Table of Contents for

System Forensics, Investigation, and Response, 3rd Edition

You have a lab, you have software, but what about personnel? When considering potential candidates, looking for candidates who have taken a forensic class is a very good first step, but you should also look for candidates who have earned industry certifications. Before looking at specific certifications, let’s discuss computer certifications in general.

Certifications have always been a controversial topic. Some people swear by them and won’t even interview a candidate who does not have a few. Other people are convinced they are worthless. The issue stems from a misunderstanding of what a certification means. It is not meant to certify the person as an expert or master in a specific field. But a certification would imply a person has a working knowledge comparable to that certification.

It is meant to demonstrate a baseline of competence. Think about a medical degree. Simply having an MD does not guarantee the person is a brilliant physician. It just shows that the person achieved a certain minimum skill level. There is certainly a wide variation in skills among physicians. The same thing occurs with IT certifications. There are people with the Certified Information Systems Security Professional (CISSP^®) credential from the International Information Systems Security Certification Consortium (ISC)^2® who are brilliant security professionals with a very deep understanding of security and a wide set of skills. There are others with that credential who are only moderately competent.

Another issue with certifications is the boot camp. These programs are usually four or five days of intense study where the materials needed to pass a certification test are crammed into the students. On the final day, when it is all still fresh in their minds, they take the relevant certification test. This does lead to many boot camp attendees forgetting everything a few months later; however, this can be seen not as a failure of the training, but rather of the student. If you attend a boot camp, it is incumbent upon you to keep your skills up after the training is over.

Regardless of your personal feelings about certifications, it is a fact that they can only help your résumé as a forensic analyst. That doesn’t mean, however, that you should ever hire any IT professional based solely on certifications. But they are one part of the total résumé. A combination of the right certifications along with formal education and experience make an ideal candidate.

So what are the right certifications? Forensics is a very broad topic that requires analysts to have both broad and deep knowledge. Some of this knowledge is obtained in a formal degree program, whereas some is obtained on the job. But anywhere you have a gap in your knowledge, or simply want to enhance your résumé, is a good place to add a certification. You need to know the following areas:

• PC hardware: This can be obtained in a basic hardware course at a college or via the CompTIA A+ certification.

• Basic networking: Most computer science–related degrees include a course in basic networking. This satisfies your needs as a forensic expert. However, you might consider the CompTIA Network+ or the Cisco Certified Network Associate certifications.

• Security: You must have a general knowledge of security. This can be best demonstrated with the (ISC)² CISSP certification or the CompTIA Security+ certification.

• Hacking: Yes, you do need to know what the hackers know. A few certifications for this area of study exist. One is Offensive Security’s test, which requires hands-on hacking. Additionally, there are the Certified Ethical Hacker from EC Council and the GIAC Penetration Tester (GPEN) from SANS.

Now that you have learned about certifications in general, it’s time to consider specific forensic certifications. The following sections examine two vendor certifications. Clearly, if your lab uses a specific tool, it is a good idea to have analysts who are certified in that tool. Subsequent sections explore a few general forensic certifications. These tests are about forensic methodologies rather than a specific tool.