Passed today with 96 percent. Better than I had hoped, not as good as I wanted. Surprisingly, I finished in under an hour and forty-five minutes, and although I did reference printed materials a number of times, I still would have passed easily without them. All in all, it's not a bad score:
http://www.giac.org/certified_professionals/listing/gcia.php
I felt the exam could have been much harder, or perhaps I got a bunch of easy questions. I don't say this because I'm a subject matter expert (far, far from it; I'm still clearly n00b level). I would also respect the exam a bit more if it had simulations like Cisco exams ("Using tool x, look through this trace and find y, determine z.") GIAC exams are still a good challenge, however, even though being able to bring in printed materials feels like cheating sometimes.
I spent a solid two months studying for the GCIA, first going through the OnDemand presentation (for which I took a week off from work to view) and then listening through the MP3s a few times over during my daily commute. Before I took SEC-503, I felt the content to be potentially intimidating since my IDS experience was nearly non-existent, even though I have been working with firewalls and VPN appliances for some years now. It's one of those things that I always tried to set up at work, but kept getting put on the back burner due to new priorities always popping up. We all know how that goes.
http://www.youtube.com/watch?v=RoB0mLerbG0
Mike Poor does an excellent job of keeping you entertained with the material, providing context and anecdotes to put things into perspective. 503 is obviously not a beginner's course. Before you jump in, you should have a decent grasp of TCP/IP principles (
http://www.sans.org/security-training/tcpip_quiz.php). The first day will run through those basics very quickly for foundational review. It goes by fast, so having the ability to pause the course as needed comes in handy. If you attend live instruction, it might be more overwhelming if your experience with the subject matter is minimal.
But it's all fun. There may be days when you feel your head is going to explode (in a good way), and you may experience the occasional buffer overflow, but I learned a good deal. It's always worth it if you can immediately translate what you absorbed in a class and apply it to your work environment the next day. In 503 you will look at packets, packets, and more packets. You'll dive to the bit level, start noticing subtle details in the tcpdump output, and learn to carefully examine hex ****. I thoroughly enjoyed the process of learning how to decode the entire IP / TCP / UDP / ICMP header structure by just looking at the raw hex **** (and performing file carving from non-HTTP streams).
Interestingly, I came across a large number of packets at work over the last week which my IDS triggered on. Neither Wireshark nor tcpdump decoded them properly, and I actually had to do it by hand to make sense of it. I knew being able to decode hex was a good fundamental skill, but I never thought I'd actually apply it in practice.
I will say this though - the course will not make you an expert in intrusion detection / analysis and you won't walk away quoting entire RFCs. You won't even leave the class a Snort kung-fu master. It will, however, provide you with a solid foundation, and expertise should come with sustained experience and practice like anything else. Beyond understanding layers 2 - 4, in real-life you'll need to know the upper layers to perform analysis. In other words, while the IDS can interpret the higher layers past the reach of many firewalls, the analyst will also need to be "protocol-aware" to make good judgment calls and reduce wasted effort on false positives.
One section that I was a bit disappointed on was the coverage of Microsoft protocols, specifically SMB / CIFS and especially MS-RPC. These are complex protocols which are relatively difficult to interpret, however, and really examining them in-depth would probably be a class in itself. 503 kind of glosses over this area.
So anyway, this was my third SANS course. The 401 and 502 courses (for the GSEC and GCFW, respectively) were great experiences in themselves, but I felt 503 applied more pressure. Think of it as a good stretching exercise. I've gotten the best bang-for-the-buck with this one between the SANS courses I've taken so far.
A good potential complement to 503 should be TCP/IP Weapons School 3.0, taught by Richard Bejtlich:
http://taosecurity.blogspot.com/2009/12/difference-between-bejtlich-class-and.html
I'm hoping to take this in August to augment what I've already learned and create more (brain) muscle burn.
That's my review. I shall now go forth and continue Snort tuning. Death to false positives!
