Meet Erik Van Buggenhout. Erik is the co-author of SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses. In addition to SEC599, Erik teaches SEC560 - Network Penetration Testing & Ethical Hacking and SEC542 - Web Application Penetration Testing & Ethical Hacking. He has been involved with SANS since 2009, first as a Mentor, working his way to Community Instructor in 2012 and finally becoming a Certified Instructor in 2016.
Erik loves explaining deeply technical concepts by using war stories, adding a few funny anecdotes here and there. As a testimony of his technical expertise, he has obtained the GSE, GCIA, GNFA, GPEN, GWAPT, GCIH, and GSEC certifications.
In addition to his work with SANS, Erik is the co-founder of Belgian cyber security firm NVISO, which focuses on high-end cyber security services, specializing in government, defense and the financial sector. Together with his team of 20+ technical experts, Erik delivers a wide array of technical security services, including penetration testing, security monitoring & incident response.
SANS: What made you choose to work in tech/security?
Erik Van Buggenhout: It's quite typical really: My dad was a consultant for Digital Equipment Corporation and I was always fascinated by everything he did with those computers. He allowed me to play around with his corporate computer whenever he was home from work. I fondly remember a moment where I accidentally deleted Minesweeper from Windows 3.11 and I thought I had really broken it. I was so shocked! Thank God he fixed it afterwards!
SANS: Tell us an interesting fact about yourself and your connection to the technology world?
Erik Van Buggenhout: Between 2014 and 2015, I had a fully operational ATM in my apartment. I used it to do research around ATM attack vectors with a focus on malware attacks (with the ultimate goal of dispensing cash). I succeeded in a few weeks' time, but as it only had "fake" notes, my girlfriend was not pleased!
SANS: What was your first SANS course?
Erik Van Buggenhout: The first SANS course I ever took was back in November 2008, when I took SEC560 in London. At the time this was the first "offensive" course offered by SANS, and back then the London event was the only one that SANS held in Europe. It was led by John Strand and Pieter Danhieux. To this day I still suffer a trauma from that event, as I did not manage to win the Capture the Flag event on day 6 (I was stuck at the final hurdle!!). Since then, I've had to confess to my SEC560 students that I never won the coin myself!J
SANS: What SANS event are you looking forward to most this year?
Erik Van Buggenhout: As I only recently became an author for SANS, I haven't had the chance to teach at any of the big US events (SANS 2018 in Orlando, SANSFIRE in Washington, Network Security in Las Vegas and CDI in Washington). I'm very much looking forward to these events and getting a taste of how these events are run!
SANS: How do you stay up-to-date with the latest cybersecurity information? Social media influencers, hashtags, blogs? Give examples.
Erik Van Buggenhout: I try to attend a number of conferences on a yearly basis. Examples include the Security Analyst Summit, FIRST, and Defcon. Below is a list of some of the people I follow on social media. I tried to stay away from the usual suspects (other SANS Instructors) and big-shot names everyone already knows like Brian Krebs and Mikko Hypponen, who I of course follow as well:
- Florian Roth (@cyb3rops) — Blue team — Incident Response & Digital Forensics
- Didier Stevens (@DidierStevens) — Malware analysis
- Costin Raiu (@craiu) — APT hunting and malware analysis
- Andrew Case (@attrc) — Core Volatility developer
Furthermore, I've learned that as a SANS Instructor we are in a very interesting position because we talk to many different people with diverse backgrounds every time we teach. I try to talk to students as much as possible, as this helps broaden my view and I usually learn a thing or two while teaching the class. So talk to people around you!
SANS: Advice for someone taking a SANS course for the first time? Attending their first event?
Erik Van Buggenhout: If you've never taken a SANS course before, I would advise you to prepare up front. SANS is very transparent on what types of topics are handled throughout the week — the full day-by-day course contents are listed on the SANS website. So you can already prep and think of questions you may want to ask the instructor. It will also help you prepare for possibly more complex sections of the course, where you know you might struggle and need some more preparation time.
SANS: What is a quote that inspires your work and why?
Erik Van Buggenhout: I'm not the type to use "inspirational quotes." But as I like to think of myself both as a hard worker and a fun person to hang out with, I would go for something simple like "Work hard, have fun, no drama."
Erik a self-confessed speed walker, if you see Erik rushing around at a conference: feel free to stop him and say "Hi!"
To learn more about Erik and where you can take his next course — visit his SANS bio page: https://www.sans.org/instructors/erik-van-buggenhout/date/asc
Follow him on Twitter @ErikVaBu