Thursday, October 8, 2009

Certifications...A Necessary Evil?

51: CSI: Investigates!Image by practicalowl via Flickr
I just couldn't resist the urge to chime in on this topic, especially with the buzz it has created.

As Larry Daniel's son and employee, I have had the great advantage and privilege of learning through the apprenticeship model. I also have the opportunity to incessantly bug him with a plethora of questions more or less every day.

The experience I have had through the apprenticeship model goes far beyond the realm of acquiring technical proficiency in digital forensics. I have learned through observation and emulation many other skills, many of them "soft" skills that would be extremely difficult to translate into a certification curriculum.

Furthermore, I have had the opportunity to work on dozens of cases in a relatively short time, starting at the very bottom and working my way up to being able to act as the lead examiner on cases.

However, I know that my situation is the exception and not the rule. Obviously I like the apprenticeship model, but this model does not work on a large scale. We accept forensic interns here at Guardian. Logistically we can only accept so many requests for internships. Responsibility for the bulk of the training these interns receive falls primarily on my shoulders.

Between my caseload, travel schedule, management duties, and occasional need to sleep, the training of one intern can seem a monumental task.

So my point: The apprenticeship model is not a viable model across the board.

My other point: There is a lot of great training out there and certifications can be useful.

I have taken classes, and some have been fantastic. Most recently I was at a SANS conference and received 12 hours of training on computer forensics and incident response and it was great.

Certifications, at the least, can show an ability to absorb technical information. They can also act as a reality check for those attempting to enter the field who think it is going to be like CSI: Miami. Many of them offer very useful information and experiences as you get to learn from real experts and gain knowledge of real techniques.

Certifications are also the only option to many people who have a desire to work in digital forensics since internships are sparse.

I think there is a deeper issue at the center of this, so here is my take:

Certifications can be extremely useful if, and only if, the participant is passionate about forensics and really wants to learn the material for reasons beyond getting a certification.

Otherwise they are just collecting expensive paper.

Apprenticeships are useful if, and only if, the apprentice is passionate about forensics and wants to acquire the skills and expertise for reasons beyond getting a job.

Otherwise, they are just filling a chair.
Reblog this post [with Zemanta]

1 comment:

  1. Lars,

    Insightful post, but I wouldn't want to work with someone who can absorb technical information...there are lots of folks like that out there. I'd rather work with someone who can *apply* it. I've seen too many times where someone's gone to certification training, obtained the cert, and then not bothered to apply it. This isn't an issue with the certification...as you pointed out, the real short-coming with a certification is more about the individual.

    ReplyDelete

I have moderated my comments due to spam.