Last Day to Save $300 on Cyber Security Training at SANS Seattle Spring 2020! 7 Courses Available.


Washington, DC | Fri, Jun 14 - Sat, Jun 22, 2013
This event is over,
but there are more training opportunities.

SEC301: Intro to Information Security Waitlist

Mon, June 17 - Fri, June 21, 2013

  • GISF
  • 30 CPEs
  • Laptop Not Needed

I took SEC301 and really enjoyed it. It was a great refresher course. I learned in 1-day what previously took a whole semester and the instructor; Keith Palmgren made it very easy to understand.

Amanda S., U.S. Federal Government Military

Good basic information for someone just coming into the field.

Bryce Richert, SUH

This introductory certification course is the fastest way to get up to speed in information security. Written and taught by battle-scarred security veterans, this entry-level course covers a broad spectrum of security topics and is liberally sprinkled with real life examples. A balanced mix of technical and managerial issues makes this course appealing to attendees who need to understand the salient facets of information security basics and the basics of risk management. Organizations often tap someone who has no information security training and say, "Congratulations, you are now a security officer." If you need to get up to speed fast, Security 301 rocks!

We begin by covering basic terminology and concepts, and then move to the basics of computers and networking as we discuss Internet Protocol, routing, Domain Name Service, and network devices. We cover the basics of cryptography, security management, and wireless networking, then we look at policy as a tool to effect change in your organization. In the final day of the course, we put it all together with an implementation of defense in-depth.

If you're a newcomer to the field of information security, this is the course for you! You will develop the skills to bridge the gap that often exists between managers and system administrators, and learn to communicate effectively with personnel in all departments and at all levels within your organization.

Course Syllabus

Fred Kerby
Mon Jun 17th, 2013
9:00 AM - 5:00 PM


Information security is based upon foundational concepts such as asset value, the CIA triad (confidentiality, integrity, and availability), principal of least privilege, access control, and separation. Day one provides a solid understanding of the terms, concepts, and tradeoffs that will enable you to work effectively within the information security landscape. If you have been in security for a while, these chapters will be a refresher, providing new perspectives on some familiar issues.

CPE/CMU Credits: 6

Fred Kerby
Tue Jun 18th, 2013
9:00 AM - 5:00 PM


To appreciate the risks associated with being connected to the Internet one must have a basic understanding of how networks function. Day two covers the basics of networking (including a review of some sample network designs), including encapsulation, hardware and network addresses, name resolution, and address translation. We explore some typical attacks against the networking and computing infrastructure along with appropriate countermeasures.

CPE/CMU Credits: 6

Fred Kerby
Wed Jun 19th, 2013
9:00 AM - 5:00 PM


Cryptography can be used to solve a number of security problems. Cryptography and Security in the Enterprise provides an in-depth introduction to a complex tool, (cryptography) using easy to understand examples and avoiding complicated mathematics. Attendees will gain meaningful insights into the benefits of cryptography (along with the pitfalls of a poor implementation of good tools). The day continues with an overview of the security organization in a typical company. Where does security fit in the overall organizational scheme? What is its charter? What other components of the larger organization must it interact with? We conclude the day with a whirlwind overview of wireless networking technology benefits and risks, including a roadmap for reducing risks in a wireless environment.

CPE/CMU Credits: 6

Fred Kerby
Thu Jun 20th, 2013
9:00 AM - 5:00 PM


Day four will empower those with the responsibility for creating, assessing, approving, or implementing security policy with the tools and techniques to develop effective, enforceable, policy. Information Security Policy demonstrates how to bring policy alive by using tools and techniques such as the formidable OODA (Orient, Observe, Decide, Act) model. We also explore risk assessment and management guidelines and sample policies, as well as examples of policy and perimeter assessments.

CPE/CMU Credits: 6

Fred Kerby
Fri Jun 21st, 2013
9:00 AM - 5:00 PM


The goal of day five is to enable managers, administrators, and those in the middle to strike a balance between "security" and "getting the job done." We'll explore how risk management deals with more than security and how the ISO-OSI model may have an eighth layer (political) impacting communications and transmission. It is replete with war stories from the trenches that illustrate the TSP protocol (the Tie to Sandal Protocol) used by successful security professionals worldwide.

CPE/CMU Credits: 6

Additional Information

Here's what recent attendees had to say about this course:

This class is great for IT professionals looking for their first step towards security awareness. I have been in IT for 17 years and I learned a lot on this first day of class. - Paul Beninati, EMC

Good basic information for someone just coming into the field. - Bryce Richert, SUH

It's a very good course if you need the basic foundation. It's a very helpful class to take because it expands on some basic concepts. - Shruti Iyer, DCS Corporation.

  • Persons new to Information Technology (IT) who need to understand the basics of information assurance, computer networking, cryptography, and risk evaluation
  • Managers and Information Security Officers who need a basic understanding of risk management and the tradeoffs between confidentiality, integrity, and availability
  • Managers, administrators, and auditors who need to draft, update, implement, or enforce policy
Which Course Is Right For You?

This is the track SANS offers for the professional just starting out in security. If you have experience in the field, please consider our more advanced offerings such as Security Essentials, SEC 401.

  • Discuss and understand risk as a produce of vulnerability, threat, and impact to an organization
  • Understand and apply basic principles of information assurance (e.g., least privilege, separation of risk, defense in depth, etc.)
  • Explain the fundamentals of networking (link layer communications, addressing, basic routing, mas- querading)
  • Describe the predominant forms of malware and the various delivery mechanisms that can place organizations at risk
  • Understand the capabilities and limitations of cryptography
  • Evaluate policy and recommend improvements
  • Identify and implement meaningful security metrics
  • Identify and understand the basic attack vectors used by intruders

Author Statement

A good friend of mine once said, "A little security is better than no security." If your organization is in either situation (little or no security) and you want to make a difference in a positive way, this course is a great place to start. If your organization has already made an investment in security, this is a great opportunity to compare notes with others and identify how to maximize the return on your investment. Twelve years ago I agreed to fill the position of "number one spear catcher" (the head security guy) for our organization. I asked about training and my predecessor told me that the agency would provide training, but suggested that I work for six months to get some "real-world experience to compare against the theory." It was a long and frustrating six months and the training was less than helpful. A few years later when SANS offered to let me help write and teach this course, I literally jumped at the opportunity. Every time I teach it, I'm excited and I enjoy it as much as the attendees. It's been very gratifying.

- Fred Kerby