Networking is way more than connecting computers together

It is time for you to talk to another DFIR human in real life

One of the very few things that I will miss from the past two years is the wealth of online training and videoconferences that were available. It was such an amazing time of resources where every vendor, every expert, and every organization went online to share more information and research than any one person could consume in a lifetime.

From being able to physically attend maybe two or three conferences a year in prior years, many of us were able to attend an online conference once a month, plus a full online courses, and plenty of webinars. I will admit, there was a point of overload to catch a conference while still trying to maintain a reasonable workload, but the travel time was eliminated.

During those years, I presented at some of the online conferences, fully attended other online conferences, and lurked in as many conferences as possible in between cases. One of the biggest benefits that I found was discovering vendors and technologies new to me. The other obvious benefit was of course racking up training hours to document on my resume.

Coming around the 2020 corner

Well, I’m sure you have noticed the reduction in the number of online conferences and training as compared to one year ago. Organizations have already been heading back to the physical conference venues. This includes training courses as well. Unfortunately, the number of hours I will be able to attend from now will be much less than when everything was online. That is little bit of a bummer.

The biggest benefit

I learned many years ago that the biggest benefit to physically going to training courses and conferences is networking. For many years I attended conferences for the sole purpose of learning something that I did not know to improve my job. I didn’t speak to anyone because I focused on the presentations and learning. This started back in my law enforcement days of attending conferences to learn investigative skills, use of force skills, and other criminal procedure topics that would help me my job.

For years, I did not have any intention of networking at these conferences, even as I was being told by more senior people that networking was the most important. Learning the skill is important, but networking is more important. I realized that years later after contacts that I had made in conferences helped me in my job in ways that nothing else would have. The same connections allowed me to help others in their jobs and investigations in the same manner.

By the time I was beating the DFIR door down to let me in, I made sure that my first conference was all about networking. I don’t mean networking as in cables and DNS, but networking as in trading business cards and email addresses.

Weird

The first physical conference I went to after all these lockdowns was Techno Security in Myrtle Beach. There were so many people that I wanted to meet for the first time after so much chatting with them online, that I didn’t have time to meet them all. Some resulted in a quick quarter second hug with a promise to meet up later, only to be derailed by other networking events. I wished other conversations lasted hours.

After speaking with people online during these past two years who have never met before, it was weird to meet them in person. Weird because, I’m sure I am either shorter or taller or smaller or bigger or younger or older than anyone expected, as was everyone to me. And t didn’t even matter. What mattered was getting to know people in real life.

Upcoming conferences

There are a few upcoming physical conferences and hybrid conferences coming up. One is the new ResponderCon, put on by Basis Technology. Let me digress a second about ResponderCon. While at Techno Security in Myrtle Beach, I had the pleasure of sitting with Brian Carrier and got the first word about his new conference ResponderCon. An online conference would have been impossible to speak to and meet Brian to hear details of his new conference coming up this year. Side note: Brian is cool.

Even during Techno Security conference, I had the pleasure of speaking to Amber Schroader and she has her PFIC conference coming up really soon. Amber, in my opinion, has a good idea of a hybrid conference because at least then I can probably make it virtually instead of not being able to make it at all. Another side note: Amber is also cool.

Here is something about all of these DFIR conferences is that there is typically one person who is a major driver of the conference. The stress, pressures, expenses, deadlines, marketing, arranging venues, and herding speakers is not for the faint of heart. The organizer must have a huge heart to do this. I know this to be true because I have put on a conference as the main driver. I fully appreciate every organizer who does this. I’m not saying that I have a huge heart but am saying I know the stresses and that the person must care a lot for the conference to be successful for the benefit of all attendees to learn something valuable.

Tips on going to a physical conference

• Personally speak to people because this is a great opportunity you can get otherwise
• sincerely offer to help others in the future rather than ask for help from others
• assume that the person that you want to speak with will want to speak with you
• assume that the person you want to speak with doesn’t see you in the crowd
• assume that the person you spoke with online will not recognize what you look like in real life
• assume that one person you meet will be the biggest mutual help to each other in the future
• assume that every speaker wants to know if their presentation was beneficial to you
• assume that everyone wants your blog URL on your business card
• assume that you will forget everything that you hear, so take notes constantly
• assume that you will speak to someone who knows much more than you that you can learn from
• assume that you will speak to someone who knows much less than you, who will be able to learn from you
• show up for the presentations and sit up front
• assume that the person eating by themself would love for you to sit with them. Just ask.

Tips on a virtual conference

• other than learning the content, engage in the chats
• engage in the Q and A after the presentations

You can see the differences between the physical in a virtual conference or training session. Another benefit to physical conferences, is having a connection to others who attended the same conference. Things like,” oh yes, we were at the last Techno Security conference held at Myrtle Beach,” or we met at the first ever ResponderCon conference, or "Nashville was awesome at PFIC 2020!"

Another benefit of the physical conference is being able to connect with someone you did not speak with at the conference, but can reach out in the future by simply saying, “I was in your presentation in Las Vegas last year, and I have a question for you…”. It is a little bit different by saying that if it was an online conference that you attended. I say that as one who has spoken physically and online at conferences, and one who had attended physically and online.

Training hours

Documented training hours is important. I believe that. I also believe that the things that you learn in the hallways of conferences, which is rarely documented, is just as important. If you don’t believe me, consider that courts do take this in consideration for your training and experience. It is not just information that is fed to you as you sit in the seat, but also the information that is shared informally among the community, the practitioners, and the researchers. There is no hallway in a virtual conference. Hallways are awesome on many levels. 

The biggest negative to physical conferences

The biggest negative to physical conferences is the same as it had always been: time and money. A three day conference is actually four or five days when you add travel time. If you are like me and work unusually long hours, a physical conference takes away even more days for not being able to work evenings.

To make up for this loss of time, network and network more. There should never be a conference that you attended where you regretted spending the time and money. You should always strive to not only learn one thing that made it worthwhile but also to make one connection with one person who either inspired you on the spot, might inspire you in the future, or you were an inspiration to them.

Free DFIR book challenge

Before everything went virtual, I was giving away DFIR books in a book challenge. I gave away a dozen books or so. Then I stopped, because the point of the challenge whet away when physical conferences stopped.

Now I will start up again with a change in how I give away the books. Let me refresh the rules and purpose of what I had started first.

• Each DFIR book was signed by the author or authors.
• The author wrote a one sentence inspiration in the front matter, and also highlighted/signed a passage that meant a lot to them
• After reading the book, I also highlighted and signed a passage in the book that meant a lot to me, and I signed the book with a short sentence of inspiration in the front matter.
• Then I gave the book away.

The book challenge was my request for the winner to read the book and do the same thing. Highlight an inspirational passage, sign it, and pass it on. The goal was to take the book to a conference and give it to anyone who wanted to read that book, and hopefully do the same thing at their next conference or even in their workplace.

There are several purposes of this challenge. You get a free book. The book signed by the author. You get to see what passage inspired the author. You get to see what passage inspired me. You get to see what passage inspired the next person in the next person in the next person. You get to see everyone’s name that this book flowed from the author to you. And you get to pass it on.

In the hundreds or thousands of the printed copy of that book, there is only one that is signed by the author, signed by me, and signed by you. I will not give away the same book twice.

Another purpose is to give you a reason or excuse (depending on how you look at it) to speak to another human. With this book in your hand, you have the complete authority and power to walk up to anyone, explain the book challenge, and offer it to them. From there you have a conversation with someone in the community. How cool is that?

If you are DFIR book author and would like your book in this challenge, please let me know. I will buy your book for you to sign, and I will give it away.

The best result of this book challenge is that at a conference, someone gives that the book to you and it has been dog eared, highlighted, and signed by dozens of people. Make your mark and pass it on. Or you keep the book yourself, that’s up to you.

I’ll probably start fresh with my latest book since I gave away my other books, and then try to run down some authors for books.

Oh yes, the change this time is that to enter this book giveaway contest, you have to be going to any conference coming up. This narrows down who can be entered but it also means a smaller pool in which you can win the book. I am making this change just to encourage passing the book along sooner than later so more people will be exposed to the book, and have the opportunity to speak to another human not just about the book but about the community and whatever comes up in conversation.

So, if you going to any conference coming up in interested in winning a book be sure to follow DFIR training on Twitter or LinkedIn or Instagram so you don't miss it!