Leadership Laboratory

Leadership Lab: Interviews with SANS Technology Institute College Graduates

A series of interviews with SANS Technology Institute College graduates

Interview with T. Brian Granier, Second Graduate of SANS Technology - September 19th, 2007
Interview with Richard Hammer, First Graduate of SANS Technology Institute - March 31st, 2007

Interview with Richard Hammer, First Graduate of SANS Technology Institute

March 31st, 2007
By Stephen Northcutt



Richard Hammer is the first graduate of the SANS Technology Institute, a post graduate information security college. Stephen Northcutt spoke with Richard to get more of his story about the experience of earning his degree from STI.

Richard, what made you think about going back to school to get your Master of Science in Information Security?

I have worked at Los Alamos National Laboratory (LANL) for over 20 years with a Bachelor of Science Degree. Los Alamos and LANL has one of the highest percentages of PhDs per capita in the country and a Bachelors Degree does not carry much clout. I started as a technician and have risen through the ranks to be a Technical Staff Member. I worked hard enough to be promoted to the team leader level and have performed those duties for most of the last ten years. That is the highest realistic level someone with "just a Bachelors Degree" can achieve. Over the years I had looked at different degree programs but never found one that would fit my life style and experience level. The last ten years I have been in the awkward position of being able to teach a lot of the material in the advanced degree program but not having the document to prove it.


There must be a hundred programs offering Masters in Information Security, why choose the SANS Technology Institute?

One of the ways that I have stayed technically sharp over the years has been SANS training. I started attending SANS conferences in 1998 and feel that it is the best system and network security training available. Over the years I have stayed active supporting SANS by reviewing course material, writing exam questions and serving on boards (GCFW Chair/Vice Chair & Advisory Boards). I was excited when I heard that SANS was going to offer an advanced degree plan, finally a distance learning program that would add value more than just getting a piece of paper.

I applied and was accepted into the SANS Technology Institute's Masters Program in late January 2006. I set a personal goal of being one of the first people to graduate from this program and structured my life to achieve that goal. I could no longer put in the hours required to be a good team leader so I stepped down from that position. Over the years I have accrued almost 400 hours of vacation and that allowed me to take off work to travel to the residential institutes. I did not purchase the new ZX-14 motorcycle that I wanted so I could afford the cost of training that LANL would not cover. My children are old enough that they can stay by themselves and do not mind me traveling as much as they did when they were small. Having a couple gold certifications allowed me to have a little head start on the program and I set out to achieve my goal of being one of the first graduates and helping the SANS Technology Institute (STI) receive accreditation.


Wow, you gave up a lot! For folks that are not familiar with the academic accreditation, an institution cannot even apply for accreditation until the first cohort of students graduates. So, was it worth it to you Richard?

I have derived many benefits from the STI program. I feel very "technically sharp" after completing the core technical courses and that has helped me in my current position at LANL and teaching the network courses at the College of Santa Fe. I like the fact that the STI community requirement takes the students out of their comfort zone and forces them to perform. I thought the most challenging part of the program was the Joint Written Project. Not that it was technically difficult but it required coordinating and working with another person. Having people in different time zones, with demanding jobs, taking classes, and trying to live their lives around the "Joint Written Project" was difficult. I had a great partner, but still spent many late night hours talking on the phone and exchanging e-mail trying to supply a quality product.

Being a former high school teacher and teaching at College of Santa Fe (CSF) has allowed me to feel comfortable presenting to audiences. The most surprising benefit I achieved from the program is the time that Alan spent with me putting together my Network Security 2006 Las Vegas presentation. He made me look at the presentation in a completely different way. I was amazed at how available Alan made himself during the weeks that he helped me on my Las Vegas presentation. The time he spent with me has made a lasting impression and I hope to implement the concepts he shared with me anytime I put a presentation together from this point on. I truly wish that he would have worked with me before my first presentation so I could have implemented his concepts on my own for the second presentation.


So you have accomplished what you set out to do, you have a Master of Information Security degree. What will you do next?

Now I can focus on what I think it can do for me. I am very happy and satisfied in my current position at LANL and will not receive any extra compensation for the advanced degree. Money or changing positions was not my motivation when I started the SANS Technology Institute (STI) program; I wanted to prove to myself that I could do it! I believe that both LANL and I have benefited from my completion of this program. I also believe that having the MSISE degree from STI will make people recognize my technical understanding of system and network security issues. I want to remain on the technical end side of LANL but want to influence the policy side.

I have always wanted to teach and having the advanced degree will give me more options. I have been successful teaching at the College of Santa Fe and want to continue teaching there, but if something changes, this degree will expand the range of places I can teach. I feel very fortunate that CSF allowed me to teach with "just a Bachelors Degree." My teaching marks have been very high over the years and they have been rewarded for giving me a chance.

I am proud to be associated with SANS and happy that I can be one of the first people to graduate and help STI achieve full accreditation. I do not want anyone to question the quality of the program or my skills. That is why I have had all the exams proctored and took the extra UNIX course (wanted 30 hours). This is a good program and I want NO questions about STI first round of graduates.

You have been a wonderful student, and it is clear from your own words, really more of a partner. You and I have talked about founding an alumni program and we hope you will remain active with SANS and STI. What are your thoughts on that?

After I complete the MSISE degree I will remain active in SANS, I really do believe it is the best system and network training available. I am already involved in helping review course material and exam questions and will continue as long as Jeff Frisk needs my assistance. I would also like the opportunity to teach SANS training occasionally. I think I can show that I am a capable instructor and can give SANS another capable trainer.


Needless to say, any fledgling program will have issues. What are your recommendations for changes to the program?

The things I would change if I had the power:


Richard, you have mentioned SANS a lot, but let me ask you something. You know GIAC better than most people; can you comment on the strengths and weaknesses of the GIAC program and, please, be straight with us and share straight from the gut.

The people that run GIAC are GREAT! I have spent many hours working with them and have seen a dramatic improvement in the exam review/challenge process. When I first started taking the exams (1999/2000 time frame) you never heard back on exam questions that were challenged. Now you not only hear back quickly, but you are involved in a dialog on what would make the question clearer, fairer, or more technically accurate. I have gotten to know the people that work for GIAC very well, they are quality people. GIAC has really come a long way since my first exam.


You took a lot of courses, may we ask which Course was most valuable?

SEC504 Incident Handling and Hacker Techniques! This gives the student a really good idea of the threats a network faces and how to respond to them. Had I not taken SEC401: Security Essentials before I started the program I would have listed it as the most valuable because it gives an overall foundation that all students must understand.


You want us to move the credit hours back to 30 hours and we have done so. We have not increased the credit hours assigned to the community project though we will be evaluating that in the future. We really believe in the community project part of the program. Which of the Community Project Requirements was most valuable for you?

I found all of the community requirements really helpful in order to grow, but the second presentation was the most valuable for me. I have always felt like I presented well, but working with Alan on the second presentation raised the effective communications bar for me. I am really enjoying presenting in front of audiences right now!


Richard, as you know, our mission is to develop the information security technology leaders needed to help strengthen the defensive information community all over the world by improving the security of cyberspace. SANS seeks to prepare both the managers of information security groups and the technical leaders who direct security technology programs. SANS Technology Institute's primary functional emphasis is instruction, but the Institute faculty and students will engage in research and public service programs that contribute to the learning process. Can you comment on your development as a leader? You helped break in new courses and you were supportive at all times. It feels like we got the better deal here, but can you share the single most important thing you learned about leadership?

I have been a team leader for many years and know being a leader is difficult. The STI program does a good job of not only giving students the technical ability to make sound technical leadership decisions, but forces students to deal with leadership roles that are difficult. This is a difficult program that requires intestinal fortitude to finish. The community projects are designed to remove the student from their comfort zone and see how the student handles pressure and unusual situations. For instance, the "Group Discussion and Written Project" requires multiple students (all wanting the leadership role) to choose one person to present. The entire group grade hinges on the presentation: the decision on who would present was very difficult and truly required leadership ability from all involved. I feel very fortunate that my partner was a strong leader and we were able to determine the tasks that maximized our team's chances for success. I think that is really what leadership is all about, maximizing the team's chances for success.


Any last thoughts, any thing you want to share?

Finally, I do think that the MSISE degree will open doors for me that would not be available otherwise. I have no idea what those doors will be but will certainly be happy when I see them. And of course, there is absolutely no problem that a long motorcycle ride will not solve.