I’ve been also authorised to post them on my website, so feel free to download them from the updated “Papers & Presentations” page, where I have also posted some of the comments I received from several readers, as well as an interesting reference to my article from Harlan Carvey.

Happy reading!

That’s been what I call my ‘SANS itinerary’ since I started this exciting journey back in June 2007. It all started at SANS Secure Europe, in Brussels, where I took my first SANS class with Jess Garcia, CEO of One eSecurity and a good friend of mine. It was SECURITY 508, System Forensics, Investigation & Response, an awesome track created by Rob Lee on one of the most interesting and hot topics of Information Security. It’s been almost two years since then, but now I realize the tremendous positive influence that event had in my career as a security professional.

Early on the first day, I could see that was a different kind of training, far different from all the training sessions I had attended before, including the well-known CISSP bootcamp and vendor specific training like Checkpoint‘s and others I took in the past. Unlike those, this was real hands-on training, with lots of exercises and challenges, including the use of several virtual machines and an arsenal of security tools you can take home with you. Also, the amount of material you receive throughout a 6-day course is awesome. Someone described it like “drinking directly from a fire hose”. Actually, I can’t describe it better.

Add to that a friendly, relaxed but yet professional atmosphere, and the multiple opportunities you get for both networking and sheer knowledge with attendees and instructors and you will understand why Brussels was only the start.

With Carlos Fragoso and Richard Fadul at SANS Secure Europe 2007 in Brussels

Next came London, in December 2007. That time I chose the challenging SECURITY 503: Intrusion Detection In-Depth. I don’t exaggerate if I say this is the most advanced course in network intrusion detection and traffic analysis that has ever been taught, and by far the most valuable course I’ve ever taken. The quality of the material is outstanding (I keep using it as a valuable reference) and the fact that I had Dr. Johannes Ullrich (Chief Research Officer for the SANS Institute and responsible of the Internet Storm Center) as instructor was really a plus. Even if you knew nothing about IDS I guarantee the first thing you will do when you’re back home is setting up a Snort sensor or even deploying a Sguil NSM System!

Last thing I can say about this course is that I actually enjoyed it three times: first at the live event, second when I went through the entire courseware and exercises again to prepare for the GIAC exam, and third, when listened to the mp3 files of Mike Poor teaching the same material in a different venue. Two instructors for the price of one!

The same was true of my third stop, SANS Sydney in November 2008. This time it was SECURITY 560: Network Penetration Testing and Ethical Hacking, delivered by Mike Poor (I was looking forward to meeting him!!) and authored by Ed Skoudis.

While this is described by SANS as “one of the most technically rigorous courses offered by the SANS Institute”, I had some advantage with this one. While my previous experience in areas like Forensics and IDS was limited, I had been doing penetration testing at different professional levels for more than 8 years. Although I was certainly familiar with many topics and tools like Nessus, Nmap, Metasploit and others, there were plenty of advanced tips and tricks that made this course worth the money. I will just tell you that the section on Windows command line kung fu for pentesters and the exercises on password cracking using advanced Netcat relays will leave you breathless!

Ultimate hacking with Damian Grace and Robert Di Pietro at Mike Poor’s class in Sydney!

Then again, I enjoyed listening to Ed Skoudis’ mp3 files while commuting to work for the last couple of months before I took my GPEN exam. Thanks Ed for making traffic jams a lot more bearable!

My GIAC Certs: GCFA, GCIA and GPEN. Watch the 99% score on the last one!

As I said before, so far this journey has given me the opportunity not just to receive top quality training from some of the best security instructors in the world, but also to meet great professionals, colleagues and friends that make you feel part of a unique security community. Some of the people I’ve had the opportunity to meet and even hang out with includes Jess Garcia, Mike Poor, Johannes Ullrich, Raul Siles, David Perez, John Fitzgerald, Pieter Danhieux, Richard Fadul, Carlos Fragoso, Almerindo Graziano, Jonathan Ham, Justin Clarke, Robert Di Pietro, Chris Mewett, Damian Grace, etc… and many others I am fortunate to keep in touch with.

Now, the next stop in my ‘SANS itinerary’ will be Amsterdam in May this year. This time I’m proud to say that I’ve been selected to facilitate at SECURITY 542: Web App Penetration Testing and Ethical Hacking, a new 6-day track written by Kevin Johnson and focused on finding and exploiting web application attack vectors. Seth Misenar will deliver this track at SANS Secure Europe 2009 in Amsterdam.

Best thing this time is that, in addition to attending the course, as a room facilitator I will have the opportunity to work closer with all the instructors (specially with Seth) and other fellow team members.

I look forward to that!

Whatever you did, and despite the amount of money you spent, one thing is for sure: if you are reading this it’s safe to assume that you are still interested in reading about good infosec stuff, aren’t you?

Keep reading then and have a look at the following links containing a few interesting security tools, new forensic challenges and even a new Multi-Boot Security Live DVD:

• DFRWS 2008 Rodeo (forensic challenge): The 8th annual Digital Forensic Research Conference was held from August 11 to 13, 2008 in Baltimore, MD. A key element of this conference is the “forensic rodeo”, a challenge where conference attendees form teams to solve a digital forensic problem. The DRFWS has made the materials for the 2008 Forensic Rodeo available on their website for educational purposes and to support further research in memory analysis and file carving. The scenario description and the image files can be downloaded http://www.dfrws.org/2008/rodeo.shtml
• The Open Computer Forensics Architecture (OCFA): OCFA is a modular computer forensic framework developed by the Dutch National Policy Agency meant to be used in large investigations. If you want to give a try you can download the required packages from their main site: http://ocfa.sourceforge.net/
• Splunk: Splunk is a log archiving product that allows to search, navigate, alert and report on all logs in real time. Plus it’s free and available for all platforms on http://www.splunk.com/download
• Multi-Boot Security LiveCD DVD: A new all-in-one multipurpose LiveDVD that combines some of the very popular LiveCD ISOs already available on the Internet:
  • Backtrack 3
  • Damn Small Linux 4.2.5
  • Knoppix 5.1.1
  • Ophcrack 1.2.2 (with 720 mb tables)
  • Puppy Linux 3.01
  • and a few more…

I’m currently downloading the 4GB MultiISO .torrent file and will it give a try soon. Shame that Helix is not part of the DVD, but still looks like a handy tool to have in your Incident Response jump bag.

Enjoy and good luck with you holiday blues!

I’m sure those, both Unix beginners and their managers, will appreciate the following presentation I came across a few weeks ago: ”Unix Command-Line Kung Fu“. It’s author, Hal Pomeranz, presented it at SANS 2008 Orlando as part of the @Night talk conferences.

I think these nice slides will make happy not only users with less experience with the Unix command line, but also some experienced Unix folks that will find a good amount of tricks that provide massive productivity increases. I especially like the slides devoted to “Time-Based Searches”, which contain useful commands for intrusion detection and forensics analysis.

Well done Hal and thanks for this great material. And for those wondering whether there is any Windows alike version, stay tuned!

By the way, I thought there was no better place to start my new blog than right from where I am. If you keep reading my blog (thanks for that) you will see there are many things I enjoy. One of those is traveling, and London is one of my favourites places, and other one is technology, specially anything related to Information Security. And yes, that includes Macs! In fact I’m currently typing in one of the new iMacs, and you know how difficult is to find a free one, if you have ever been here.

Well, let’s keep this post short for now. I’m heading to the airport to catch my flight back home. I’ll be posting here soon, so stay tuned.