SANS SEC401 Course Review

Posted on by

I recently completed the SANS SEC401 Security Essentials Bootcamp course via an online on-demand webcast.  If taken in person, this course runs 9 AM to 7 PM for six days…hence the “bootcamp” label.  With the on-demand format, you have the added privilege of viewing the lecture content at your own pace over a four month period.

If I can summarize the course in one word it would be, “AWESOME.”  The writer and instructor of the course is Dr. Eric Cole, a fellow of the SANS Institute.  His enthusiasm is contagious and he made approximately 50 hours of lecture content fly by in what felt like a mere 49 hours.  That is no simple feat considering the content.  Each day is dedicated to a particular topic:  Day 1:  Networking Concepts, Day 2:  Defense In-Depth, Day 3:  Internet Security Technologies, Day 4:  Secure Communications, Day 5:  Windows Security, Day 6:  Unix/Linux Security.  Oh, and there is a corresponding book for each day…

SANS GSEC401 Text Books

SANS GSEC401 Text Books

I read every word and went the extra measure of creating an index for all 6 volumes, which SANS intentionally neglects to include to encourage “Learning.”  I followed the advise posted by this fellow SANS trainee so I won’t bother going into detail.  My index looks eerily similar to his and I found his blog posting very useful.  In total it is 28 pages long.

 

What I especially loved about this course is that Dr. Cole added so much real world context to the material.  The course differs from the “textbook” model of teaching, and as far as I’m concerned, this should be a requirement for all security courses.  Textbook and real world are often misaligned.  The content addressed these challenges head on.  On the other hand, examples were provided of when textbook recommendations have been ignored and at what cost.  For example, he talked about a scenario where an adversary breached a very large network.  One of the well meaning administrators sent a message over email in reference to cleaning up the breach.  Oops…they never had a chance because the adversary read the email and inflicted as much damage as possible by Monday.  This highlights the importance of out of band communication in the event of an incident.

There was also tons of hands on labs and practical content.  I spent the time doing every lab and had the opportunity to play with tools like tcpdump and even messed around with stego crypto.  It was kind of fun hiding a secret message to my wife within a jpg picture of our kids.  Hands on training is a simple, but powerful learning technique and SANS makes good use of this as part of their curriculum.

Compared to the CISSP content, which I consumed 6+ months ago by means of a self-study program,  I found there to be some overlap.  More often than not, the SANS training looked at hands-on topics more granularly, but areas of theory were covered in more detail within the CISSP courseware.  For example, the Bell-Lapadula model was briefly mentioned in SEC401, but explained in further detail by the CISSP.  Overall, I am happy in the order that I pursued these credentials, but they could have been tackled in reverse order just the same!

This class truly was a bootcamp and for that reason I did appreciate the ability to go through the material at my own pace.  In some regards, though, I think doing so is prolonging the pain, er, I mean, extending the fun.  There is something to be said for battening down the hatches and going off-grid for 6 long days versus trying to steal 6 long days from your normal schedule.  Some other courses which are more lab intensive and collaborative, would not be as good if taken in this format.

SANS offers endless training opportunities and there is a case to be made for all IT employees to take some of their training.  For example, they have an entire course that focuses on Windows Security.  There’s another that focuses on Unix Security.  Secure Web Development?  They got that.  Let’s not forget Network Security…  The list goes on and on.  These courses are not just for security analysts.  They are for IT professionals who want to accomplish their job in a secure manner and I highly recommend them to all IT administrators.  Perhaps one person from each department could attend one SANS course per year?  Wishful thinking perhaps, but it would be a great investment and in line with our core values here at DoIT.

“We will actively hire great people, develop the growth of our staff, promote a diversity of voices, and support our staff.”

I will be taking the associated GIAC GSEC exam within the next week for the sake of putting a rubber stamp on this experience.  However, it’s really all about the journey, not the destination!

Some food for thought from the course:

1) Prevention is ideal.  Detection is a must.

2)  What is the risk?  Is it the highest priority risk?  Is it the most cost effective way to mitigate the risk?

3)  TCP/IP and TCPDUMP Cheat Sheet

4)  SANS Windows Tools and Scripts Download

5)  Baseline your systems while they are healthy by, at a minimum, documenting running processes, listening ports, existing users (especially admin and root level access UID 0) and admin group membership.

Rating:  Excellent – I’d pay my own way … okay, not really, but that’s how much I liked it.

Thanks for reading and don’t forget to subscribe!

46 thoughts on “SANS SEC401 Course Review”

  2. Hi Matthew, I was just wondering if you completed the practical exams provided? If so, are the questions similar to what will be in the real test?

    Reply ↓

    • Yes, the practice tests and the actual exam were almost identical. The questions were different, but the style and difficulty were exactly the same. In fact, I scored higher on the real exam than I did on the practice exams.

      Reply ↓

    • The pdf version of the books are not given to students, probably to prevent sharing…

      Reply ↓

  4. Hi Matthew, I recently joined the security team and I am wondering if its best to start with SEC401 or dive straight into CISSP?
    I have loads of 15 years work experience in all support fields e.g group policies, AV, Active Directory.

    Regards

    Reply ↓

    • Hi Jack. I personally did the CISSP first, and SEC401 next. It worked out well for me, but I don’t think the order is overly important. If you are in a more tactical, hands-on role, 401 is definitely the way to go. However, CISSP is very broad and gives you the big picture. IMHO, CISSP lends itself to a self-study program more-so than 401. So if your company is sending you to a class or paying for an online course, use it for SEC401 and study on your own for the CISSP. Ted Demopoulos of SANS recently released and updated the study guide for the CISSP. You might want to check it out: http://securitycerts.org/review/cissp-study.htm

      Reply ↓

  5. Hello Matt,

    I took the SEC401 course and I have my exam in 20 days and I haven’t made the index at all. Your blog is very helpful. Is it possible for you to email me your index? I would really appreciate it! Thanks much!

    Alyssa

    Reply ↓

    • Hi Alyssa! I’m sorry, but I can’t share the index with you for a couple of reasons. 1 – The books have probably been revised since I took the course so the page numbers would not be accurate. 2 – In my index I included notes from the actual text books, so sharing it may constitute a copyright violation. My apologies, but no worries, you can still create one in time. You have 20 days and 6 books. That gives you 3 days per book to create an index. Since you are pressed for time, don’t worry about indexing every word, just the high level topics and topics that you struggle with. Let me know when you pass!

      Reply ↓

  8. Is it possible to retake the test without retaking the course?
    I regrettably found that indexing was not the right path for me. Need a do-over.

    Reply ↓

  9. this is so very helpful, thank you!
    I am sitting the course in a month’s time, my CISSP is very old (although active) and I’m not a hands on at all any more. What could I read to prepare myself?
    thanks
    J.

    Reply ↓

  10. Hi Matt, I’m a 23 year old looking to get my foot in the door for IA and I was directed to the path of 8570 courses. I have very little experience in IA and security but I was wondering which sections you might suggest for someone who is brand new to this world and trying to learn. I see you suggest CISSP for a more broader overview and the SEC401 for more specialized? The whole process can be very confusing for someone just starting out and trying to decipher the courses and acronyms, so I would appreciate any guidance you might have for me.

    Best, Laura

    Reply ↓

    • Hi Laura! If you are looking for a more technical course, GSEC would be the better way to go. Both the CISSP and GSEC are broad, though. GSEC goes deeper into the topics it covers, whereas CISSP helps you learn key terminology and concepts. Your background and goals would make a difference here. CISSP is more widely known and will help you land those job interviews. But I am a big fan of GSEC, which will really help you be effective in the real world. There are other options you may want to consider as well, such as the GISF or Security+ since you are just starting out.

      Reply ↓

  11. I am prepping to take my certification test after having completed the On Demand course. My brain must be really strange because the only thing I remember about the course is how to blow up peeps in a microwave with aluminum foil. Not feeling real confident right now.

    Reply ↓

    • Ha! That lesson stands out in my mind as well. I always feel the same way after taking a SANS course. Then, after doing some prep, the practice test makes me feel a lot better. Do your index and you will be fine. The course content always feels harder to me than the exam.

      Reply ↓

  12. Matthew,
    Thanks for the read, an index is a great idea. I will have to hold a mindset for indexes as I move forward. I am just starting out into the infosec world and just started graduate school for cybersecurity technology.

    Looking at the material do you think it is worth it to take SEC401 or should someone like myself start at SEC301. Although I am new to the material, my understanding of what is presented in SEC301 seems to be EXTREMELY basic even for someone just starting their way into the field. Is 301 necessary or should I forget about it and start with 401. Additionally, are the GIAC certs something I should wait for an employer to pay for or if I can somehow manage by should I take something like the 401 before employed i.e. is the GSEC something that will also improve my hireability?

    Reply ↓

    • Hi Chris. If you have a background in IT and you are going to have some graduate level courses in progress or under your belt, you can probably go straight to 401. GIAC certs are relatively expensive so if you can wait for an employer to pay for it, you are better off. The CISSP you can pretty much achieve via self-study and holds a lot of weight with HR departments, although GIAC is has way more practical value and the tide is starting to turn in their direction. So if money is a factor, you may be better off going for the CISSP on your own, and then when you start interviewing make sure they will include one SANS course a year as part of your hiring agreement.

      Reply ↓

  13. Hey Matthew,

    Hopefully you see this and respond but I figured I’d give this a shot anyways. I plan on taking the GSEC bootcamp course at the end of the month and I believe that I will be taking the exam immediately after the course finishes. Is that a wise decision in your opinion? Hopefully I won’t be too burnt out after a long week of training but I want to get the certification test done as soon as possible while the information is fresh in my head. For background, I currently work in a SOC for a defense contractor so I do have some experience with the subject. I also have my Security+ but I am well aware that is childsplay compared to the GSEC. Anyways, I appreciate the help and response!

    Reply ↓

    • Hi Tom! Quite honestly I think that is a bit ambitious. I would give yourself at least 2 weeks to prepare. If you are looking to score 90% or higher and become part of the GIAC Advisory board (which I highly recommend), I would push it out a full month. Let me know what you decide and how you make out. You are going to love the course!

      Reply ↓

  14. Hi Matthew,
    i am planing to take compTIA secutity + exam next month, and i am interesting for GSEC certification, but i am a little bit confusing a about the best way to do this certification (doing a 5 days course or self-study), and about the cost of this certification.

    Reply ↓

    • Security + is a nice foundation to build upon so congratulations in advance! IMHO the GSEC cert (or SANS certs in general) is not a good candidate for self study. To challenge the exam you are in for over $1k and the official “textbook” is only available if you take SEC401. Your best bet is to take the course via the SANS work study program, or try to find employment with a company that will pay for the course. The prices are listed on SANS’ website.

      Reply ↓

  15. Hi, after 20+ with telecommunication industry, I am planning to transition my career to cybersecurity. Mostly, my current experience has to do Transport technologies (e.g., DWDM, OTN, SONET, etc.), bit of IP networking, and scripting languages. Do you think taking the GSEC certifcation will be a good starting point, will it good foundation to get entry level job. Or do you have another recommendation on what class/certification should i pursue first.

    Reply ↓

    • Hi Ash: Good question. It is an ambitious starting point if you don’t have general IT experience, in addition to Transport technologies. I would consider some of the Comptia certs as a first step, and then progress into GSEC IMHO. The Comptia cert probably won’t get you an interview, but it will lay the foundation for GSEC or another security cert.

      Reply ↓

  16. Hi Matthew,
    I am looking at doing the SEC401 class through work and am wondering what would be the best way to do so, in your opinion: online study or taking the 6 day bootcamp style.
    Thanks in advance,

    Reply ↓

    • If they will pay for the in person class, do it! There’s nothing better than being face to face with the terrific SANS instructors and a room full of peers trying to learn the same things you are in 6 intense days of instruction. But if your job will only pay for the online version, don’t be too disappointed. That’s how I took this class and doing so online has some advantages too, like being able to move through the material at your own pace.

      Reply ↓

  17. I’m interested in the SEC 401, but won’t be available until November. Any bootcamp coming up in my area around this time? I live in Kentucky.

    Reply ↓

Leave a Reply

Your email address will not be published. Required fields are marked *