As the security landscape evolves, mitigation and forensics are becoming as critical to a strong security stance as defense. Recognizing that, (ISC)² has developed a new certification that aims to create a global standard for assessing the mastery of forensics.
“This certification bridges the IT and physical security worlds,” said executive director Hord Tipton in an interview with IFSEC Global. “Today, as surveillance cameras move toward digital, they all have IP addresses. The forensics piece of it goes between the IT and physical security worlds seamlessly as if there are no boundaries.”
Increasingly, organizations are hiring forensics experts for their IT teams in order to strengthen their security. “Employing forensics professionals that hold the credibility of a globally accepted and comprehensive certification like (ISC)²’s CCFP provides a strategic advantage for public and private organizations alike,” said Ken Zatyko, Assured Information Security’s vice president of Maryland Operations in a press release. “The CCFP validates that their forensics team has a very specialized skillset that empowers them to lead investigations with expertise and accuracy and can act as trusted advisors to other teams throughout the organization.”
These organizations, though, currently have no way of measuring the expertise of potential candidates. “If you have a forensics person who is savvy enough to determine the root cause of a security problem and report it clearly, it takes away a lot of confusion,” said Tipton. “Identifying these kinds of problems can make security strong. It won’t eliminate all risk, but it can reduce it.”
The (ISC)², which also administers the well-known CISSP and CSSLP certifications, has announced that it will offering testing for the newly minted Certified Cyber Forensics Professional (CCFPS) certification starting on September 25, 2013. “When we looked around at what was already out there, we saw a lot of silos and a lot of training focused on the use of tools,” said Tipton. “We didn’t see a credential that reached out and covered all the areas that needed to be addressed.”
The end result is a certification that addresses the forensics field broadly. It addresses six domains that are “purposefully designed to include everything you could imagine occurring in the digital world,” Tipton said. The areas are:
- Legal and ethical principles
- Investigations
- Forensic science
- Digital forensics
- Application forensics
- Hybrid and emerging technologies
In developing the certification, the non-profit organization asked subject matter experts from across the blog to contribute to the Common Body of Knowledge (CBK) that creates a foundation for the credential and associated exam questions, said Tipton. In the end, Africa, Australia, Canada, Hong Kong, India, the Netherlands, Singapore, South Africa, South Korea, the United Kingdom, and the United States were represented. The global perspective was important, since about 10 percent of the information is country-specific, while the rest is applicable across the world.
Initially, the certification will be offered in the United States and South Korea. However, other countries will be offering it in the future. The organization plans to work with representatives from these nations to tailor the information and test questions to the specific geography.
The certification has stringent requirements for eligibility, including a four-year degree and three years of full-time professional experience in digital forensics or IT security in three out of the six domains of the credential. Those without a degree are required to have six years of experience. “The experience factor is more stringent than anything you will find,” said Tipton. “Our experts felt very strongly that the credential needed the degree and experience to present the best impression in court, if they serve as expert witnesses, as many will.”
Currently, the (ISC)² is offering a 29-page content information bulletin, which is downloadable from the website, but will be releasing a book containing exhaustive materials by the end of August.
Free Download: The Video Surveillance Report 2023
Discover the latest developments in the rapidly-evolving video surveillance sector by downloading the 2023 Video Surveillance Report. Over 500 responses to our survey, which come from integrators to consultants and heads of security, inform our analysis of the latest trends including AI, the state of the video surveillance market, uptake of the cloud, and the wider economic and geopolitical events impacting the sector!
Download for FREE to discover top industry insight around the latest innovations in video surveillance systems.
Any time you hear of a court case anymore there is most of the time some digital forensics that comes up. The only times I have seen this evidence break a court case is when it was collected or report incorrectly. The individual who pursues this line of work really does have to be equal parts security and technical professional to be successful. It is great that the need for qualified professionals has been recognized yet again and a certification developed for this field.
When i was speaking to the folks at (ISC)2 they stressed repeatedly the importance of a professional look, presentation and communication style for forensics professionals. It’s critical to make a good impression on the jury and be able to present forensics findings in ways that are accurate, understandable, and clearly relevent to the topic at hand. There’s a very special skillset and it’s only going to get more important.