﻿CW 232 Transcript Welcome to the
Infosec Career Video Series. This series of short videos will provide
a brief look inside cyber security careers and the experience needed to enter them.
Today I’ll be speaking with Infosec Skills author and Paraben founder, Amber Schroader,
about the role of digital forensics analysts. So let's get into it. Welcome, Amber.
Thanks so much. Amber, let's start with
the basics. What is a digital forensics analyst, and what does a digital forensics
analyst do? What are the day-to-day tasks? So, an analyst is the one that's going to go
through and do your imaging of your computers, your mobiles, cloud, capture all the data. So,
that side of it. But they'll also start going through and start doing the analytics. So putting
the pieces of the puzzle together to figure out what happened. Where the data was found?
Who was involved? The who, what, when, where. All the w's get involved with the analyst.
Mm-hmm. Are there different levels of digital forensics analysts? And if, so do
the tasks change in these different roles, or is it an entry-level kind of thing?
No. I mean, they do change. There are different levels of it. Obviously, there's career path in
it, of course. And you'll specialties. So that's the biggest difference that's happened probably
over the last five years, is that you'll get someone who only does mobile, only does computer,
only does malware, so on and so forth. Got it. How does one become a digital
forensics analyst? Is this an entry level position? Or do you need some experience
first? Do you come from other directions? You got to have some mad skills, of course.
Of course. You can go out and you can pursue
different ways to do it. So you could go get a degree. There are digital forensic degrees
now. One of the many components of cyber. You can go through and get certifications,
which there are a ton of great ones out there. Infosec has them, obviously.
Certified Hacking Forensic Investigator. So, CFHI.
But the big one is you actually have to have developed skills. You can't just go like,
"I know nothing. And I’m going to start today." There's a lot of foundational knowledge because
this is a process, because it is technically a type of science. So you have to know all
those processes before you can start. So you can't just walk off the street and be like,
"Ooh, I’m an analyst. I’m good." Got it. So what skills does a digital
forensics analyst need to do their job well in terms of whether it's soft skills or whether,
you say, as hard technical skills that you can't walk off the street with and already have?
For the hard technical skills, obviously, that's understanding computers. How they actually
operate? Because you're really at the core. It's kind of like when you walk into a great bakery,
you're like, "These cakes are amazing. I totally can make this at home." And then you realize,
"I need to understand all the ingredients to make a great cake." Same thing with digital forensics.
You got to know all those ingredients. And on the softer side, you actually have to be a
really good writer. No one ever talks about that. But you write a lot of reports. And you even have
to be a decent presenter, because, essentially, you're conveying a lot of technical information
to someone who is non-technical. That's why they brought you in in the first place, is to find
all the needles in the haystack. And they don't even understand what hay is. So you really are
in that process. So you've got to have kind of the soft skills of writing. And I don't even know if
writing's a soft skill. And presentation. It's almost like you almost need to be like a
translator in certain ways then? A little bit. Yeah. You're like
a nerd translator. Absolutely. Yeah. Yeah, yeah. We got this high-level thing,
and we have a CEO who still gets their emails printed out for them. And you need to make them
understand why this is a problem. Yup.
Okay. I feel like is a very tool-intensive job. What are some common tools that
digital forensics analysts use? They're going to use – Well, my favorite
is they're going to use a lot of gloves. Just kidding. It's just gross. You're touching other
people's data. But you're going to use things like write blockers. So you're going to use some
hardware devices to prohibit any writes that occur between you and the computer while you might be
imaging it. You're obviously going to use Faraday technology to block signals onto mobile devices.
And you also are going to use a lot of software, both open source and proprietary.
You get a combination of anything from like autopsy on the open source. That's the top
open source tool in the space. To practical proprietary platforms. Obviously, Paraben makes
one, the E3 Forensic Platform. You've got FTK, EnCase. They've been around a long time as well.
Those are all out there. And there's sometimes new emerging tools that do one specific thing, like,
fantastic at Internet history. And that's all the tool does. Again, you have more screwdrivers
in the toolbox when it comes to digital forensics than probably any other discipline in cyber.
With regards to open source software, is this the sort of thing that you would
encourage people to just sort of grab these things and start tinkering around with them?
Or do you need to have the sort of theoretical framework first?
I think you should tinker around, because that way you're going to know if you actually like
the processes that are done every time. I’m one of those that has been in the industry for 30
years. So I started tinkering around. That's how I got my start in it. And in doing so,
I was like, "Wow! This really syncs with my brain and how I go through the process."
And it felt comfortable to me. I knew this was a space I wanted to stay in.
So where do digital forensics analysts work? What type of job options are available to them?
Well, if you want a super public job option, this is not it, because you are definitely in the back
of the house. Any midsize company, up to large companies, typically have a digital forensic
analyst on staff that will do work. Usually internal investigations, versus doing something
external. Unless you're with a consulting firm. If you love to travel, this is a great field, because
you can work with a consulting firm, and you can travel the world. They will be thrilled.
And it also has very strong public sector. Whether it's federal, state or local,
there are digital forensic analyst jobs at every one of those levels. We're kind of everywhere.
We're just the introverts in the back of the room that are hiding a little bit.
Okay. So there are some cases where a forensics analyst is sort of on staff for a certain company.
But for the most part, it sounds like you're doing consultancy work. You're doing almost kind of
freelancy work. Is that a reasonable span? It's about a 50-50. It's really down the middle.
Any type of large company you can think of, they would have an analyst on staff, because
they're going to generate enough internal work that they need to have someone internally.
Okay. For people who are afraid of making the wrong decision and feeling locked into
a certain role, can you move into other roles from digital forensics analysts? What
are some common pivots out of that work and into other things?
Obviously, because I come from the space, I feel that digital forensics is one of the cornerstones
of cyber, because we touch all the other things from pen testing, to intrusion detection. Usually,
you'll produce some type of evidence that you want analysts to go through and review how that
puzzle got put together in the first place. So I think there's a lot of ways you can pivot
once you have these skills to those other fields. You can go to managerial. A lot of the directors
that I see at some of the larger companies, most of them started in digital forensics.
It was a good place for them to get their investigation side going.
See. So, I guess to wrap things up today, for our listeners who are ready to get started,
what's something they can do right now once they turn this video off that will
move them towards the goal of becoming a professional digital forensics analyst?
I know it's going to sound silly, but you can always start on those soft skills. So you can
work on your writing skills. You can work on your presentation skills. And the big one is go out and
start researching. A lot of times, we don't know the problem. We have to go and learn about it. So,
"Oh, this brand-new app came out. We know nothing about it. So we have to go and put
those pieces together." That's a great way to get started because you're going to find
out if that's something you want to keep doing. I actually love the research side.
So I have probably 15 phones on my desk right now I’m doing different research on.
And that's an interesting aspect to me. So that's a great way to start.
Or start looking at your own devices. If you enjoy looking at your own data, you're going
to like looking at someone else's. Oh, that's great. Amber Schroader,
thank you for your time and insights today. I think this was really interesting.
Thank you so much. And thank you all for watching this episode. If
you'd like to know more about other cyber security job roles, please check out the rest of Infosec's
Career video series. We'll see you next time. © 2022 Cyber Work