Useful Certifications for Computer Forensics

This is a frequently asked (and answered) question - please try the search function here.

Jamie

Mariesa,

I think my thoughts on certifications as they relate specifically to analysts are…pretty well known. However, I do recognize the need for such things, particularly when it comes to credibility and getting your resume past recruiters.

My company currently has an open position for a forensicy person…I'm interested in determining what applicants can do, b/c I know a number of folks with certs who can't do a basic exam.

I'd recommend the certs as a starting point…but not the end. Grab some of the online challenges, and do them. Run through them, then dig deeper. For example, some of the SANS training talks about the NTFS MFT…using online challenges or even your own systems, dig into the MFT.

Which certifications would you all recommend for someone trying to break into the Computer Forensics field?

Thank you,
Mariesa

I agree with Harlan so there isn't any need to go over that ground again in detail. For example, I don't require a certification for people I hire, but I do work them into their training plans once they come to work for me. That said, they're a fact of life in our field and getting some before you hit the job market is a good idea.

The EnCE is a great idea because it seems to be pretty popular in job descriptions and it's very inexpensive to obtain compared to some of the others.

The CCE is very popular and the price isn't all that bad for what you get. A nice bonus that comes with getting the CCE is having access to the CCE email list.

The GCFA (FOR508) and the upcoming GCFE (FOR408) from GIAC are great options, but they're expensive to challenge so it's better to get them as part of purchasing the training courses. Full disclosure that I'm in league with SANS and will be acting as Rob Lee's TA for the upcoming FOR408 course at Network Security 2010 next month in Vegas. I have also done some test development work for the GCFE test so you might not consider me the most objective person when it comes to these certifications.

What is your background? Why do you feel that you need a certification at all?

Thank you everybody! I feel that experience would speak more than certifications. But I'm hearing from so many people that it's hard to get into the Computer Forensics field that I was thinking maybe some certs would be a good idea.

-Mariesa

Well what do you have so far? Not flaming but consider the way the question was posed - it was analogous to asking, "What is the best way to get from NY to LA?" There are many ways but without context it is hard to give a recommendation.

Do you have any degrees, licenses, certifications now?
What is your education background?
What other training have you done?
What is your professional experience?

Think of yourself as the subject of an examination.

Right now at time 0 what do you have?
How did you get there?
What results do you want from your future actions?

At least she's changed her tone from ~*Breezy*~

Well what do you have so far? Not flaming but consider the way the question was posed - it was analogous to asking, "What is the best way to get from NY to LA?" There are many ways but without context it is hard to give a recommendation.

Do you have any degrees, licenses, certifications now?
What is your education background?
What other training have you done?
What is your professional experience?

Think of yourself as the subject of an examination.

Right now at time 0 what do you have?
How did you get there?
What results do you want from your actions?