Network Security 2014: FOR408 Work Study

YFZblu

Hey all,

I received word a couple days ago that I have been accepted to facilitate the FOR408 course: Windows Forensic Analysis. Fee + SIFT kit is $1,235. Network Security 2014 takes place in Las Vegas, so it should be a nice excuse to have some fun the following weekend. Today I submitted a request to my employer to have the fee paid, I'll use this thread to post updates and later on my experience of the conference and coursework.

This is exactly the course I wanted, so I'm pretty stoked. The course will fill large gaps I have regarding the Windows environment and digging into malicious artifacts during Incident Response.

--chris--

YFZblu wrote: »

Hey all,

I received word a couple days ago that I have been accepted to facilitate the FOR408 course: Windows Forensic Analysis. Fee + SIFT kit is $1,235. Network Security 2014 takes place in Las Vegas, so it should be a nice excuse to have some fun the following weekend. Today I submitted a request to my employer to have the fee paid, I'll use this thread to post updates and later on my experience of the conference and coursework.

This is exactly the course I wanted, so I'm pretty stoked. The course will fill large gaps I have regarding the Windows environment and digging into malicious artifacts during Incident Response.

I just learned about the work study program, I'm very excited for you! I was wondering today how well they will balance the "work" and the "study" considering you are there to learn.

YFZblu

This will be my 3rd Work Study experience. Most of the work is done before and after the conference - I have never once been removed from the classroom or missed any material because of the WS commitment.

cyberguypr

Superb. Been looking to do FOR408 but they didn't bring it to Chicago this year. I tell everyone who will listen about the Work Study Program. Best deal ever. I'm facilitating SEC501 starting this Sunday here in the Windy City. In two my previous experiences I only had to leave the room to go pickup pizza or sandwiches, as the instructor bought everyone lunch so we could work through the break and catch up. Definitely a great experience.

YFZblu

Just got word that my employer approved the expense

cyberguypr wrote: »

I tell everyone who will listen about the Work Study Program. Best deal ever.

Agree 100%

chanakyajupudi

Great ! I did the 408 with work study as well last year. Trying for the 508 this year.

JoJoCal19

I'm wanting to do the Work Study program for some of the SANS courses, starting with the GSEC, possibly at the Orlando event next year. What tips do you have for applying? How far out, is there something SANS looks for in particular, etc. Does having certain other security related certs and experience, and/or degrees help?

j.petrov

@YFZblu congrats on getting accepted! I just completed the workstudy program in Boston for SEC 410 (GSEC), it was awesome. Enjoy the conference!

YFZblu

JoJoCal19 wrote: »

What tips do you have for applying?

I always take a decent amount of time to write my answers out in a text editor first. The site only gives you 15 minutes to complete the application, and I don't want to feel rushed. IMO, it is important to take the time to write a really good answer to the question: "why do you want to volunteer with SANS?"

JoJoCal19 wrote: »

How far out

I don't like straying too far from home when it comes to Work Study - So typically I will look at the yearly schedule and have my eyes on a few conferences. I'm in Phoenix so I usually look for the Phoenix conference, Vegas, and Southern California. At one point I was living in Michigan and was able to make the one in Chicago happen.

Anyway, because I have my eye on a few conferences early on, I'm always checking to see if my conference of choice has been added to the Work Study application drop-down menu. In the case of Las Vegas, I'm pretty sure I applied the very day they added it to the WS page. Just make sure you can be patient - I applied months ago, and just heard back this week.

JoJoCal19 wrote: »

is there something SANS looks for in particular, etc.

My understanding of their preferences:

1. SANS Master's students take first priority
2. Those with Work Study experience
3. New blood

It is important to note that SANS always makes sure to have some new people in the mix, so it's not like experienced SANS facilitators are chosen every single time.

JoJoCal19 wrote: »

Does having certain other security related certs and experience, and/or degrees help?

I'm sure it does, but it's likely not that stringent - When I received Work Study acceptance for SEC401 I was working Desktop Support and did not have much experience beyond that.

One last thing to add: Even if you don't get the course you want, or if it's a course outside of your interests, my advice is to work the event anyway. Ultimately having a relationship with SANS will work out in the end. That being said, they do an excellent job of lining Work Study participants up with the courses they want to attend.

JoJoCal19

Thanks for the info YFZblu! I talked to my manager and he said if I get accepted that at a minimum I can get 3 days off covered without using vacay, and that he'd try for the other 2. It's not fair that the line of business I support spends all the departmental training budget on the folks that actually produce income, and leave nothing for us technology folks. So I have to do the Work Study Program to attend SANS training.

TBRAYS

Just don't do workstudy for huge events because you will be out of the class quite a bit. I did the workstudy for DFIR Summit in Austin 2 months ago and I was pulled out quite a bit. I received word that I was highly recommended to do future workstudy events. I worked my a... off!

YFZblu

^ Interesting, I haven't done a really big event yet. Based on the number of courses being offered (46), Network Security 2014 will be by far the largest event I've helped out at. It will be interesting to experience the differences from a WS perspective.

YFZblu

I feel like there hasn't been a proper gambling update for a SANS work study experience yet. I slowly lost $100 playing Roulette, and then quickly lost another $100.

...I then said "screw it", and bet $100 on 'black' and $100 on 'even', simultaneously. Won. I am now even, minus the dealer tip. Help...

Seriously though, Las Vegas is far too distracting. It has mastered the art of taking my money. I shall post an actual SANS WS update in the morning - my first day reporting in.

YFZblu

Quick updates:

Sunday, day 0: This is the largest conference I've facilitated for, and the setup was pretty rough. We also registered Students and handed out materials that night. It was by far the longest day 0 I've had with SANS - I didn't get back to my hotel until 8p

Monday - I ended up missing the first hour of class because we needed to help finish the remaining registrations. I also had to Facilitate for a lunch-and-learn, which required me to be there 30 minutes in advance. More missed class time.

Tuesday - Yet another lunch-and-learn, another 30 minutes of class missed. Additionally I had to Facilitate for a SANS at night vendor event, so I left my FOR408 course 30 minutes early.

Wednesday - No lunch-and-learn, no night event. I'm looking forward to a full day to digest the material.

Because this is a larger event, I have missed a lot more class time. It's still worth it, but it's much more demanding of my time than previous Work Study experiences.

docrice

I'm not surprised at the missed class time. I think the Vegas and Orlando events are SANS' largest with a full-packed schedule, packed vendor room, and a very lengthy course list. On the other hand, you get to help contribute to a great experience for the other student attendees. At the two conferences that I've attended, everything went very smoothly and I'm sure the WorkStudy folks made a huge difference.

TBRAYS

My co-worker is in the class you're facilitating

cyberguypr

I've been toying with the idea of doing work study at one of the big events. What's the verdict? Would you do it again or do you like the smaller events better?

TBRAYS

cyberguypr wrote: »

I've been toying with the idea of doing work study at one of the big events. What's the verdict? Would you do it again or do you like the smaller events better?

I did both Cyberguypr, I'd prefer the smaller events because you get more class time.

azmatt

TBRAYS nailed it. I've done big and small and while there are advantages to both the smaller events can be a lot closer to the normal student environment.

YFZblu

cyberguypr wrote: »

I've been toying with the idea of doing work study at one of the big events. What's the verdict? Would you do it again or do you like the smaller events better?

Sorry for the late response - I left Vegas late Saturday night, and began working early Sunday morning. It's been 'go go go' since then.

The benefit I see to larger conferences is the larger variety of courses available; and the added likelihood of being selected for Work Study. Other than that, it was pretty grueling, IMO.

The setup and breakdown was much more work, and I missed class time twice a day, four out of the six days. In a smaller conference environment I might have one or two lunch-and-learns/nighttime events to help out with. In the case of Las Vegas, I worked five - all but one was a vendor/sales event. Bleh. It was especially unfortunate for the FOR408 course simply because there was so much material that I was inexperienced with. SANS anticipates this however; as you know we get the On-Demand material for four months.

In the end, it's always an honor to work with SANS and the training is simply the best. Yes, Work Study at a larger conference is still worth it; however because I am now in the position to get SANS training as a Student via my employer, I would likely only Facilitate a large event if it was a course I was dying to take. It worked out in this case, because 408 was at the top of my list.