Don't underestimate a class that is "A mile wide, but an inch deep."

In a recent CEH class I taught, a group of students had an unusually broad background and motivation for taking on the course. One thing that impressed me a great deal was how well they seemed to understand this even before meeting each other. Everyone had healthy expectations, and were looking toward realistic outcomes, but at the same time I felt it was a challenge to make sure I could both fit the course for them and stay within the scope of the curriculum. We needed to pass the exam, not conduct an improvised 5 day Q and A session, though I was tempted to do exactly that.

This got me thinking a bit about something that recent trends I have noticed has brought to light about the way students and training programs evolve together.

I often say that "there are entry level info sec classes but info sec is not an entry level topic". I think the reality however is that as IT assignments branch out, security becomes an efficient solution for bridging and broadening a persons understanding of IT no matter what their background. Sometimes people take infosec classes not so directly for security information, but for the unusual point of view. It is very unsanitized, imperfect at times, philosophical, and demands critical thinking.

CEH paired with CISSP is in a sense, a way to be exposed to an encyclopedic knowledge of all of the basics, from techie to management, from data to packets, and from apps to hardware. Being a mile wide is perhaps harder in some ways than being a mile deep. These classes are incredibly challenging for precisely this reason. Every student will find one chapter, module or domain that they think has been simplified into silliness. They will also encounter a portion of the class that is so unfamiliar it may seem the instructor has begun to speak a martian language. Yet to those who work in that area, it is as simple silly as the other aspect of the course was.

The first step is figuring out the difference, the second step is reconnecting the dots.

As any technology advances a compression phenomenon occurs. What once took a career to learn and master eventually becomes required basics just to attend a 5 day bootcamp. "Assumed knowledge" at this point to even enter the discussion of information security is more than many people even care to know in what would be gained in a lifetime of experience in IT.

The goals of technical training therefore needs to adapt to this. Bootcamps such as what we offer are designed to demonstrate key ideas that help the disparate parts of day to day experiences come together. Its like finding the one piece of a jigsaw puzzle that helps connect too other vary large assemblies. Sometimes however, a student grasps this catalyst, but has to wait until some time down the road to realize why it is important.

One thing we can absolutely guarantee is that all of the effort placed toward this goal will become useful at some point. No knowledge in info sec is wasted, no matter how unrelated it might seem to a current assignment.