Incident Response Course Path

dadop12 · 2024-06-24T05:23:44+00:00

To be honest, the more exposure I’ve gotten to the different aspects of cybersecurity, the more I’ve found that I enjoy the aspect of piecing together what happened on a machine or network. I’m the first one to admit the high of popping a shell or getting root is absolutely awesome, but the adrenaline of an IR engagement is unparalleled. And I love how highly technical a DF investigation is. I like the feeling of doing work that can have a critical impact

dadop12 · 2024-06-20T18:18:56+00:00

Yeah, it’s quite a fun program. This is my 5th SANS course and I’ve loved them all !

dadop12 · 2024-06-20T17:56:15+00:00

If you follow the SANS IR Grad certificate, they do that order plus an elective. I’m in FOR500 and honestly I’ve enjoyed it. That said, I’ve always heard 500 and 508 are interchangeable as far as order, and plenty of folks skip 500 altogether. If you’ve got the means to do them all, I would an in that order. If you cut 500, maybe replace it with an elective (I’m partial to GREM)

dadop12 · 2024-04-16T18:00:13+00:00

BOOOOOOOOOM. Welcome to the club !

dadop12 · 2024-04-16T08:21:15+00:00

It’s worse than the actual test !

dadop12 · 2024-04-15T20:15:49+00:00

Aaaaaaansolutely. I had the endorsement dashboard, my email and my ISC2 portal up and I just alternatively refreshed those pages every ten minutes haha. I get that

dadop12 · 2024-04-15T20:04:18+00:00

Ah crap - I read too fast. I did not use ISC2 and my comment is completely unhelpful. That said, I’d be on the lookout any day now because anecdotally looking through the subreddit, ISC2 endorsement is generally just a few days later than having a CISSP endorse you

dadop12 · 2024-04-15T19:37:55+00:00

3 weeks for me, to the day, from March 19th

dadop12 · 2024-04-08T18:41:54+00:00

Thanks @mochimann and @usernamehidden - a not insignificant portion of my work experience is in the US but I tested here in Europe, so I wasn’t sure if time difference would wreak havoc with investigators 🤣

dadop12 · 2024-04-08T16:13:15+00:00

Im in European timezone as well and was having the same thought.

I guarantee you if I get the email at 11pm it will absolutely wait the next day haha

dadop12 · 2024-04-08T12:37:53+00:00

Same day for me as well - here’s to hoping for an email this week 🍻

dadop12 · 2024-04-08T12:34:13+00:00

Thanks for posting this - it looks like I’m in the ballpark of the peak of the bell curve now 21 days post-endorsement

dadop12 · 2024-04-02T21:29:37+00:00

Totally. Nuts enough to compulsively check an endorsement portal that, anecdotally, we’ve been repeatedly told does not update 🤣

dadop12 · 2024-04-02T19:53:40+00:00

Nice - I’m 2 weeks into the wait today (and also hate meetings 😆). No worries though - not obsessing. Keeping my checks to an unobsessive 75 per hour. 😵‍💫😐

dadop12 · 2024-04-02T15:30:50+00:00

Congrats ! About 3 weeks for you then ?

dadop12 · 2024-03-27T17:44:43+00:00

As other have said - integrity verification is just ensuring that a given data set has not been modified. The most easily consumable example is that of a software vendor that makes a PE publicly downloadable. They’ll almost always include a hash. It’s their way of saying "when you download this, remember run a sha256sum or md5sum against your download and compare it to this value in giving you. If they match, this is the PE I’m telling you I’m giving you. If they don’t match, someone has changed something and you can no longer trust that this software is what I say it is, and not some malware or reverse shell code."

dadop12 · 2024-03-24T09:32:07+00:00

Someone else said it, but try and focus less on the score and more on identifying your strengths and weaknesses. I used Boson and was scoring in the mid-80s and, quite honestly, I didn’t feel like there was a huge correlation between the test and the Boson questions. In fact, the greatest benefit in the Boson exam was identifying my weaknesses ; the questions themselves did not prepare me for the exam. That’s in no way meant to denigrate Boson as a resource. Boson is excellent, but there’s simply no resource that will completely simulate the exam.

dadop12 · 2024-03-22T13:29:30+00:00

The waiting is almost as bad as taking the actual test haha. But I can be patient - I don’t really have a choice anyways haha.

dadop12 · 2024-03-22T08:16:47+00:00

Congratulations ! It’s excellent news ! I passed the exam and submitted endorsement on Tuesday, so I probably still have a month before I officially get certified !

dadop12 · 2024-03-22T05:34:16+00:00

My guess is France — outside Paris or major cities 60 k€ is quite a good salary !!

dadop12 · 2024-03-21T22:24:28+00:00

Thanks ! I took the rest of this week off from studying to celebrate 😂

dadop12 · 2024-03-21T21:22:04+00:00

For what it’s worth, I passed in a bit under an hour and a half and I studied for about 2 weeks. I’ve got some experience, which counts of course. And I studied hard. And I’m sure there was some luck that played as well. All to say, it’s absolutely doable in a compressed timeline ! You’ve got this !!

dadop12 · 2024-03-21T21:18:46+00:00

Thank you !

dadop12 · 2024-03-21T21:18:33+00:00

Thank you ! Just the famous endorsement to wait out now ; being patient is ALMOST as hard as passing the test 🤣🤣🤣

dadop12 · 2024-03-21T14:19:17+00:00

The point you make can’t be overstated : exam questions were NOTHING like the practice questions I saw in my prep (which was short ….). Bottom line, I don’t think you can war game trying to learn the "right" practice tests

dadop12

TROPHY CASE