Tips for first timers attending SANS events

This is a guest post by Ori.

In the past 12 months I attended two SANS training events as a Work Study participant and decided to write this post based on my observations.

SANS Institute is the biggest player in information security education field with the best and brightest instructors and unmatched content quality. This all comes with a price, $6,000+ per class which doesn’t include Certification attempt, practice tests or OnDemand course-ware. (Not all classes have certifications by the way.)

Here are some tips for future attendees so you get the most out of your experience:


A working laptop is a *MUST* and is what can make or break a great experience. Make sure you have a laptop powerful enough to run at least 2 virtual machines simultaneously. A minimum of 8GB memory should be sufficient for most classes. If you have a clunker that can leave you on the side of the road half way through the week, don’t risk it and get yourself a new/used device. You can also ask your employer/friends for a loaner device. (What’s another $500 when you’re already dropping $6K on a class?)

  • Don’t forget your power adapters.
  • Bring empty USB sticks in case you need to transfer files between computers.
  • Network cables (usually not needed but you can never be too prepared).
  • SANS exclusively uses VMWare(Player, Workstation, Fusion) so make sure you have it installed and configured properly before you arrive at the training facility. Virtualbox can be used most of the time but the support you receive will be limited. This part is very important, do not skip this step.
  • Learn how virtual networking works, such as Bridged vs. NAT configurations.
  • If you feel uneasy about hopping on the Wi-Fi at the facility utilize a VPN service.


For those of you who are taking a class that comes with a certification, if you are planning to get certified you have 4 months before time runs up. GIAC certification exams are mostly open book so start creating your exam index while you’re in the classroom. As the instructor is reading through the slides throughout the day, open up your favorite spreadsheet application and start taking notes. Make a 3 column sheet that goes like:

Screen Shot 2018-08-15 at 11.08.02 PM

If you purchased the certification attempt it will show up in your account dashboard within a week once your class is over, make sure to complete your index, head over to the GIAC website and take your first practice test. Look for spots in your index where you can improve upon based on the questions you encountered in the first practice test. Once index is updated then take your second practice test. Your score should improve since your index is much better now. Once you complete the second practice exam feel free to schedule the real exam. These exams are proctored therefore you need to find a location near where you live, and they have limited spots! Register early, register often!


Research the instructors who teach the class you are planning to attend. Not all of them deliver the content the same way, certain ones may have more expertise in the subject matter or just simply be better presenters/teachers. This can greatly effect how much you get out of the class, so do your research.


Netwars is a phenomenal experience. If you can afford it make sure to purchase access to this 2 day after hours Capture the Flag event at your training location. This CTF is different than the one taking place on the last day of your classes.


Wear comfortable clothes and shoes. Classrooms are usually in large ballrooms in hotels/convention centers. Temperature in the rooms can vary significantly throughout the day. Dress in layers so you can react to room temperature changes accordingly.


Fill out the daily evals handed to you so that your feedback can be considered for making future improvements/adjustments to the classes. It may feel like overkill but the feedback from individuals are incredibly important, otherwise SANS would have no idea how they are doing or how their instructors are holding up.


Meet your neighbors in classroom, strike a conversation and you will be amazed to hear the stories of people from all walks of life and all levels of experience. They will also likely to be your teammates at the end of the week if there is a Capture The Flag (CTF) event on the last day of your class.

Ask Questions

Ask questions to your instructor, if you have a lot of questions ask some of them during the breaks. If you are feeling like most of the topics are flying over your head, then go to the event management office and ask for recommendations on what other classes you could switch to that are being offered at the same location. This is a good idea even though you’d be missing the very beginning of the class you’re switching, The alternative is wasting a ton of money for a class you’d be lost in for 6 days.


Keep hydrated, make sure to snack and keep your brain sharp.

Keep In Touch

Exchange business cards, emails with people and stay in touch. Just because the class is over learning doesn’t stop, stay engaged.



@hacksforpancakes (Lesley Carhart) has an amazing guide on how to prepare for GIAC certifications on her blog.

Comments are closed.

Up ↑

%d bloggers like this: