IACIS CFCE vote passes

Jonathan, as I said, there needs to be a change to some policies, and perhaps a bylaw. Under IACIS rules, any such change needs to be drafted, initially approved by the board, then posted for a month for member review and feedback, and then unconditionally approved by the membership. Additionally, IACIS is going to need to source provider(s) for the background checks to cover multiple countries since they have over 60 (maybe more, I haven't checked lately) different countries represented. I think it's doable for the next round of certification, which begins after the EU conference, but I'm not directly involved in the process so I can't say with any certainty.

Paul, there is already (as of the current cycle already underway) no longer any difference between being external (didn't attend the training before entering the cert) and internal. All students get full mentoring during the peer review (first 4 problems) and all get zero mentoring for the certification stage (hdd problem and written exam).

so wait. To try for CFCE one still needs to have LEO experience?

While having the CFCE certification available to the general public will probably be helpful, IACIS will need to make some major changes to their process to make it accepted by the general forensic community.

The certification process, in my experience, is highly subjective. Pass or fail on each of the practicals is left to each coach who grades the written report that is required for each practical. You have a year to complete the certification, but there are arbitrary internal deadlines for each practical that are buried ten pages deep in their instructional documents and if the deadline is not met you fail the process regardless of the reason. Granting of extensions are possible, but again this is arbitrary and depends on who in the IACIS hierarchy reviews it.

There is a written test that is part of the certification process, but this is done at the end of the practicals and consists of essay-only answers. If you fail this portion, you have failed the entire certification, regardless of how you performed on the practicals.

All that said, my experience with this process was in 2005 and it may have changed somewhat. If it has, all the better. If not, then you need to be aware of the issues if you plan on attempting the certification.

Mark

Jhup, no, you don't need LE experience.

mkel, the CFCE is being transitioned to a completely objective testing methodology. The issue of subjective grading by coaches was acknowledged by the certification stakeholders over a year ago and much of it has already been resolved, or will be resolved in the near future.

The structure of timeframes has also been changed substantially since '05. You get 4 months to complete the peer review which consists of 3 practicals and the wildcard. There are no milestones within that 4 months, you can finish as fast or as slow as you like so long as all 4 questions are finalised before the end date. Once you pass peer review, you get I think 2 months to do the hard drive and the final exam.

As for the comment about failing the exam means you fail the whole thing, I think you'll find that in any competency based testing program, the same thing applies. You are expected to meet all the competencies, and the competencies are spread out amongst the practicals and the exam. If you don't pass it all, then you're not yet competent, and you need to study some more and try again. If you fail at the certification phase, you wait 60-180 days and apply to retake the certification phase. There's a fee for the do-over that's to be announced, but I don't expect it will be much.

The IACIS website has the dates for application for the next CFCE cycle. Enrollment is August 15, 2010 to November 1, 2010. The cycle starts on 1 December. Looking at that timeframe, and knowing the process to change the policies, I'm guessing that the June cycle will be the first one to open up, but I wouldn't rule out the new policy being in place before November.

mkel, the CFCE is being transitioned to a completely objective testing methodology. The issue of subjective grading by coaches was acknowledged by the certification stakeholders over a year ago and much of it has already been resolved, or will be resolved in the near future.

The structure of time frames has also been changed substantially since '05. You get 4 months to complete the peer review which consists of 3 practicals and the wild card. There are no milestones within that 4 months, you can finish as fast or as slow as you like so long as all 4 questions are finalised before the end date. Once you pass peer review, you get I think 2 months to do the hard drive and the final exam.

That is very good to hear. Most other certifications that I am aware of are graded objectively and this was an issue with CFCE - both in the certification and re-certification exams. This will go a long way in improving the CFCE certification credibility. It also sounds as though the process has become more streamlined with fewer practicals and a more compact time line.

As for the comment about failing the exam means you fail the whole thing, I think you'll find that in any competency based testing program, the same thing applies. You are expected to meet all the competencies, and the competencies are spread out amongst the practicals and the exam. If you don't pass it all, then you're not yet competent, and you need to study some more and try again. If you fail at the certification phase, you wait 60-180 days and apply to retake the certification phase. There's a fee for the do-over that's to be announced, but I don't expect it will be much.

I fully agree with the premise that failing any part of the certification process means failing the certification. Where I disagree is the placement of the exam in the process. Again, most certifications I am aware of that include written and practical portions place the written exam at the beginning of the process as a "pre-test" (for lack of better terminology on my part.) To spend four to six months demonstrating competency in the actual work of computer forensics and then failing the written seems backwards to the actual goal of certification which is to demonstrate knowledge and competency in the field. I know that the written was extracted from the hard drive exam practical as part of the process, but this competency could easily be demonstrated in some other manner.

Mark

Has there been any discussion of training programs that would have some loose association such as the CCE has with Key Computer Service and ISFCE? Or GCFA and SANS 508?

There is no requirement to take any particular training. When I got my CFCE, I'd never had any formal training, just on-the-job training in a well established lab. Because IACIS also trains, I don't know if they would seek to have arrangements with other companies in this regard. However, I expect that the competencies will be published at some point which will enable training orgs to align their current training with the IACIS competencies if they so desire.

Any updates on the availability of the CFCE to public sector? Well there appears to be
http//www.iacis.com/certification/external_overview

I LMGTFY myself-ed. Not sure the board policy on that 😉

Any updates on the availability of the CFCE to public sector? Well there appears to be
http//www.iacis.com/certification/external_overview

I LMGTFY myself-ed. Not sure the board policy on that 😉

Looks like you answered your own question. That page makes it clear what the requirements are. Do you want me to seek a clarification from a board member for you?

I guess just looking for clarification as to when the IACIS Basic Computer Forensic Examinations (BCFE) training event might occur. I see that the enrollment process is opening on March 1st?