The 2019 SANS DFIR Summit is over, but not forgotten. At least not for me – a first year attendee. I had a blast during the two day conference, and I hope to attend next year. Here are a few things that come to mind when thinking back on my two-day trip to Austin:
1. I had a front row seat to see and hear, what I’ve only experienced watching YouTube-replays of summit talks. I heard the passion each presenter had for the content they delivered.
2. I was exposed to different subjects outside of my comfort zone. One example was a talk on finding evil in Windows 10 compressed memory. It was new for me and I was in awe of the work put into this talk!
3. I spoke with different people in the community, each with a passion for what they do.
4. I absorbed the energy the summit brings to life in the DFIR community, and will use it to create momentum for myself and those I work with.
Expanding on points 4 and 5…
Point 4 – Meeting new people
It’s always good to shake hands with someone new, or with someone you’ve only connected with through social media. The former lets you learn about someone new, and possibly, something new. There are so many people working in the DFIR space that, getting to know someone and what they do can open up your eyes to new and exciting things. Perhaps, you’ll find a new interest during your meet and greet (topic within DFIR), and more importantly, you have the opportunity to make a new friend (someone in the private sector if you’re in government, or vice-versa).
If you’ve only communicated with someone over social media, then meeting face to face is a great thing to strive for. Social media posts are great for spreading thoughts far and wide, but personally, there’s nothing like meeting someone in person, and just chatting. It doesn’t have to be about DFIR – you can chat about your love for, let’s say… bourbon!
Point 5 – Inspiration and motivation through osmosis
I left the summit inspired and motivated to learn, dig-deep (research things known and unknown), and overall, get better at what I do. My goal is to bring inspiration and motivation to my teammates, so we can continue helping others, asking questions, finding answers, and reaching project goals. How did these feelings of sharing and caring take shape? Seeing others speak passionately about areas of DFIR. It brings out the best in the person absorbing the information.
It’s exciting to hear about the way someone went about researching a problem, and the excitement of finding new information. It’s exciting to hear about a new way of using existing information in a particular case-scenario, as well. For example, Heather Mahalik and Sarah Edwards presented on information that can be used to assist in distracted driver investigations. In addition, Alexis Brignoni and Christopher Vance presented on information left behind by mobile applications after they are deleted. I found the information to be very relevant to my casework. So, the presentations are definitely a source for motivation and inspiration when I return to work, and review analysis I’ve done to date.
By attending the summit, you’ll get a chance to hear the passion in everyone’s voice. People are very excited to share what they see and do in the community, and how they feel about helping others facing the same data sets or problems. My suggestion is – absorb that passion in the air, find your own passion, and dig in to something new. Or, take something old (I use this term loosely), try to look at the same problem from a different perspective, and try to find a solution. Ask questions, ask for feedback, and don’t be scared to… (insert your own end results such as – arriving back at square one, arriving at a different conclusion, a feeling like everything is falling apart).
We need a break from repetitiveness, protocol, standard operating procedures and policies. We need a break from responding to emergencies. We need a break in order to refill our tank with some unicorn magic juice, so we can continue to work effectively, and professionally with our teams. Much like the skills you can take back to work after a SANS class, I am walking away from the summit with momentum and inspiration. I will take both back to my lab, and support a focused work environment . Most importantly, I’m going to help my teammates enjoy what they do.
Persistent 4n6 