Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a programmer, doing mostly web development now, dealing also with securing the web applications in my line of work. I have reasonable knowledge of security matters, though not always staying up-to-date on the latest developments (mainly due to laziness and lack of time). I'm not doing any pen-testing and not plan to specialize of security only, though I of course want to keep my projects secured.

So, from this point of view, is it worth for me to do SANS training - I specifically mean training courses like DEV522 or SEC542? Would they add enough to my knowledge that it would justify a week spend on them (and the money of course :)? I took their free assessment test and made 92% without any preparation and in half of alotted time (missing ones I suspect are some acronyms that are outside of my line of work), but not sure if that means anything.

Especially interesting would be to hear from people of similar background that went to one of these courses or similar ones.

P.S. I understand this is somewhat subjective, but given the info on the background I think there are many people with similar background that may use such information. I just want to try and estimate the level of the course against the level of average security-conscious programmer.

P.P.S. For suspicious minds: I have nothing to do with SANS and don't know much about them, I'm posting the links only so it will be clear what is being asked about. But I like the way you think :)

share|improve this question

closed as primarily opinion-based by Jens Erat, Xander, Neil Smithline, Mike Ounsworth, Ohnana Dec 12 '15 at 2:55

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

Hard to say if its worth it, without knowing your intentions. What do you want to do with it? Do you want to work in infosec, are you hoping this help you get a job? Are you thinking this will help your projects be secure (it wont, you'd be better off just learning the stuff without the cert...)? – AviD Jul 24 '11 at 0:47
@AviD As I said, I do not plan to specialize on infosec. I already have a job. I am hoping to upgrade and update my knowledge of security matters as it pertains to creating secure web applications. I am however not looking for certs and not looking for basic "what is XSS" type of courses, but rather in-depth stuff that would tell me something I didn't know before - new techniques, new threats, etc. So my question is are these ones worth it for expanding my knowledge - and maybe if not, what one would recommend instead. – StasM Jul 24 '11 at 5:19
up vote 6 down vote accepted

My subjective opinion is that these particular courses are not worth it for you.

These courses are expensive at $4,000+ per course. They are highly structured and compacted into a short time period. These courses are perfect for someone who needs to learn a lot quickly and will do well in a structured intense formal environment.

Based on the assesment test you appear to know a good bit of material. You don't seem to be in a hurry, and it looks like you are more interested in learning how to write good software than earning a certification or writing security papers. (I have a security certification, and I like reading security papers.)

In my opinion learning to write secure software is best done by writing software, having peers review it, testing it, discovering vulnerabilities, and fixing the vulnerabilities. Don't assume that it all has to be done for your employer. Follow announcements and news at OWASP or or Dark Reading. Contribute to a honeypot project. Read and answer questions at

It takes time for security knowlege to be collected, ordered, and formatted for classroom teaching. While some instructers will throw some of the 'latest developments' into their classes, most of the class will be well vetted security knowledge.

I think that the classes have value, just not for you.

share|improve this answer

I've taken SANS courses, they are fantastic assuming you have the proper foundations going into the particular course.

Not worth $4000+ of your personal money, but definitely worth campaigning your manager or company to pay for.

share|improve this answer
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. - From Review – daniel Azuelos Dec 24 '15 at 10:55

protected by schroeder Dec 11 '15 at 19:28

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.