http://www.owasp.org/index.php/Hartford

“Attending a security conference does not need to be expensive, however. Several organizations, such as ISSA, ISACA, OWASP, and many others, offer local low cost one- or multiple-day conferences that cater to practitioners in a particular geographic area.”

Let me second that comment, you are right on! As a matter of fact providing a low/free cost educational opportunity was one of the reasons why I founded a local security group called the Northeast Ohio Information Security Forum (http://www.neoinfosecforum.org). Networking and sharing with peers was the other reason. The meetings are free to attend and include relevant topics from knowledgeable local and regional speakers. We have some great discussions amongst members as well. All without anyone selling a product. We usually get around 40 people attending and have over 400 in our mailing list database.

I want to mention that our local InfraGard chapter (http://www.nocinfragard.org) offers free and low cost training as well. We hold quarterly meetings and an annual 2-day security conference called the Information Security Summit (http://www.informationsecuritysummit.org). The Summit, which features over 30 sessions as well 1/2 and full day training, is very affordable at $250.

Northeast Ohio professionals have some great low cost & free offerings to choose from.

When I was in a position where I was responsible for managing the budget, I set aside $4500 per employee for training and travel. It’s not cheap, but I believe the ROI is high in terms of more effective and happier employees.

If it’s difficult to get away for training, there are more and more online offerings everyday. I have taken several courses online that were four hours a week for 10 weeks. The same training is offered at conferences in a week long format. Doing it online was cheaper, allowed me to stay at work (whether that’s a benefit or not, depends on the person) and gave me a week to digest the material in between each session.

Due to the current economic climate, my employer recently put a freeze on all training budgets. But there are creative things that can be done. For example, I’d been wanting to go to Shmoocon for the last few years. This year, I had the money and the vacation time, so I went. While I was there, I took good notes and when I returned to work, I wrote up a two page summary of what I’d seen and learned and sent it to my boss asking if I could share it with the whole team. She was pleased and told me to change the vacation days on my time sheet to work days. It didn’t cover my expenses, but having the vacation time back was a huge win.