A great question was posted to one of the SANS’ lists on the practical requirements

I felt it was worth while publishing as it covers and answers a question I though about but never asked.

The Question:

I’ve just had a quick look at the site you link to and would be interested to know why this was chosen as the attack platform:

<quote>

* Backtrack version 4

* Fedora Core 12

* Windows  Server

To ensure a level playing field for all candidates, you will not be permitted to use any pre-installed favourite tools that you may have on your laptop. To complete the exercises you must exclusively use the tools and virtual machines provided by GIAC. Failure to comply will result in dismissal from the examination.

</quote>

What does this prove, that you are a pen-tester from 4 years ago (BT1 released May 26, 2006)?

Surely if this exam is meant to show that you have current skills then it should allow you to use current tools.

A great response came back from Mark Baggett, one of the most recently minted GSE.

Mark’s response:

I think of it more like “Hey McGuyver, here is your paperclip and bubble gum, now dodge this.”

I found the old tools added VMWare compatibility complications to the test.

Having newer tools would have been nice. (or not deviating from the system requirements, no matter how smart I thought I was)  That said, the compatibility problems I experienced added to the “pressure cooker” which I think is part of it.  Also, I don’t think that being able to attack ms08-067 requires a different skill set than ms04-011.  Certainly pen-testing has changed a bit since then, but the GSE covers 504 not 560.  All aspects of pen-testing are not part of this.  A very solid understanding of the fundamentals of an attack are required.