Image by practicalowl via FlickrI just couldn't resist the urge to chime in on this topic, especially with the buzz it has created.
As Larry Daniel's son and employee, I have had the great advantage and privilege of learning through the apprenticeship model. I also have the opportunity to incessantly bug him with a plethora of questions more or less every day.
The experience I have had through the apprenticeship model goes far beyond the realm of acquiring technical proficiency in digital forensics. I have learned through observation and emulation many other skills, many of them "soft" skills that would be extremely difficult to translate into a certification curriculum.
Furthermore, I have had the opportunity to work on dozens of cases in a relatively short time, starting at the very bottom and working my way up to being able to act as the lead examiner on cases.
However, I know that my situation is the exception and not the rule. Obviously I like the apprenticeship model, but this model does not work on a large scale. We accept forensic interns here at Guardian. Logistically we can only accept so many requests for internships. Responsibility for the bulk of the training these interns receive falls primarily on my shoulders.
Between my caseload, travel schedule, management duties, and occasional need to sleep, the training of one intern can seem a monumental task.
So my point: The apprenticeship model is not a viable model across the board.
My other point: There is a lot of great training out there and certifications can be useful.
I have taken classes, and some have been fantastic. Most recently I was at a SANS conference and received 12 hours of training on computer forensics and incident response and it was great.
Certifications, at the least, can show an ability to absorb technical information. They can also act as a reality check for those attempting to enter the field who think it is going to be like CSI: Miami. Many of them offer very useful information and experiences as you get to learn from real experts and gain knowledge of real techniques.
Certifications are also the only option to many people who have a desire to work in digital forensics since internships are sparse.
I think there is a deeper issue at the center of this, so here is my take:
Certifications can be extremely useful if, and only if, the participant is passionate about forensics and really wants to learn the material for reasons beyond getting a certification.
Otherwise they are just collecting expensive paper.
Apprenticeships are useful if, and only if, the apprentice is passionate about forensics and wants to acquire the skills and expertise for reasons beyond getting a job.
Otherwise, they are just filling a chair.