Being a DFIR Speaker

Brett recently posted a very good article on the three fears folks encounter when comes to public speaking in DFIR.

Reading his article, and re-reading it, got me to thinking about my own experiences.  My first experience speaking in DFIR was at LISA NT 2000; however, it wasn't my first public speaking experience.  I'd taken a required public speaking course in college, and like most folks in college, did what I could through the course, did a brain dump on the exam, and walked away from the material.  That was a mistake.  I was headed into the Marine Corps, and guess what...they put each and every one of us on the hot seat, over and over again.  It began with the "impromptu speech" exercise in Officer Candidate School, where we were each given a few minutes to put together a short speech on a topic that the platoon commander gave us, and we had to give that presentation in front of the rest of the platoon.  No props, no PowerPoint, no finger puppets...just put together and present a concise, coherent presentation.  This training continued the following summer after commissioning as each of us went through The Basic School; for example, there was an evolution of instruction called "techniques of military instruction", where we each had to give a short presentation after choosing from several topics, such as "field sanitation".  Throughout the six months of training, we were constantly giving presentations...patrol orders, and other 5-paragraph orders.

When I returned to The Basic School as an instructor, I had to go through the process called the "murder board"...I had to give the classes I would be presenting in front of the rest of my team, which included other LTs, Capts, and the Major in charge of our group.  After that, there was continual process improvement, as I gave the various classes and presentations to student companies (2ndLts and Warrant Officers), and processed their instructor review forms from each class.

So, yeah...I had a good bit of practice.  Some of the feedback was constructive.  In other instances, the feedback was purposely negative, so that we'd get used to receiving negative feedback.  However, when I was standing on the podium for the first time, giving my first presentation in front of a technical audience in the private sector, I was already pretty beat by the time I got there...the anxiety from my imposter syndrome had kept me amped for so long, I was pretty tired by the time I said, "hello" into the microphone the first time.

Another opportunity I had to present at a major conference was in New Orleans; the conference organizers thought it would be a good idea to hold the conference during Mardi Gras.  This was both a good and bad idea at the same time, because it gave folks something to do besides the conference.  One I was accepted to the conference, I was really looking forward to meeting and engaging with a couple of the folks who would be teaching training courses before the conference...but that ended up being a non-starter, as several of them disappeared into the party crowd the moment their course was complete.

When it came my time to speak, I dutifully got the room a few minutes early to ensure that the AV was suitable, I had the right connectors (VGA, at the time) and everything was set up.  When the time came for me to speak, I looked up and all I could see, in the entire room, was the folks recording the video for the talk, and their lights.  I quite literally could not see anyone else in the room, and was just about to cancel the talk when I realized that there were actually four people in the room besides me, and the video crew.  However, they'd all decided to sit behind the stadium lights the video crew was using, and I couldn't see them.  I ended up giving the presentation to what I assumed was all four people...the door in the back of the room may have opened and closed once or twice during my talk, I don't remember.

Some things that I've found over time are good to prepare yourself for...

There's always going to be someone asking what seems to be out-of-the-ballpark questions.  When the question gets asked, your mind is going to be racing to understand the question and apply it to the context of the presentation and conference.  You'll have just spent weeks, or even months, preparing the materials, and even practicing your presentation.  And you'll have just spent 45 minutes or more, with your mind racing while you were speaking...are you hitting all of your points, are you saying what you wanted to say, oh, god I'm not really reading directly from the slides, am I?  Sound exhausting?  It is.  And you'll get that way-out-beyond-left-field question. 

My recommendation...rather than trying to do a pretty massive context switch on the fly, just say that you'll take it off-line.  Don't get into a back-and-forth right there, because it'll just chew up time and others won't be able to ask their questions.  Or, in the case of presentations just before a break, or lunch, or the end of the day, get to whatever's next.  Besides, it's better to be able to focus your attention on those types of questions when you're not on the podium.

Similar to this is the "...what happens if you..." or "...did you do this..." question.  I remember years ago I was presenting at a conference on NTFS alternate data streams, and I ran through the litany of examples, only to get, "...did you try this?"  If you're confident in the material and the Demo Gods are kind to you that day, there's nothing wrong with opening a command prompt and giving it a shot.  After all, I strive to learn something new from the perspective of others, when I have the opportunity, and this is a good way to go about it.  However, in this case, the question was a "...what happens if you...?" question, and I turned it around...I knew the person asking the question had a Windows laptop open in front of them, so I asked, "...why don't you try it and let us all know what you find."  Now, this wasn't intended to put that person on the spot, nor to single them out.  The purpose of my responding what way was to demonstrate that when the conference was over and we weren't all in the room together, it's possible to get the answer to our questions by simply trying these things ourselves.

Another aspect of this is the smartest person in the room.  You know who they are, because you've seen them at conferences, just like I have.  These are the folks who have a question, stand up, and the first word out of their mouth is "I", and they don't actually ask a question.  Whether they intend it or not, their delivery is going to come across as, "look how much I know" or "look at how smart I am".  Now, I'm not suggesting that this is the intention, I'm simply saying that this is how it comes across, and the best way to handle these situations is to thank them, and maybe follow up with them later in the conference. 

Then there's the long-winded talker who takes the opportunity, once they have the mic and everyone's attention, to abscond with it.  Yes, its exactly how it sounds...there will be someone who "runs away" with your presentation once they have the microphone.  This is another one of those, "...let's take this offline..." moments. 

There are going to be people who ask the question you just answered.  Literally.  I've been to conferences (attended, as well as been a speaker...) where speakers have to submit their presentations prior to the conference date.  The presentations are provided on a CD/DVD, or at the conference web site.  In more recent years, this has all been part of smartphone apps for some conferences; everything, including the schedule and presentation materials are available via the app.  When it comes time for you to speak, the person from the conference who introduces you will usually make a statement about where the presentation materials can be found, and some speakers may also have a URL in their presentation (maybe at the beginning, usually at the end) as to where the slide deck or materials can be found.

And yet, there will still be someone who asks if the materials will be available, and if so, where/when.  It happens.

What I've seen more recently is that even though presentation materials are available, attendees will use their smartphones to take pictures of slides.  I'm not at all sure why people do this if the materials are available, but from my perspective as a speaker, it simply tells me that they aren't interested in what I have to say.

Final Words
I don't for the life of me believe that anything I've shared here today is isolated to the DFIR community.  Not at all.  I am sure that these same sorts of things happen in other communities and at conferences of all types.  However, I'm sharing what I've seen over the years in hopes that it will help others as they prepare to venture forth and engage in speaking at conferences.  If it's a good experience for the speaker, they're more likely to continue.  Good luck.