Security/Forensic Certifications

Forums › IT Pro and developers › Security/Forensic Certifications - www.giac.org

Aaroona

3067 posts

Uber Geek

#140985 26-Feb-2014 08:39

So I'm looking at studying for the GIAC Certified Forensic Analyst certification (GFCA) - but I'm unsure of its use here in NZ.

Just a few questions to start...

1. Is this a very common certification?
2. Is this recognised world wide?
3. Does anyone here have it?
4. What certification would you recommend as an alternative?

ANy help you guys can provide would be appreciated!

LINK to certification

gzt

13739 posts

Uber Geek

Lifetime subscriber

#994791 26-Feb-2014 12:41

Sounds cool. Never worked in this area. If you have enough background experience in some kind of technical IT to begin moving into this area it would be a good move. I have seen a few of these jobs advertised recently. Find one and explain where you are at and see what they require and if they are willing to send you a job description. Imho for the most part nobody in NZ IT hires just purely on the basis of certification, it's only one aspect if sometimes an important one. All imho but hope that helps.

MyHeritage DNA

Affiliate link

Affiliate link: MyHeritage DNA test kit helps you discover your ethnicity results, DNA genetic groups, family relatives.

timbosan

1956 posts

Uber Geek

#994804 26-Feb-2014 13:14

I have been studying towards a Masters for Forensic IT (MFIT) at AUT for a couple of years now (just about the complete my last paper) so have some relevant input:

1. Is this a very common certification?

Never heard of it. Closest I have heard of apart from the MFIT is the Cyber Security Masters at Waikato, or the industry stuff like EnCase. Other than that there is ISACA stuff which can help - http://www.isaca.org/Certification/CISA-Certified-Information-Systems-Auditor/Prepare-for-the-Exam/Study-Materials/Pages/default.aspx

There isn't really any comparison though between a 3 hour exam and real world experience, or 2 years of full-time training/these writing. I suspect it wouldn't do you much good in the job market.

2. Is this recognised world wide?

Sorry don't know but I will ask around the staff at AUT.

3. Does anyone here have it?

Not me!

4. What certification would you recommend as an alternative?

MFIT is a NZ certification, and is now in its 5th year, so know in NZ. However, the biggest problem you will find is work specifically as a forensic analyst. The NZ market is broadly split into three areas - 1) Police 2) Big consultancies such as KPMG, PWC, etc 3) Other small organisations such as data recovery services, etc. MFIT pumps out around 20 people a year into an industry that is already full. The Police offer you the ability to work on 1000's of cases a year, with no (or little) budget constraints, focused on crime (i.e. legal stuff). The consultancies offer work in the civil space, but with budgets.

I would also recommend you skill up on the legal aspects, especially the requirements for being an expert witness and the documents at NIST that cover processes, device certification, etc in the forensic field, plus also do a paper/study in cryptography.

Any questions just let me know!

gzt

13739 posts

Uber Geek

Lifetime subscriber

#994811 26-Feb-2014 13:24

Adding to my comments above, this is a current one from TradeMe:

"We are interested in proven expertise with a range of tools and technologies. The ideal person will be a graduate of a Technology discipline, but demonstrated on-the-job ability is just as valuable. It is essential that you have strong technical background, with exposure to many different tools."

http://www.trademe.co.nz/jobs/it/other/listing-695786784.htm

BigMal

975 posts

Ultimate Geek

ID Verified

Trusted

#994814 26-Feb-2014 13:31

I worked in e-crime at the Police doing forensics about 6-7 years ago. It's easily the most interesting job I've ever had but
a) the pay is pretty poor compared to run of the mill permanent IT jobs (and is pittance compared to contracting)
b) the police can be pretty painful to work for, they have little money and are somewhat dysfunctional

Really interesting job though. Worth doing if money isn't an issue for you and you want to venture on to crime scenes :-)

kenkeniff

628 posts

Ultimate Geek

#994823 26-Feb-2014 13:37

timbosan: I have been studying towards a Masters for Forensic IT (MFIT) at AUT for a couple of years now (just about the complete my last paper) so have some relevant input:

1. Is this a very common certification?

Never heard of it. Closest I have heard of apart from the MFIT is the Cyber Security Masters at Waikato, or the industry stuff like EnCase. Other than that there is ISACA stuff which can help - http://www.isaca.org/Certification/CISA-Certified-Information-Systems-Auditor/Prepare-for-the-Exam/Study-Materials/Pages/default.aspx

+1 to industry certifications, FTK is a big one and used heavily by NZP (over Encase).

timbosan

4. What certification would you recommend as an alternative?

MFIT is a NZ certification, and is now in its 5th year, so know in NZ. However, the biggest problem you will find is work specifically as a forensic analyst. The NZ market is broadly split into three areas - 1) Police 2) Big consultancies such as KPMG, PWC, etc 3) Other small organisations such as data recovery services, etc. MFIT pumps out around 20 people a year into an industry that is already full. The Police offer you the ability to work on 1000's of cases a year, with no (or little) budget constraints, focused on crime (i.e. legal stuff). The consultancies offer work in the civil space, but with budgets.

I would also recommend you skill up on the legal aspects, especially the requirements for being an expert witness and the documents at NIST that cover processes, device certification, etc in the forensic field, plus also do a paper/study in cryptography.

Any questions just let me know!

Don't go down the Police route, they're not as advanced and don't have as big budgets as you may think.

Also +1 to studying up on the legal aspects (investigations, chain of custody, forensic imaging, e-discovery, expert witness etc) as that's usually what you're there for at the end of the day, to prove something in court.

jnimmo

What does this tag do
1057 posts

Uber Geek

Subscriber

#994855 26-Feb-2014 14:21

NZ Security Intelligence Service recognise the GIAC qualifications, and I know they are recognised globally. http://www.security.govt.nz/careers/current-vacancies/information-technology-security-advisor-forensic/

I'm hoping to do the Cyber Security Masters at Waikato one day soon, more interested in big infrastructure/network security than the forensics stuff. Hadn't seen the AUT one so I'll have to look into that as well. Waikato seem to have a pretty strong computer science dept.

jonb

1676 posts

Uber Geek

Trusted

#994872 26-Feb-2014 14:46

Generally, certifications in Information Security would have a wider range of career potential than just forensics. It might be better to do the GIAC Security Essentials first, (or CompTIA Security+) and then forensics later?

Aaroona

3067 posts

Uber Geek

#995627 27-Feb-2014 17:04

Thanks for all your responses guys.

Very interesting to see that SIS job.

I'm still looking into what would be the best for me; I really enjoy the process of data discovery, investigations and such, so just want to make sure I go for the right one.

To give you some background, I'm currently working full time, my role spans over L2,L3, and security (with other bits in between).
I'm definitely not looking at going down the Uni route - as a personal opinion, I don't believe Uni has the knowledge or skills I'm looking for, or provide me with anything of value (unless we talk negatives, in which case... a student loan!)

While I realize certifications are not the be all and end all, I am gaining a small amount of industry experience as well with some of the work I do currently, but I want to get into it more heavily, in which case a certification goes a long way.

I'm MCITP, MCTS: Exchange and A+ certified and can learn pretty quickly, so hopefully won't be too much of a shock to the system!

I may also look at some practice tests of each certification at least to give me an idea of what's involved.