Security Laboratory

Security Laboratory

Computer Security Training and Education

This series will look at the many perspectives of network and computer security training and education, what works and what doesn't.

Other Related Articles in Computer Security Training and Education


What it takes to be a computer security instructor for SANS


By Stephen Northcutt

People ask me about teaching for SANS several times every month. The purpose of this essay is to show you the path.

Promotion In House

The majority of people that teach for SANS started by taking a SANS course and signing up for the corresponding GIAC certification. If they score 85 or higher on their exam, they receive a note inviting them to become a mentor. If you have ever studied to prepare to teach a course, you know how much you end up digging into the material. Mentor courses are usually held in the evenings, once or twice per week. The Mentor develops confidence in his or her ability to field questions and execute demos and help students with laptop and other configuration problems. Mentors are expected to help market their programs using mailing lists, Facebook, Twitter and their blog.

Successful mentors have the opportunity to move up to Community SANS. This is stand up teaching using the same slide deck that is used at SANS Conferences. We limit the class size and help train you to teach with our own internal proprietary methods. An experienced instructor will be on call if you run into snags, but it is up to you to perform. In a sense, this is similar to flight school, at some point you have to solo. After a time at the Community SANS level, you get invited to try out at a regional conference. Make sure you know your material and prepare your delivery, because this is a critical step. Any student that has been to conference before is going to be comparing you to instructors like Eric Cole and Ed Skoudis. If you are successful at two conference events, and successful includes the number of students you have (so keep developing those course marketing skills,) you can move up to SANS Certified Instructor.

Promotion From Outside


This is rare, but it does happen. If you are a well known name in the security market and a skilled instructor, we may be able to bring you in directly. Please understand this is fairly rare and there are failures here, many people think they are a better communicator than they actually are.

Promotion By Authorship


There have also been times where someone writes or develops a course that has such unique knowledge requirements that they are the only qualified person to teach that course. These courses tend to be fairly specialized and attendance numbers are lower so compensation may not be as attractive, but it can be a way to get a foot in the door. This can also be attractive to people that have developed their own course and come to the realization that the time they spend booking hotels, printing and shipping books, registering students and dealing with payment issues takes time away from what they love doing, information security. In some cases, we can handle all of that for you.

The bottom line. I am not going to kid you, the bar is pretty high and we expect a high degree of professionalism. I have taught sick, taught after flying in from Europe only a few hours earlier, taught while a relative was dying. On the other hand, each and every SANS instructor in the speaker ready room is a great person to know, friendly, helpful, knowledgeable and competent. They are contacts that can help you in your career for years to come. SANS is generally considered the best mainstream security training outfit and, while it is a lot of work, I think you will find it worth it to be associated with the organization.