My experience as SANS facilitator (SEC566)

FluffyBunny

EDITED: Thanks to @Meggo I can now include links I've updated this post to include all the links that were missing...

(Originally posted on my blog here)

About a month ago I explained a bit about the amazing chance I'd been offered by SANS, when they accepted me into their Work/Study Program. My week with SANS is coming to its end, so I thought I'd share a few of my experiences. Quite a few others have shared their stories in the past (linked below), but this is mine.

• ChooseLife's story for SEC401 in 2012
• UnixGuy's thread from 2017
• CyberGuyPR's thread from 2015
• My current co-Facilitator Chris van Bael's story from another year.

As was expected the days are pretty long and the work is hard. But for me they haven't been unbearably long, nor impossibly hard. Overall the atmosphere at SANS Amsterdam has been pretty laidback! 

Before coming to town, our event managers had set up a WhatsApp group so we could stay in close contact before and during the event. This turned out to be very helpful, as we could keep messaging eachother during class through the magic of WA's webapp. You can count on silly memes flying through that chat, but it's been mostly useful

Sunday was spent moving and unpacking 250 boxes of books into the respective eight rooms. There's a rather specific layout that SANS want their student-tables to be in (books stacked exactly so-and-so, pen here w/ yellow cap there, logo pointing here and so on. As another Facilitator said: "Clearly someone has put a lot of thought into this...". I've found that, after putting the boxes on the ground in a circle around me, I got into the rhythm of making the stacks real quickly. Setting up the mics and speakers and rigging powerlines was a nice flashback to my days with AnimeCon. 

Choosing not to stay at an Amsterdam hotel has been both a boon and a burden. Traveling home allows me to see Marli and Dana every night and saves me quite some dough. It'll also take my head out of SANS a little bit, so I can unwind. On the other hand I'm missing out on the nightly sessions and NetWars. 

Working with the SEC566 trainer Russell has been nothing but a pleasure. As he himself said, he's "pretty low maintenance". He doesn't need me to go around town to grab things for him, just make sure his water bottles are always available and that the room's ready for use. So instead, most of my time went to the rest of the party: cleaning the room, prepping for the next day and making sure that the other students are "in a good place". A few people were having issues with their lab VMs, some folks had questions about practical SANS matters and others were simply looking for a nice chat. 

Speaking of: I can honestly say that it's been a long while since I've spent time with such a friendly group of people! I know that some folks on the web have been complaining that the InfoSec industry has been toxifying in recent years, but at least we didn't notice anything'bout that at SANS Amsterdam. I've met quite a few fun and interesting people here! 

In short: I am very grateful for the opportunity SANS have given me and I would recommend applying for the role to anyone in a heartbeat!

 

---

 Because some people have asked, here's my "normal" workday as Facilitator, traveling from home in Almere to Amsterdam.

• Wake at 0530, make breakfast for myself and my daughter; pack her lunch, do my makeup and run for the train.
• Arrive at 0740, making sure that I'm really in time for the agreed-upon 0800 start.
• Parlay with the hotel banquetting staff, seeing if everything's okay, welcoming students and trainers who may be early, help opening up rooms where needed.
• By 0830 I'm officially back in charge of "my room", meaning that I stay there and only there. Welcome my classmates, help the trainer with anything they need, etc. 
• The day's first break is scheduled for 1030, so I step out of class by 1015 to grab myself a quick drink and make a quick trip to the loo. During the actual break I'm expected to be available to students and trainers; that's why.
• Ditto for lunch: the break starts by 1215 and lasts until 1330. In order to actually have a short break myself, I work together with my neighboring rooms (managed by the awesome Lars and Nicolas) to cover eachother's rooms. So beforehand I make sure I can actually keep watch and clean the rooms a little bit, while the other two are gone. 
• And again for the afternoon break: evaluations are due later, so before my classmates have their breaks I grab the forms, have a snack, etc etc. 
• Around 1700 SEC566 winds down. While the trainer's answering final questions I start cleaning up and dishes and trash so we can leave the room in good shape for the next day as soon as possible.  

During the lab exercises I usually work ahead, so I'm one chapter ahead of the class. That will allow me to know upfront what kind of problems they may run into and may need help with. As others on TechExams.net have pointed out, Facilitators are NOT the same as TAs (teaching assistants). So on the one hand I am constantly a bit anxious about whether or not I'm butting into the trainer's ground. On the other hand I've had good responses from both classmates and the trainer, so I reckon I didn't tick anyone off... At least not this time

I can imagine that it'd be entirely different in a tech-oriented class. I'd have to pipe down a lot more than I did this week. 

E Double U

You and Russell both did your jobs well!

FluffyBunny

Thanks EW! I appreciate that your positive feedback

cyberguypr

I work with Russell regularly in $dayjob. Fantastic guy.

scasc

What a lovely post - many thanks for sharing. Hopefully I’ll get selected to also facilitate 566 soon.

FluffyBunny

cyberguypr said:

I work with Russell regularly in $dayjob. Fantastic guy.

As I said to the event manager: Russel is absolutely the most charming trainer I have ever had. 

Sure I had funny ones, fun ones, cool ones. But this was something else

Penguineer

Thanks for sharing! I've always wondered what it's like to be a facilitator at a SANS event. I had a chance to facilitate SEC401 but had to pass because of scheduling conflicts. How early did you submit your workstudy application? 

UnixGuy

Thanks for sharing! Glad you had a good time!

FluffyBunny

Penguineer said:

How early did you submit your workstudy application? 

Let me check my paperwork!

• I applied for SANSAmsterdam 01/2019 in early September 2018, after learning about the program.
• Looooong silence after that, wasn't expecting much anymore.
• I received confirmation that I was selected as Facilitator in early December.

As our trainer indicated: if you'd like to be in the Work/Study program, apply early.

And also keep in mind: while SANS may retain your previous applications, they will NOT automatically call on you for other events. You have to apply for each event separately. Of course, once you've been a Facilitator once they will also base their judgement and acceptance on the feedback they received from your trainer(s). 

Penguineer

Thanks for the info! I will take your advice and apply early this time. I applied late last time and was only offered to facilitate 401 because someone cancelled last minute. 

Good luck with your studies!