topic Re: CCFP in Exams

CCFP

DFIR_JasonJ — Thu, 26 Oct 2017 09:16:24 GMT

So as one of the co-authors of the CCFP, I was quite surprised that (ISC)2 was killing the certification, and it would be a really good idea to see exactly why this was.

It is actually quite sad because the concept was good, but I think what was needed was more input from actual digital forensics practitioners to make it actually relevant.

Is there anyway that this process could be revived or rebooted?

Re: CCFP

jlcoupe — Thu, 26 Oct 2017 10:00:32 GMT

I am also sad and have tried to book training for CCFP for about a year now.

Re: CCFP

Kentner — Mon, 30 Oct 2017 12:10:27 GMT

I was excited to see (ISC)2 embracing the Forensics field and offering a certification. Although I was doing forensics full time when the cert was introduced, I did not qualify to write the exam at that time.

So, I put it on the back burner, where it has stayed.

Re: CCFP

jpisfilr — Mon, 30 Oct 2017 12:28:49 GMT

I was contemplating the idea of going forward with the CCFP certification to aggregate to my master's in computer forensics. it is news to me that ISC2 is killing this cert. Do they intend to replace it with an alternate forensics certs or will they just be dropping it?

Re: CCFP

ScharfRJ — Mon, 08 Jan 2018 15:40:07 GMT

This is the reply I received from ISC2 when I sent them a not so gentle argument email about this issue of dropping the CCFP:

"Hello Robert,

Thank you for your email and we apologize for any inconvenience this may cause.

Unfortunately this decision has been finalized and we wouldn’t be able to change the mind of our board.

I will certainly express your concerns to the correct individuals, but I can’t offer a resolution at this time.

I hope this helps, should you have any further questions please contact me.

Best Regards,

Thaddeus Feldhouse
Customer Service Coordinator
(ISC)², Inc."

...I had stated to them that:

"I should have seen the writing on the wall when ISC2 started pushing the CCSP even when the ISO standards were not even completed, being only released in 2015 (ISO 27017). The NIST definition was only completed in 2011/12 yet your CCSP is asking practitioners to have 5 years’ experience. It doesn’t make sense to support the CCSP standard yet drop the CCFP standard.

Without CCFP practitioners you cannot enforce CCSP standards in the field!"

Rob Scharf

CISSP member #34200

Re: CCFP

ScharfRJ — Mon, 08 Jan 2018 15:46:48 GMT

this kind of behavior from "The Board" just brings up concerns of back-room pressure from competitors such as SANS...the ISC2 members should be notified of the reasons for these decisions since we are the ones paying for books, training and yearly fees for these certifications.

Re: CCFP

DFIR_JasonJ — Mon, 08 Jan 2018 16:45:51 GMT

Hi Rob

The response that you received is really concerning. As one of the authors that wrote several chapters in the CCFP CBK, we were not even notified or even consulted on the decision. I found this to be a real slap in the face after all the work that we put in.

I for one would like to have a reason why it was dropped, and a real honest reason at that.

Re: CCFP

Baechle — Wed, 28 Feb 2018 18:50:42 GMT

Jason,

It’s actually quite difficult to see what the CBK was for the CCFP. Without additional information on what the certification covered, I kind of side with the board on this one.

Certification in the world of forensics is tricky and somewhat misleading. Many folks rely on digital assistive technology certifications for example, those from Guidance Software or Access Data. If you were to compare this to another field, for discussion, accounting – then this would be like getting certified in Excel. With advanced knowledge of Microsoft Excel, you would know the tool well, including use of the formulas and formatting, and you could probably solve basic accounting equations. On the flip side to that, I wouldn’t want you doing my taxes.

There are professional academic degrees in forensics, such as Forensic Accounting, Forensic Psychology and so on, that combine a rigorous education in the discipline combined with significant electives in scientific methodology and law. Even these programs I think are fairly light – serving as a baseline for those at the entry level. I believe digital forensics education belongs in this bucket. Advanced, deep-dive degrees in computer science mixed with scientific method, analysis, and legal education.

A flip side to this is investigative or legal professionals that know the legal world well, and are assisted by specialists that may not be “forensicators” in their own right. These folks could collect facts with the assistance of technical specialists, regardless of if that specialization is in computers, psychology, accounting, etc. The difference is that these specialists are typically formally licensed. Most Forensic Accountants have the CPA; Forensic Psychologists are either Medical Doctors or Clinical Psychologists; and Computer and Electronic Engineers have the Professional Engineer qualification. Those in other forensic sub-disciplines are generally similarly accredited and licensed. These are example prerequisites for state licensure. And state licensure is typically required to practice forensics by most States in the USA (unless you are a government agent, or an investigator working on behalf of an attorney).

So, in reality the CCFP isn’t going to offer you much in the courtroom. I believe it may be a good framework of knowledge to familiarize yourself with forensics generally – and could be a good book to read in its own right. But I don’t believe it fits well as a qualification from (ISC)^2 or anyone else (e.g. SANS) for that matter.

Sincerely,

Eric B.

Re: CCFP

ScharfRJ — Wed, 28 Mar 2018 22:09:01 GMT

I agree with some of your points but also must add that anyone looking for a forensic analyst must look at the whole skillset package of a digital examiner/investigator. Personally, I've made sure to make sure my skillset has multiple facets, (although may be easier for me than others since I am on the Autism spectrum). I did some years on Mainframe operations, some years with mini-computers, been through all the flavours of MS OSes, passed my A+ PC Tech certification, passed my CISSP 15 years ago and just passed my CCFE. (due to ISC2 retiring the CCFP before I was prepared to pass the exam)

I believe that we should strive to pad our teams with people who have unique talents in the IT and IM/IT Security streams, as well as younger members talented with the cyber social genre, in order to equip our Companies and Governmental Agencies with a Cyber/Cloud Security team which is adaptable.

Respectfully, let me make one last point...we must not make the mistake of comparing the traditional fields educated and governed through the University/College Institutions, with the Computer/Digital/Cyber/Cloud fields of technology, for I fear this would greatly limit our collection of the gifted examiners out there who studied, backwards engineered, disassembled and decoded the parts of this unique set of technologies from a young age right in their own homes, compared to fields where it was difficult to study within the home.

Cheers

Re: CCFP

Baechle — Thu, 29 Mar 2018 15:20:42 GMT

Robert,

I have to respectfully both agree and disagree with some of your points concerning forensics examiners.

Specifically, the CCFP I think applied only and specifically to forensic examiners. This is a career field in and of itself. It uses elements and knowledge of Information Technology, but in and of itself is not primarily an Information Technology discipline.

A forensic examiner in any specialization should have, first and foremost, formal training as a scientist or engineer. This generally only occurs through the formal academic institutions. While some people develop critical thinking skills on their own through life experience, a forensic examiner’s primary tasks are using critical thinking in proposing a hypothesis, designing and documenting experiments, running the experiments, and documenting the results.

That being said, I agree that Information Technology teams should have a blend of skill sets and experience levels. I believe that for the most part, Information Technology is a trade or neo-Blue Collar work. On the other hand, conducting formal experiments for the purposes of presenting findings to a court of law is not neo-Blue Collar work – and should be governed through formal academic institutions, education, qualification, and licensing.

I think that the ability to disassemble, reverse engineer, and other skills are extraordinarily good to have. At the same time, I would want to ensure that the processes used here for forensic purposes, could be defensible in a court of law both through the voir dire of the technologist’s education and through actual application of the scientific process.

Sincerely,

Eric B.

Re: CCFP

ScharfRJ — Thu, 29 Mar 2018 21:18:18 GMT

Hi again, thank you for all your points and feedback, I am enjoying your input as well as clarifications that make me re-examine what I was trying to articulate.

I think now that my main concern about this field, is that a whole sector of the IT security industry workforce may be overlooked to fill certain positions which are badly needed. There are hundreds of thousands, if not millions of digital forensic jobs that will need filling to manage internal Corporate or Governmental (Municipal, Regional, Provincial/State, Federal) security investigations covering security policy violations, which are administrative in nature, rather than civil or criminal.

I'm hoping that the digital forensic industry will mature to a point where we will see the following streams of positions filled by a multi-tiered workforce:

Digital Forensic Examiners, covering internal Corporate/Government administrative security violation cases, educated through self-paced/online/distance learning training and certifications.
Digital Forensic Investigators, covering internal/external Corporate/Government civil security violation cases, educated through college training and certifications.
Digital Forensic Analysts, covering internal/external Corporate/Government criminal security violation cases (eventually escalated to Police Authorities), and trained/certified through special higher education institutions, approved by Provincial/State/Federal governing bodies.
Digital Forensic Researchers, covering Digital Forensic Research, such as digital forensic artifact profiles, ISO standards, standard operating procedures, digital forensic policies, digital forensic tool testing, etc...educated/certified by higher education institutions, which are approved by Provincial/State/Federal governing bodies.

I know flavours of this may already be in the works but the thrust seems to be more towards the higher education to fill more news worthy criminal case jobs rather than the millions of behind the scenes jobs needed filling that will never warrant expensive higher level education.

In the past few years we've seen the costs of SANS courses rise $1700 (50%) from $3400 to $5100 per course, not to mention the costs of College or University tuitions for IT Security courses, half of which do not cover digital forensics very well, most leaning towards programming and/or security controls administration.

Again, thank you all very much for any feedback we can provide to further this kind of dialogue before we reach a critic workforce deficit due to increasing education costs.

Cheers

Re: CCFP

Baechle — Fri, 06 Apr 2018 16:14:58 GMT

RJ,

I looked over your framework. I am a little confused by some of what you presented - and by some of the independent research I conducted.

First, I don't understand the difference between the "Examiner" and "Analyst" work roles. According to the SANS material an Examiner is someone that conducts forensic examinations at a basic level, while an Analyst is someone that conducts forensic examinations at a more advanced level.

Second, I think that Technologists watched too much CSI, Criminal Minds, and NCIS on TV and then went way outside of their lane in trying to define what Computer, Digital, or Electronic Forensics actually is. Forensics - is having to do with presenting information to or on behalf of a court of law. So, regardless of what Technologists think forensics is, it's really what is considered customary by the court that matters.

In the framework that I observe there are really two work roles.

Investigators. Investigators primary job is to obtain information from various sources, and authenticate the source of that information. Investigators may be trained to conduct Forensic Examinations.
Computer Scientists. Computer Scientists primary job (in applied to forensic investigations) is to conduct research as to the best methods for obtaining authentic information from various computer and electronic sources. Computer Scientists may be trained to conduct or support Forensic Examinations.

In my framework there are two tasks.

Forensic Examinations. A forensic examination is the process of conducting a series of tests, by applying the scientific method, in order to answer a legal question. Either Investigators or Computer Scientists can perform this task as it relates to electronically stored information. To be effective, Investigators must receive additional training in the technology that is the target of their examinations and methods to recover that information while maintaining its authenticity. Computer Scientists on the other hand must receive training on authoring legal reports and memoranda, and testifying in court.
Research. Contrary to Examinations, Research can only really be done by a Computer Scientist. What I am talking about here is applying the knowledge of Computer Science in developing protocols for performing destructive and non-destructive tests of electronics in order to successfully recover authentic information.

As far as Forensic Examinations is concerned, what matters is the perception of the court. The court generally consist of technology lay-persons such as, the Judge, the Attorneys, and the Jury. A certification merely states that its holder has memorized some process long enough to pass a test. A degree in the sciences (4 years in the case of undergraduate, and as much as 10 in the case of a Doctoral degree) shows the court that the holder has not only memorized the scientific process, but has applied it successfully over a number of years. Additionally academics at the higher levels requires authoring research for peer review, and establishes that the holder of a degree has the authority to speak to a subject with the weight of approval of his or her peers. When attempting to prove to the court that an examiner or fact witness has the authority - which do you think is most appealing to the court? In a disagreement between two examiners or witnesses, which do you think the court is most likely to believe is correct?

As far as Research goes, what matters is the ability to have your work be repeatable and peer reviewed. In this case, as long as a researcher is able to publishing their work, have others verify it by following the same process, and reach the same results; then no formal education is really needed here. The process of others reaching the same conclusion is validation in iteself.

Sincerely,

Eric B.