Employers rarely hire beginners into digital forensics and incident response roles. Those interested in this field will find it more practical to build DFIR-related skills in the jobs they already have, such as system administrators, DevOps engineers, or network specialists.
The field of digital forensics and incident response (DFIR) is attracting attention among cybersecurity professionals and law enforcement officers seeking to progress in their careers. One of the challenges of entering this field is that employers often limit their recruitment efforts to experienced forensicators. What can people seeking to get into this industry do?
It seems that organizations rarely want to invest in growing the skills of a beginner forensics or IR analyst. As a result, individuals seeking to enter DFIR should look for opportunities to develop relevant skills within their current job responsibilities. Some ideas and examples:
- If you work as a system administrator or DevOps engineer, start getting to know the steps and tools used to investigate suspected security incidents. Gradually incorporate these utilities into your toolkit. Examine logs for security events. If you encounter a suspicious executable, begin experimenting with it in a malware analysis lab from a behavior-monitoring perspective.
- If you have a network administrator role, become familiar with the essential aspects of network intrusion detection. Use the network troubleshooting tools you already know, but dig deeper into the traffic to identify potentially malicious patterns. Practice with capture-the-flag (CTF) challenges, such as the SANS Holiday Hack Challenge, which can include network forensics tasks.
- If you administer cloud services or identity providers, explore the security events in the logs they retain. With your organization’s permission, practice searching those logs for sign-ins, permission changes, and other activity that an investigator would want to review.
- If you have a software engineering background, get to know assembly. Pick up a free disassembler and debugger and begin exploring benign programs using these tools. Identify interesting code sections and spend time understanding their inner workings. When you feel comfortable, start looking at malicious executables.
- If you’ve been performing file system and related forensics tasks, start incorporating additional utilities into the toolkit you use to examine the evidence you already feel comfortable collecting. Look at the artifacts you didn’t consider earlier. Research their meaning and ask questions about what you find.
The idea is to build on what you already know to obtain some baseline DFIR knowledge. Look for ways to do this in the context of your current job responsibilities without undermining your commitments to your employer.
Whatever your background, use AI assistants to help you learn, explore, and experiment. Ask AI to explain an unfamiliar artifact or a tool’s output. Ask it to walk you through its analysis steps, then follow the steps to validate the answer.
Augment the research and experimentation you can do at work with studying and exploring on your own time. Read books on the relevant topics, such as Joshua Wright’s free Dynamic Incident Response, keep up with DFIR blogs, and take formal training if your budget allows. Work through practice challenges, such as malware samples to examine in a lab or log data with planted intrusion indicators. Participate in online forums and informal meet-ups. Talk to people who currently work in DFIR.
Once you learn a bit about DFIR through informal exploration, reading, and studying, start looking for a job—in your organization or elsewhere—that can provide you with experiences and mentoring in the aspect of digital forensics and incident response that interests you. Don’t forget to incorporate what you’ve learned about DFIR into your resume, of course.
