Fossen’s talk “Windows Exploratory Surgery with Process Hacker”. The two main takeaways from this talk were:
- He know more about Windows than I will ever know about anything
- He is friggin hilarious
The only other night talk I got a chance to attend was John Strand’s talk covering tools on the ADHD distro including HoneyBadger and ReconNG. I’ve used ReconNG few times but a few of the other tools were new to me and the talk as a whole was highly informative and obviously entertaining.
There were a few other night talks that I wanted to attend but Netwars was calling my name. I got a chance to play for about an hour last year and had a blast so I was looking forward to being able to play for two full nights. I did a lot better than I did last year but I also identified several areas where I need to improve my skills in 2014.
While all of the things above were awesome the main reason for attending any SANS conference is the class itself. This year I was in Mike Poor’s 503 class on intrusion detection and packet analysis.
I was excited to get a chance to attend Mike’s class as packet analysis is an area where I have a ton of room for improvement as I rarely deal with it on a day to day basis. I always put in a lot of after class studying and test prep but this class may set the record as there’s a lot for me to work on. I’ll definitely have another post or two on my study process.
Regarding the in class experience, Mike Poor is a fantastic instructor. He’s mellow, friendly, seems genuinely interested in his students leaves a very good impression.
Our teaching assistant was Judy Novak. I heard several “the legend of Judy Novak” stories from John Strand last year during my 504 class so it was cool to get to meet her. She is Knowledgeable, helpful, funny, sweet and just 100% awesome. She gave an extra session on “IDS evasion using Scapy” late one afternoon which was a cool bonus.
All in all it was a great experience and I can’t wait until I get a chance to go to another.