SEC504: Hacker Tools, Techniques, and Incident Handling

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsThe coins - more precisely, Round Metal Objects (RMO) - were initially created to recognize students who demonstrate exceptional talent and significantly contribute to, and lead, the cybersecurity profession and community. The coins are meant to be an honor; they're also intended to be rare. SANS Institute uses the coins to identify and honor those who excel at detecting and eradicating threats, those who understand the critical importance of cybersecurity and continually strive to further not only their own knowledge, but the knowledge of the entire cybersecurity field. These students actively share their experiences and encourage learning through participation in the community; they're typically leaders in the community.
The challenges through which students can earn a coin are typically held on the last day of class for a SANS course. Students compete in a Capture-the-Flag (CTF) or Capstone Challenge and must successfully overcome a number of obstacles to prove their proficiency during timed, hands-on incidents. The CTFs and Capstone Challenges are created by SANS' top instructors - each one a cybersecurity practitioner, subject-matter expert, experienced teacher, and professional leader in their own right.
Each SANS Institute Curriculum features different coins.
Those who are awarded SANS Challenge coins are also bestowed special privileges and recognition, including participation in the well-regarded "coin check" challenge and response.
A coin check typically begins by a challenger holding his or her coin in the air or slamming it on a table and yelling "coin check!" All those within earshot must respond by showing their coins to the challenger within 10 seconds. Anyone who fails to do so must buy those who successfully returned the coin check a round of drinks. If all the challenged coin holders produce their coin, the challenger must buy the round of drinks. (Also, if anyone accidentally drops their coin and it makes an audible sound on impact, they have "accidentally" initiated a coin check. There are no exceptions to the rules - get those coins out or you're buying!)
An Operational Cybersecurity Leader will be able to:
A Transformational Cybersecurity Leader will be able to:
Already been awarded a coin in the Digital Forensics & Incident Response Curriculum? Find your name on our list of winners.