2012 SANS DFIR Summit Wrap Up

Last week I had the opportunity to attend the 2012 SANS Digital Forensics & Incident Response Summit. It was held in Austin, Tx at the Omni Downtown Hotel for a second consecutive year. First thing I want to say is that this is my third consecutive DFIR Summit. I did not think they could top last year’s offering. Boy was I wrong, dead wrong.

The Summit started off with Cindy Murphy’s most excellent Day 1 Keynote (intentional Bill & Ted reference). She talked about how we sometimes need to step back from our examinations to see the big picture and how data without context is just data. She had a great quote from Helen Keller, “It is a terrible thing to see and not have vision”. It was very inspirational presentation and has motivated me to reflect on who my “monks” are. If you haven’t had a chance to check it out yet, make sure you do (http://computer-forensics.sans.org/summit-archives/2012/6-blind-monks.pdf).

I have to say that I enjoyed all of the talks that I attended, but the ones that stood out for me were:

As far as the SANS360 talks (http://computer-forensics.sans.org/summit-archives/2012/dfir-sans360-talks.pdf) went, I think they were all great.  6-minutes each (roughly) and to the point.

The one thing I’d like to complain about is the fact that there were two tracks this year. The one thing I’d like to commend is that there were two tracks this year.  Confused?  Well, it stunk that I had to miss a few talks because I was attending others. That said, it was great because it gave the opportunity for more people to present. Good thing the slides are available online.

The only real complaint I’ve heard about the Summit was from the folks trying to follow along at home.  Apparently, the live stream kept cutting in and out due to issues with the hotel’s network. Hopefully, that issue is squared away for next year and the remote viewers have smooth sailing.

I will echo what others who have reviewed the Summit have stated. The other best thing (aside from the presentations), was the chance to meet other DFIR Community members. There were a lot of new faces in attendance this year. It was great to meet people I’ve spoken with, helped or had received help from online. When it comes to the DFIR Community, I feel like I don’t have just colleagues, but that I am part of a family. I hope that our close knit ways continue in the future.

The video presentation from the Closing Remarks (http://www.xtranormal.com/watch/13533924/closing-remarks) was epic!!!

I just want to thank Rob Lee & the Staff from SANS that helped to put together and run such a great conference!!!

You can leave a response, or trackback from your own site.

Leave a Reply

Subscribe to RSS Feed Follow me on Twitter!