A lot of our listeners are just considering cyber security as a career and don't know
what they want to start with, but what things should you be learning, or studying, or getting
involved with if you want to prepare yourself to possibly move toward a career in digital
forensics?
Yeah. I mean, that's a great question. There's no one right answer, which is maybe confusing,
but also good for people who have taken one path or another and they want to get into
this. At my current company, we hire from a very wide variety of backgrounds at Crypsis.
The traditional computer science, study of information systems. That's very helpful.
Some universities now even have digital forensic undergrad curriculum. For example, Champlain
College has a great program. University of Southern California here in Los Angeles where
I am has a great program.
That's one thing. I think more critical, more important than just the technical subject
matter is that ability to think critically and to have those technical skills, but also
to combine that with very strong communication skills, because you're engaging with clients
who are having these problems. It's one thing to be able to dive deep and do the technical,
but it's another skill that needs to be combined with that to communicate and to correspond
with the people that you're working with, whether it's attorneys, or whether it's the
victim of a of a cyber-attack.
Can you give me some – that's not a specific example, but some examples of the type of
problem-solving skills you need to be using on a daily basis in terms – like you said,
if all the data has been deleted at the last minute, or because they know something's in
there or whatever, what are some of the problem solving skills you have to bring to bear to
say like, “Well, this thing's not here. But how do I get it here?”
Yeah. I think the biggest – one of the challenges that I see very often was very common with
people earlier in their career, but even experienced practitioners. One of the hardest challenges
is how do I wade through so much data? Even one hard drive, you've got, maybe it's a terabyte
hard drive. If you are looking at unallocated space, or all of the event logs, you've got
millions of entries and you could scroll through that data for days, just one drive and investigations
nowadays are commonly hundreds of hard drives, hundreds of endpoints, thousands even.
What I see is that people really get overwhelmed, even when they've got one drive. How do I
how do I find the signal and the noise? Even when they're educated on the different artifacts,
or places to look, they find – what we see is people will try and go through them serially
and again, just very quickly, get overwhelmed. That's part of the really – a good skill
to learn is how do you filter through all that stuff to answer the questions that you
have.
Okay. Is that a thing, where you need to get familiar with certain types of tools that
can help you? Are there just instinctual things that you say, “Oh, well. If there's that
many thousands and thousands of potential inputs or whatever, what do you do?”
Yeah. What's been helpful formulation is starting with the end in mind and thinking about it,
okay, here's the question – the problem I’m trying to solve. Let's make up an example.
Let's say that our client is worried that somebody stole information from – they were
at a company, they left that company and they went. They've now started a competing business.
Our client is worried that they stole information on their way out the door.
In that scenario, you can try and sift through every byte on a hard drive, or you can think
like, “Okay. If they did that, how would they do that?” Maybe they would plug in
a USB drive. Okay, if they plugged in a USB drive, what artifacts would that create on
the system? Then looking specifically for those artifacts, well that would create something
called a link file. There'd be a link file and there'd be an entry and the registry hive
that reflects connection of that drive.
What it comes down to is basically, having different hypotheses about things that would
manifest themselves and then looking for those and testing those theories one by one, to
assess whether or not something happened on a computer.
That's good old-fashioned deductive reasoning then, basically.
Yeah. That's an investigative skill. Absolutely. The challenge is to keep that focus in mind
and not get bogged down.
New episodes of Cyber Work are available every Monday at 1pm central, and forget to claim
your free month of Infosec Skills! Sign up using the code 'cyberwork' and you'll get
unlimited access to hundreds of courses, hands-on labs, certification practice exams, skills
assessments and more. Use code 'cyberwork' for Infosec Skills!