±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 7 Overall: 36096
New Yesterday: 4 Visitors: 138

±Latest Articles

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Videos

±Latest Jobs

Is There a Need for Industry Control?

Is There a Need for Industry Control?



Page: 2/2

The fact is that if a person walked into my local Law Enforcement HQ and asked for access to case files containing indecent images they would be escorted from the building. However, if the same person flashes one of my business cards and has been sent by a lawyer, or similar, they are ushered in and made a cup of tea.

As another example I contacted a local Police Force Hi-Tech Crime Unit this week as we have not yet worked with them. The pleasant and helpful officer who replied to my email didn't ask for references, experience or indeed who the heck I was but was only interested in my day rate. I am very familiar with this reaction and I find turning up in a suit with a notebook computer and an expensive business card is enough to quell their fears. It shouldn't be enough and is wide open to abuse. My company does all it can to improve the situation by providing references on request, having ID/photo style business cards and registering with key organisations. However, the worrying fact remains that a paedophile could get his fix by setting up as a private forensic investigator defending indecent images cases without downloading a single image himself.

If there was an International Governing Body offering recognised qualifications which could also be based on provable experience, it would be a simple procedure to check up on the investigator you are planning to hire. Businesses could be approved en masse with an ISO/BS style quality and competency standard enabling them to recruit and train new people, bringing new, young trainees into the corporate sector. It would not eliminate incompetence or some tenacious people determined to gain access to illegal material but it would be better than what we have today.

In the US they now have the self styled IISFA, the International Information Systems Forensics Association (http://www.infoforensics.org/) with their CIFI certification. This is quite a challenging exam and covers all the core elements of computer forensics including Intrusion Detection, Auditing and Countermeasures. This is all very nice but, in my opinion, much more suited to a corporate internal security team not to a specialist in hard drive or even mobile phone forensics. The other problem is how many of us have ever heard of the IISFA? This 'International' organisation has 13 'Chapters' around the world and 11 of those are in the US; the only one in Europe is in Italy. (There are around 20 other certifications available from a variety of reputable sources and, shall we say, 'others' as of January 2005).

With the increase in computer crime affecting the whole world, getting new blood into the forensic investigation of electronic equipment is vital if the criminals are not going to win. Working for law enforcement as a trainee is an excellent and proven way in, however the numbers are not yet there and we need a defined and 'safe' way to recruit, train and hire people to work in this increasingly important arena.

I am not offering to set up the type of body discussed above, I believe it should come from an existing recognised body in the security arena and even if it did happen, getting companies or law firms to check the register would be yet another hurdle. However, in an industry that can give people access to illegal material and personal information and which can ultimately affect a person's freedom, more needs to be done to control and protect our industry from gaining a bad name and ultimately protecting the freedoms of the people we represent.


Nick Furneaux - Security and Forensic Specialist
CSITech
www.csitech.co.uk




--





Previous Page Previous Page (1/2)