After a slight false start concerning a registration mix-up at the test center, I got through the GCIH exam in two hours and a quarter and passed with a 96, which apparently is a lucky number or something because that's what I got on my last two GIAC exams. In any case, the questions were mostly straight-forward, but unlike my previous GCFW and GCIA exams, I had to reference printed materials much more frequently. I believe this is due to the sheer number of tools (bots, rootkits, etc.) which are covered in SEC504.
http://www.youtube.com/watch?v=erK0d8ZkZrk
This is my fourth SANS course / GIAC exam within a year (along with all the other certification studies), and quite frankly I'm burning out. A little rest period might be in order, especially with other things going on in life. SANS SEC504 is definitely a fun course and a solid introduction to the different phases of hacking attacks, their respective tools, and methods to prepare / identify them, all taught from the perspective of the corporate incident handler who must assess the situation and contain / eradicate appropriately. It's actually taught in a balanced manner from both the attacker's and defender's point-of-view.
Given the broad coverage range of the material, one should not expect to see a deep-dive into each of these tools. Some are given more attention than others. The instructor (Ed Skoudis) brings a lot of stories from the trenches to keep the topics in applicable context. You can tell he's been doing this kind of work for a long time.
On the final day of the course, there's a workshop to use the techniques you've learned over the previous days to break into box(es) and capture the flag(s). If you're doing this via OnDemand, you get an OpenVPN config to log into a remote lab and do the exercises.
I felt the GCIH exam was overall easier than the GCIA, but for me maybe a little tougher than the GCFW simply because I'm not as familiar with all these tools. Although concepts like alternate data streams, password cracking, and steganography aren't new to me, there was a particular area which I didn't comprehend easily due to the lack of a programming background: format string attacks. I think I'm still kind of hazy on this and I need to review it again.
When I first signed up for the course, I was thinking it would be more incident-handling focused. While the course arches over that process in course framework, the formal incident response process is mainly focused on in the first day. The rest of the week is dedicated towards the attack phases and the tools / methods / mindset (and how to defend against them).
I don't do incident response at work, but after taking this course I'm realizing that maybe I might enjoy this kind of work in the future. Like infosec in general, you need to be able to pull in skills from a lot of disciplines to accomplish the handling procedure appropriately. I feel I still have a long way to go in my career to up my skills in some key areas.
Summary: a solid introduction to understanding the general approach when dealing with security fires at work. I think the big takeaway is that you need to ensure you have the necessary policies, procedures, contacts, and management buy-in before you even get to the part where you can look for signs of issues on the network. Everything flows from there, and if it's the right kind of incident, you as a handler might end up in court testifying to help prove the case.
