SANS offers several training formats to accommodate many leaning styles, but I feel the least well-known is the SANS Mentor format. This post aims to provide a bit of insight and details of the Mentor course format, structure, and benefits.
What is a Mentor course?
A Mentor course is instructor led SANS training that is delivered over a multi-week period where the course will meet once per week. The course sessions are typically 2-3 hours and last for 6-10 weeks, depending on the instructor’s preference, for a total of ~20 classroom hours of instruction. It covers the same course material that you’d receive from any of the other SANS formats, including books, mp3s, labs, CTFs, and ~30+ CPE credits. With only 20 hours of teaching (as opposed to the 36+ hours at a conference), the instructors focus their teaching on what they think are the most relevant, interesting, or difficult parts of the course, and expect the attendees to read the material/perform the labs that was not covered during the weekly session.
What are the benefits of a Mentor course?
There are many benefits to choosing a Mentor course, but here are what I consider the big ones:
Cost – Since prices are always changing I won’t put down any hard numbers, but I typically see that Mentor courses cost ~$1,000 less than the other formats. Additionally, Mentor courses typically offer two discount specials: 1) Three for two – Pay for two attendees and get a third free. 2) If an organization agrees to provide a location for the course to be taught (and the instructor accepts), the hosting organization can send one attendee for half price. Outside of the cost of enrollment, there are no additional costs of travel, lodging, rental car, etc.
Location – Mentor sessions are taught in the local community, so if you are in a geographic location that doesn’t have a major SANS conference come to town, you can still get the same training without having to travel.
More time to absorb material – People often say that taking a course at a SANS conference is like “drinking from the fire hose”, implying that you are getting a ton of information in a short amount of time. While that statement is usually meant as a compliment to SANS, wouldn’t you rather drink in that same information comfortably from a cup? With the course material spread out over several weeks, the mentor format allows you to do absorb the information at a comfortable rate.
Outside working hours – As the sessions are held outside of working hours, you won’t have to sacrifice any time off to take training.
Interaction with the instructor – This one is big. Mentor sessions gives the attendee an opportunity to interact with the instructor much more than at a SANS conference. The smaller class size allows for more questions, and the instructor is much more accessible. Communication and questions are encouraged. For example, I give the attendees my email address and phone number, and make it clear that they can reach out for anything. During the course if I see any news articles, tweets, or blog posts relating to the course’s topics, I’ll send the class an email letting them know, and encourage communication among the group. Many instructors create Slack channels as an alternate way to encourage communication between attendee to instructor as well as attendee to attendee. The flow of communication goes both ways, which is great for the class (and the instructor).
Longer Virtual labs/CTF access – When taking training at a conference, you only have access to the virtual lab environment and CTF while at the conference. With a Mentor course, you gain lab access during the first week of the course, and maintain it for four months after the course ends. That gives you plenty of time (~six months to lab it up and do the CTF multiple times.
What are the cons of a Mentor course?
As you’d expect, not taking the course at an official conference means no complimentary NetWars, night talks, ice cream, T-shirt, or anything that is specific to conference events. Additionally, it requires some self-study, as the instructor doesn’t have the time to 100% of the course material.
Where can I find more information about attending or teaching Mentor courses?
You can find more information about the Mentor program here, including courses being offered in your area. If you live in the San Antonio area, I’ll be teaching SEC560: Network Penetration Testing and Ethical Hacking in October 2019.