Tackling the GIAC GCIA!

Well, it’s that time again.  Time to tackle yet another certification.  The last certification I took was the GIAC GSEC which was chronicled in depth in a previous journal.  In that post, I went over briefly on the idea of are certifications worth it to someone.  After the GIAC experience I had last year, I couldn’t wait to get back into the saddle and conquer another GIAC class.  This time, a co-worker and I were approved to take on the GIAC GCIA training and exam.  What follows is another adventure into the wonderful world of SANS.

You mean I get to travel?!

The last time I was able to go to a SANS event, it was held locally.  By locally, I mean in my state of residence, Texas.  Roughly translated, a little over 250 miles.  This time I was approved for some major travel expenses, which made me feel all warm and fuzzy.  This year I was able to go to the SANS conference in Reston, VA.  One hassle free Virgin Airlines ride and we got on our way!  This was my first time in Virginia.  My trusty co-worker and I made our way to the hotel and checked into our rooms ready to wake up, get badged up, and submit our lives to the one and only Mike Poor.

I blame Mike Poor!

Upon entering the classroom, our awesome facilitator handed us our bag of books, which was different from my first time at a SANS conference where we received our books at check-in, and made our way to our seats.  We picked them strategically… you know, not at the very back, but not first row.  Others made their way in and filled the seats.  You could just feel the aura of nerd permeating through the rows of tables.  Finally the class started and we were introduced to the man, the myth, the legend, Mike Poor.  Many have said Red Bull runs through this man’s veins.  I’m not sure if that’s true, but the energy drink company may sponsor this guy due to the amount of cans he went through during the week.  Although he may not have visual wings, this man is high-powered octane and will keep you engaged. 

Like the GSEC and, I assume, any other SANS class, we went one book a day.  This material was very new to me.  Day one I kept up and understood the majority since it was a lot of TCP/IP concepts and also included IPv6.  Day two was slightly different but I held on.  It wasn’t so much of lack of understanding, more so than lack of sleep which kicked in the last hour or so of class.  Day three is where I started getting “deer-in-headlight” face when the topic of IDS/IPS evasion and other traffic analysis topics came up towards the latter half of the day.  The workbook definitely filled in the gaps and solidified the concepts covered in class. Day four… what can I say about day four?  It was the best of times.  It was the worst of times.  We were introduced to Snort and Bro.  In the past, I was introduced to these two tools, but never got to play with them in their full capacity.  Each package went over their own operational lifecycle, so by the time you got to the end of Snort, it was like Mike hit the repeat button but it was all for Bro.  That was morale crushing.  Necessary in the grand scheme of things, but my mind just did not want to get back in the game after half time.

But wait! Didn’t you say it was the best of times?  Sure, but let’s take a step back for a moment and go over a topic I find unbelievably valuable at these conferences; SANS@Night.  These are bonus sessions in which the instructors give an hour long talk about a certain topic.  When I did the GSEC class, I found myself at these talks every night.  Up until day four, I was in the room as well.  What stopped me from going on night four?  Mike Poor.  He invited my co-worker and me to go eat at a Korean BBQ place somewhere in the area.  Let me be the first to say, when you are invited to go to dinner with a minimum of five SANS instructors, you go.  The evening was an epic event that will not soon be forgotten.  However, co-worker and I had to cut our invite short since it was getting way too late.  The rest of the party were out until sometime the following morning.  I can only speak for myself, but I was destroyed and had to depend on sugar and caffeine to get me through the next day.  For this, I blame Mike Poor.  What is most impressive, Poor came to the class and didn’t skip a beat.  He taught the class with the same intensity he had the past few days.  That man is a beast or part cyborg! 

The last couple of days went off without a hitch.  I must say I was confused on a lot of the material but picked it up with the included workbook exercises.  The final day came forcing all of us to utilize the skills we all gathered throughout the week to recount the steps a nefarious hacker took within a honeypot.  This was a very exciting exercise as we were split up in teams and divided the tasks among individuals.  I was not expecting much in the area of results from my area since everyone else seemed way more experienced than me, but surprisingly enough I nailed my portion of the investigation including finding a photo of the perpetrator with some Google-fu.

Ugh… Indexing… Again

Indexing? Do I really have to? In short, yes.  Much like the GSEC experience, you get a ton of pages with no way of knowing where anything is which necessitates the need for an index.  However the biggest difference between GSEC and GCIA is the amount of topics covered.  Whereas GSEC is a broad spectrum of information security knowledge, GCIA is more focused on a specific set of concepts, tools, and commands.  Because of this, your index will be significantly smaller than GSEC. 

My previous experience in indexing really helped out. But I deviated in my study method.  I went through each book and took meticulous notes by hand in a spiral first.  That’s right. I went through the books twice.  In hindsight, I feel I could have done this study portion without this first step.  But I can’t say it hurt.  I am able to maintain knowledge better if I write stuff out by hand rather than blindly typing stuff into a Word or Excel document.  It’s just the way I work. 

Round two of hitting the books included indexing which was not as detailed as my first phase notes, nor my GSEC index.  But I did get the main sections I included in my GSEC version (Book Index, Tools, Commands, References).  I added header charts I found over at nmap.org and a hex, dec, bin chart that definitely helps making quick work of conversions found in those practice exams.

Am I Ready?

GIAC gives you two practice exams to see if you are on target.  My first practice exam emulated my GSEC experience.  The biggest difference was how often I used material to double check my work.  I hardly found myself reaching for the index or books.  This can be a very good thing.  For the first half, I was hitting a solid 90+% score.  But something happened.  Mental fatigue and wanting to figure out what I was going to do later that evening.  The increase of bone head mistakes and just wanting this to be done dropped my score.  I passed, but I learned a ton about the necessity of maintaining concentration.  I also found areas I needed more work in such as DNS and strangely Wireshark fundamentals (I think this is due to the aforementioned distractions).  The second practice exam was better, as you’d expect.  But that damn DNS category still got me.  I did get five stars on Wireshark (At least the embarrassment of that went away).  Other than that one aspect, I pretty much got it.  I’ll go ahead and schedule the exam and let you know how it goes in the next section.

It’s Time

So in the last section, I left off with two practice exams down and this feeling of just wanting to get this over with.  I scheduled a week out at my testing facility of choice.  DNS was a weak spot for both practice exams so I had that nagging me all week and I really concentrated on trying to that sorted.  Two days before the exam I felt I was ready and didn’t want to study any more.  I just couldn’t force myself to get those books out again.  I took the days off despite my wife’s words of wisdom.  Something about locking me out of the house if I failed the exam because I didn’t study those two days.  The night before I went through the books again and firmed up the loose ends I had.  Before I went to sleep, I made sure I put all the material I was to bring in the bag from the SANS convention I got back in Reston, VA.  I had dreams of the exam.  Yes, I was the paranoid about it.  Oddly enough, it wasn’t about taking the exam, it was about missing my scheduled time and not even getting to sit for the thing!  I woke up the next morning groggy.  In addition to the horrible dream, my dog found her way on to my pillow and a canine tail was laying on my face.  Looking at the clock, I realized I had overslept but only by about 30 minutes.  Definitely enough time to get to the testing facility.

So with all the worry about waking up late and the traffic due to construction, I get to the facility 2 hours early.  The people there know me and consider me an expert tester (mainly due to the certs you obtain through WGU).  They were nice enough to just put me in the hot seat immediately.  The first few questions did not phase me.  Then the DNSish questions came…. I plowed through them.  Around a quarter into the exam, I was hitting 90+ on the accumulated score.  I think I’m going to be able to get this thing done without issue!  Or at least that is what I thought.  Half way, I’m down to 83%.  I wouldn’t say panic hit me, more than disappointment.  I took my break and regrouped.  Went outside with one of the proctors and walked around a bit.  Warmed up too; it’s cold in that room!  Getting back to the test, I fought through that thing and stayed pretty consistent.  In the end I ended up with an 84%.  Not too bad keeping that score and not dipping below the lowest checkpoint score of 83. 

Your Thoughts?

I’ll be the first to say, this exam is a definite challenge.  The practice exams provided seem to be exam preps for the Sec503, not the actual exam.  What do I mean by that?  I feel the actual exam seemed to be more targeted/focused instead of the “relaxed” content of the practice exams.  I can’t get into too much detail due to NDA, but details matter in this exam.  Overall, this was a great experience and welcome anyone who is willing to give it a shot.