3 ms·

Your previous day job of "making things work" implies you might have a talent for learning and understanding "how things work." If so, this talent will serve yo

by jcr 16y ago

Your previous day job of "making things work" implies you might have a talent for learning and understanding "how things work." If so, this talent will serve you well in Computer Forensics, Reverse Engineering, Security Auditing, and many other related fields. Heck, it will even serve you very well in countless unrelated fields. You should state what you mean by the phrase "Computer Forensics" and what you expect such a job to entail? Without knowing your definition and expectations it's very difficult to give you a good direct answer. Some of the stuff I've done professionally qualifies as "Computer Forensics" (by some definitions), but I'm certainly not an expert in the entire field.

rorry_Breaker 16y ago
Yeah, I shouldn've been more specific; I forgot the phrase encompasses a pretty broad range of jobs. Well right now, I'm mostly interested in working in a lab analyzing confiscated equipment for some contractor that does such work for police or whomever to get started. Malware analysis is pretty interesting as well; though I'm not trying to start there.
- jcr 16y ago
  It seems I wasn't clear... Do you want to work at the physical hardware level, or the software level, or betwixt, or between, or other? There's a big discrepancy in skill sets between knowing how to drive a SEM (Scanning Electron Microscope), knowing how to drive test equipment (signal analysis), knowing how to drive a disassembler (binary analysis), knowing how to drive a text editor (manual source code analysis), and knowing how to drive the "typical" industry tools (automated source code analysis, fuzzing, disk inspection, case management, ...). On top of all that, there's also knowing legal requirements and procedure (evidence handling) as well as proper cost and feasibility estimation ("is it possible?" "is it worth it?"). The most fundamental basis for all of these related fields is knowing how to write code, preferably in a whole lot of different programming languages. You need to know the high level languages used in applications and services. You need to know the common "systems" languages like C and C++. You need to know the low level assembly languages very well, preferably for multiple architectures. You may or may not need to go even lower down to knowing microcode. You may or may not need to know firmware engineering and reverse engineering. You may or may not need to know a good deal about hardware engineering and reverse engineering. There are even people who work at the materials sciences levels, and yes, they're beautifully fun and spooky to work with because they actually can answer questions like, "Was this ATM system board frozen with liquid nitrogen?" --Similar fun is true for the signal analysis folks. As you've probably guessed by now, there's a lot of heavy engineering and sciences involved, as well as a bit of art, so you'll need a nearly masochistic dedication to constantly learning. You might find books helpful to get you started in various topics, but you'll do most of your learning hands-on and on your own. The people who are "truly great" in various fields and topics are at least partially, if not completely, self-taught. Pick an area of interest, and dive into it. Learn to do your own research, and learn to find the research of others. The two things to keep in mind are, (1) all of the areas of interest are inter-related, and (2) there is significant competition between security/assessment vendors. The competition can often make finding the research of others nearly impossible. This is especially true for the malware analysis and security auditing industries where many tools and techniques are considered trade secrets. Even if you are an amazing generalist with both depth and breadth in your skills, you will still most likely still specialize to some degree. The useful skill and knowledge of any single person has limits, so you'll need to know how to work well with others, many of whom are amazingly talented in their own right, if not absolutely brilliant. If you can remain content, helpful and useful while knowing you might be the dumbest guy in the room, then there is hope for you. The technical challenges of forensics and related work are endless and very rewarding, but there is a little known and very damaging emotional toll extracted from you. Every day you at work you must stare at evil. Seriously. You need to stare at the results of truly wicked people committing viciously brutal crimes against other human beings. You will become jaded. If you fail to maintain some hope in the general goodness of humanity, you will become bitter. If you become really good at your job, you will have learned to think like the bad guys... and anyone who recognizes your skills will consider you "spooky" to some degree, even if you're one of the good guys. The absolute nicest and most honorable "good guys" in the various fields are also frighteningly talented. Becoming jaded, or worse, bitter, and always being suspect due to your demonstrated skills tends to be a rather high price tag for a career. --This is really the very first thing you should learn.
  - rorry_Breaker 16y ago
    Thank you, that was an incredibly insightful reply. It would probably be easier for me to gain entry via the software aspect, however I'm leaning towards the hardware aspect as you described above. So, to give a solid answer to your question above, I'd choose "between" (or even just hardware). Books on this subject matter seem relatively obscure though. Perhaps I shouldn't look for "forensics" books, but rather just detailed books on some of these devices and how they work. Your explanation of the emotional toll taken is especially insightful and makes me even more intrigued. Admittedly though, I didn't think people working in computer forensics would witness or have to work on situations involving brutal or violent crimes; not that it would deter me from pursuing the career. I imagined it mostly comprised of corporate crimes. I did read about people having to deal with things like "snuff films" or child pornography; I can imagine people becoming jaded and having a cynical outlook on humanity after working on things like that.
    - jcr 16y ago
      It seems you already realize your degree in CS will not prepare you for electrical engineering and analysis of hardware. On the bright side, your CS degree will (should) provide a good knowledge of fundamental logic, mathematics and algorithm design, so it is always helpful. For example, you may be required to write code to automate electronic test equipment to gather results on a piece of hardware you're scrutinizing, and then, of course, you'll need to write even more code to analyze the result datum. If you really want to specialize in hardware forensics, getting an EE degree, or even a minor, will be very beneficial. Personally, I never bothered to get an EE degree, and the gaps in my EE knowledge are something I stumble over far more regularly than I'd like to admit. Off the top of my head, I can't think of a single autodidact that is a good electrical engineer. The only exception would possibly be Bob Davis of IEEE fame but only with a caveat; he simply skipped a 4-year EE degree and went straight for a masters (MSEE). ;-) I do not mean to offend you but if you believe "corporate crime" is somehow victimless, then you are naive and you are in for a very rude awakening. It is a very common misconception so don't be too embarrassed by your oversight. I had the very same misconception when I started. Always remember that you are dealing with real crimes, real victims, and real criminals. The manner in which you respond (incidence response) and the manner in which you handle the situation (evidence handling) can either make or break the case against the perpetrator. You will often be working directly with law enforcement, or even be a law enforcement professional yourself. Like any law enforcement professional, you will be running a risk to both yourself and your family. Criminals are dangerous. I strongly encourage you to take the time to talk to officers and agents about their careers. Even an every-day "street cop" can teach you far more about the crimes they must face than you might ever want to know. As mentioned before, the first thing you need to learn is whether or not forensics is the kind of career you really want, but the second thing you need to learn is whether or not you are actually cut out for the job... http://arstechnica.com/tech-policy/news/2011/01/csi-google-winning-murder-convictions-with-search-engine-data.ars http://arstechnica.com/tech-policy/news/2011/01/csi-google-w... That's just a recent headline I read yesterday, and even though it's murder, it's tame by comparison to some of the crimes you will face with in forensics. Even if you have the dedication to acquire all the needed technical skills, you may not have the required personality and fortitude to do the work. The third thing you should learn is proper incident response and evidence handling. When you know enough to avoid the mistakes destroying the case of the prosecution, then you can potentially do technical volunteer work with a branch of your local law enforcement. Be prepared for law enforcement to do background and reference checks on you, even as a volunteer. Law enforcement always needs technical help, and volunteering is a good way to get the experience needed to ascertain if you're fit for the job. Talk to your local police department, FBI, Secret Service and most of all, District Attorney offices. The uber elite world of rainbows and ponies regularly depicted by famous computer "security" folks fails entirely the moment you mention the f-word (forensics). It might come as a surprise, but I do not mean to discourage you. Instead, I'm encouraging you to make an informed and intentional decision.

by jcr 16y ago

rorry_Breaker 16y ago

Yeah, I shouldn've been more specific; I forgot the phrase encompasses a pretty broad range of jobs. Well right now, I'm mostly interested in working in a lab analyzing confiscated equipment for some contractor that does such work for police or whomever to get started. Malware analysis is pretty interesting as well; though I'm not trying to start there.

jcr 16y ago
It seems I wasn't clear... Do you want to work at the physical hardware level, or the software level, or betwixt, or between, or other? There's a big discrepancy in skill sets between knowing how to drive a SEM (Scanning Electron Microscope), knowing how to drive test equipment (signal analysis), knowing how to drive a disassembler (binary analysis), knowing how to drive a text editor (manual source code analysis), and knowing how to drive the "typical" industry tools (automated source code analysis, fuzzing, disk inspection, case management, ...). On top of all that, there's also knowing legal requirements and procedure (evidence handling) as well as proper cost and feasibility estimation ("is it possible?" "is it worth it?"). The most fundamental basis for all of these related fields is knowing how to write code, preferably in a whole lot of different programming languages. You need to know the high level languages used in applications and services. You need to know the common "systems" languages like C and C++. You need to know the low level assembly languages very well, preferably for multiple architectures. You may or may not need to go even lower down to knowing microcode. You may or may not need to know firmware engineering and reverse engineering. You may or may not need to know a good deal about hardware engineering and reverse engineering. There are even people who work at the materials sciences levels, and yes, they're beautifully fun and spooky to work with because they actually can answer questions like, "Was this ATM system board frozen with liquid nitrogen?" --Similar fun is true for the signal analysis folks. As you've probably guessed by now, there's a lot of heavy engineering and sciences involved, as well as a bit of art, so you'll need a nearly masochistic dedication to constantly learning. You might find books helpful to get you started in various topics, but you'll do most of your learning hands-on and on your own. The people who are "truly great" in various fields and topics are at least partially, if not completely, self-taught. Pick an area of interest, and dive into it. Learn to do your own research, and learn to find the research of others. The two things to keep in mind are, (1) all of the areas of interest are inter-related, and (2) there is significant competition between security/assessment vendors. The competition can often make finding the research of others nearly impossible. This is especially true for the malware analysis and security auditing industries where many tools and techniques are considered trade secrets. Even if you are an amazing generalist with both depth and breadth in your skills, you will still most likely still specialize to some degree. The useful skill and knowledge of any single person has limits, so you'll need to know how to work well with others, many of whom are amazingly talented in their own right, if not absolutely brilliant. If you can remain content, helpful and useful while knowing you might be the dumbest guy in the room, then there is hope for you. The technical challenges of forensics and related work are endless and very rewarding, but there is a little known and very damaging emotional toll extracted from you. Every day you at work you must stare at evil. Seriously. You need to stare at the results of truly wicked people committing viciously brutal crimes against other human beings. You will become jaded. If you fail to maintain some hope in the general goodness of humanity, you will become bitter. If you become really good at your job, you will have learned to think like the bad guys... and anyone who recognizes your skills will consider you "spooky" to some degree, even if you're one of the good guys. The absolute nicest and most honorable "good guys" in the various fields are also frighteningly talented. Becoming jaded, or worse, bitter, and always being suspect due to your demonstrated skills tends to be a rather high price tag for a career. --This is really the very first thing you should learn.
- rorry_Breaker 16y ago
  Thank you, that was an incredibly insightful reply. It would probably be easier for me to gain entry via the software aspect, however I'm leaning towards the hardware aspect as you described above. So, to give a solid answer to your question above, I'd choose "between" (or even just hardware). Books on this subject matter seem relatively obscure though. Perhaps I shouldn't look for "forensics" books, but rather just detailed books on some of these devices and how they work. Your explanation of the emotional toll taken is especially insightful and makes me even more intrigued. Admittedly though, I didn't think people working in computer forensics would witness or have to work on situations involving brutal or violent crimes; not that it would deter me from pursuing the career. I imagined it mostly comprised of corporate crimes. I did read about people having to deal with things like "snuff films" or child pornography; I can imagine people becoming jaded and having a cynical outlook on humanity after working on things like that.
  - jcr 16y ago
    It seems you already realize your degree in CS will not prepare you for electrical engineering and analysis of hardware. On the bright side, your CS degree will (should) provide a good knowledge of fundamental logic, mathematics and algorithm design, so it is always helpful. For example, you may be required to write code to automate electronic test equipment to gather results on a piece of hardware you're scrutinizing, and then, of course, you'll need to write even more code to analyze the result datum. If you really want to specialize in hardware forensics, getting an EE degree, or even a minor, will be very beneficial. Personally, I never bothered to get an EE degree, and the gaps in my EE knowledge are something I stumble over far more regularly than I'd like to admit. Off the top of my head, I can't think of a single autodidact that is a good electrical engineer. The only exception would possibly be Bob Davis of IEEE fame but only with a caveat; he simply skipped a 4-year EE degree and went straight for a masters (MSEE). ;-) I do not mean to offend you but if you believe "corporate crime" is somehow victimless, then you are naive and you are in for a very rude awakening. It is a very common misconception so don't be too embarrassed by your oversight. I had the very same misconception when I started. Always remember that you are dealing with real crimes, real victims, and real criminals. The manner in which you respond (incidence response) and the manner in which you handle the situation (evidence handling) can either make or break the case against the perpetrator. You will often be working directly with law enforcement, or even be a law enforcement professional yourself. Like any law enforcement professional, you will be running a risk to both yourself and your family. Criminals are dangerous. I strongly encourage you to take the time to talk to officers and agents about their careers. Even an every-day "street cop" can teach you far more about the crimes they must face than you might ever want to know. As mentioned before, the first thing you need to learn is whether or not forensics is the kind of career you really want, but the second thing you need to learn is whether or not you are actually cut out for the job... http://arstechnica.com/tech-policy/news/2011/01/csi-google-winning-murder-convictions-with-search-engine-data.ars http://arstechnica.com/tech-policy/news/2011/01/csi-google-w... That's just a recent headline I read yesterday, and even though it's murder, it's tame by comparison to some of the crimes you will face with in forensics. Even if you have the dedication to acquire all the needed technical skills, you may not have the required personality and fortitude to do the work. The third thing you should learn is proper incident response and evidence handling. When you know enough to avoid the mistakes destroying the case of the prosecution, then you can potentially do technical volunteer work with a branch of your local law enforcement. Be prepared for law enforcement to do background and reference checks on you, even as a volunteer. Law enforcement always needs technical help, and volunteering is a good way to get the experience needed to ascertain if you're fit for the job. Talk to your local police department, FBI, Secret Service and most of all, District Attorney offices. The uber elite world of rainbows and ponies regularly depicted by famous computer "security" folks fails entirely the moment you mention the f-word (forensics). It might come as a surprise, but I do not mean to discourage you. Instead, I'm encouraging you to make an informed and intentional decision.