SANS Blacksburg, VA Day 2 / Lecture 1

I wandered out of bed around 8:20. I scarfed down some food and drove off to VT for the day. When I arrived, there was a large line for WiFi card registration, which I skipped. When I entered the auditorium I quickly discovered there were far more people than effective workspace. Around 240 people were in attendance.

Mike Poor is an knowledgeable and entertaining speaker. Much of the day was spent on a discussion of IP, ICMP, UDP, and TCP. We were exposed to a lot of tcpdump capture output. Microsoft network configurations and VPNs were also briefly discussed.

At 10:30 we took a break. There were bagels and juice. I waited in line to have my WiFi issue addressed, not knowing it was actually auditorium wide. I snagged the last orange juice bottle, which had a strong taste to it. The bagels were of mass reheated quality.

It became apparent early on that the WiFi setup was not sufficient for the large number of users and it quickly failed for many.

Not long after our return a campus wide fire alarm went off. Instead of a loud alarm we were greeting with a more tranquil warning. After a moment of confirmation everyone was asked to leave the auditorium, laptops in hand. I snagged my bagel, notebook, and laptop and wandered out into the mild weather. There were still patches of snow on the group from the previous week’s snow storm. After a time, the warning was cleared and we reentered the auditorium. We broke for lunch at 12:30.

I drove by Anthony’s for lunch, but John wasn’t there. Disappointed, I eventually stopped at Domino’s on the way back to campus and had a mediocre pizza and somewhat stale Pib Exteme Ultra Platinum soda. I drove back to campus and ate some of my pizza, tossing the rest as I went back inside. There weren’t enough visible seats and the presentation had begun anew, so I sat on the stairs until the next break. We looked at more packet dumps.

I wandered downstairs for break and bought a fake fruit juice drink with 1% juice. It was mildly good, and artificially sweetened. We finished off class at around 5:30.

The evening BOF session in the Alumni Hall was informal and spoke on a searching baselining tool that scored your machine out of a normalized maximum of 10. The tools, provided by the Center for Internet Security, are available for download and redistribution within the confines of government entities, if you are a member of a government entity. You can still download, but I don’t believe you can restribute, if you aren’t a member of a government entity. I read through a draft that was available for the upcoming next version of the Solaris Benchmark tool.

Immediately after, back at Torgersen Hall, was a MacOS Tiger presentation. I struggled to stay awake, although the features in Tiger sound interesting. The speaker seemed to have his target audience off somewhat. He spoke much about Apple abstracting interfaces so things like security credentials can be card swipped without application software having any knowedge of the card reader itself, just hooks into the abstraction layer to become aware that new security credentials are available. It was neat to watch, but not ground breaking. It was only a Tiger beta, so some things crashed.

I bussed some people back to their hotels and went to bed.