.

Forensics or Ethical hacking?

<<

mambo

Newbie
Newbie

Posts: 14

Joined: Sat Mar 31, 2007 8:11 am

Post Sat Mar 31, 2007 8:17 am

Forensics or Ethical hacking?

Im off to uni next year and im checking out what i want to do. I know i want to go into the security side of computing but i dont know what.

basically the choice for me is between ethical hacking and system security or forensic computing. can someone explain the major differences to me and which is better :p

cheers

mambo^
<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Sat Mar 31, 2007 10:33 am

Re: Forensics or Ethical hacking?

Hey Mambo,

Welcome to EH-Net. I appreciate your enthusiasm, but I think one post will get you answers you need. So I deleted one.

You ask a good but tough question. Career choices are always tough, and it's even tougher helping someone you don't know. That being said, let me see if I can help.

Both sides use tools that the bad guys use, so for each one you get a little taste of the dark side without crossing over. The main difference is that forensics deals specifically with security as it relates to obtaining data that is legally actionable. So if you are extremely meticulous and have an interest in law enforcement, forensics may be for you.

In another post somewhere in this forum, I warn people going into forensics about the type of content you may be asked to obtain and thus see. Not always but often people who act illegally do some things that may turn your stomach.

One other cool thing about forensics, is that you can charge a premium for the simple fact that it is associated with the legal profession, and there are very few truly qualified specialists. That to me screams "OPPORTUNITY!"

Hope this gets the conversation rolling,
Don
CISSP, MCSE, CSTA, Security+ SME
<<

LSOChris

Post Sat Mar 31, 2007 4:26 pm

Re: Forensics or Ethical hacking?

several people i know started pen-testing and moved to forensics because they got tired of popping the same shells over and over because admins cant patch boxes.  forensics would definitely be more of a "challenge" because you have to put pieces back together and try to uncover things people tried to hide.  that being said, like don mentioned, alot of forensics cases deal with kiddie P*rn (KP), i frankly dont want to look at that kind of stuff.  something to take into account if you are going that route.
<<

jimbob

Post Mon Apr 02, 2007 3:57 am

Re: Forensics or Ethical hacking?

One way of getting into forensics while avoiding KP is to look at a role with someone like the Financial Services Authority. They investigate financial crime, fraud (in the UK) and the like so that should keep you away from anything too disturbing.

Jimbob
<<

mn_kthompson

User avatar

Jr. Member
Jr. Member

Posts: 58

Joined: Tue Sep 19, 2006 1:59 pm

Location: Mankato, MN

Post Mon Apr 02, 2007 9:30 am

Re: Forensics or Ethical hacking?

I've been working in IT security for just about a year now, and while I certainly do enjoy my work, I can see that something in my heart is pulling me towards forensics.

The question that raises for me is where do I start?  This isn't the kind of stuff that they teach in college, and while finding stuff on the Internet can be very effective, I literally don't know what it is that I need to know to be effective at the job. 

I can imagine that some classes on evidence collection would be necessary, and that is stuff that I can take here at the university that I work at.  On the computer side, I have access to quite a bit of hardware, and I can make a case for buying some things that I might need.  What I need is a roadmap.  Anyone have any ideas?
<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Mon Apr 02, 2007 9:58 am

Re: Forensics or Ethical hacking?

Although there are plenty of open source tools out there for forensics, there is one commercial tool that stands out from the rest and that is EnCase by Guidance Software. Not only is EnCase an accepted tool by law enforcement and the legal system, but there is also a certification for the product, EnCE. It is the only product specific cert I know of in the forensics field.

I recently went to a road show they had with NetWitness. I think there is still one more day left. Check it out HERE. If you miss it, try researching their products. You won't be sorry.

It was highly informative with live demos of both companies' forensics products as well as presentations on compliance, legal issues, evidence collecting, etc.

The one big thing to take away is that forensics is splitting into 2 camps. Traditional computer forensics remains and it has been joined by network forensics. All cool stuff.

Hope this helps,
Don
Last edited by don on Mon Apr 02, 2007 10:03 am, edited 1 time in total.
CISSP, MCSE, CSTA, Security+ SME
<<

gqblue2003

User avatar

Newbie
Newbie

Posts: 35

Joined: Tue Mar 20, 2007 2:20 am

Location: DC for now.

Post Mon Apr 02, 2007 10:48 pm

Re: Forensics or Ethical hacking?

If you are interested in training in Forensics a few places like DeVry. These classes cover ethics to techniques. Also I know that EnCase is a popular Forensics tool that can run you upwards of 2K. But it is what most people use. Such as the Securities and Exchange Commision (SEC). That is how I got my copy of the manual.
"A man who finds no satisfaction in himself will seek for it in vain elsewhere."
        
                                   La Rochefoucauld
<<

LSOChris

Post Tue Apr 03, 2007 11:41 am

Re: Forensics or Ethical hacking?

i saw an encase book that came with a trial or limited use version. 

i know i dont have 2k just to mess around with the stuff with.

but the trial might be worth checking out.
<<

dean

Post Tue Apr 03, 2007 2:09 pm

Re: Forensics or Ethical hacking?

You should also have a look at Brian Carrier's sleuthkit  http://www.sleuthkit.org/sleuthkit/ . if you are looking to get your feet wet in forensic work it's a good place to start. Also, the Helix Live CD, http://www.e-fense.com/helix/,&nbsp; is a knoppix based distro that is geared towards forensic work. It won't automount drives or swap space keeping the drive you are investigating "clean". Another good site is http://www.opensourceforensics.org/ maintained by Brian Carrier. Securityfocus has a mailing list dedicated to forensics too.

I've used both EnCase and FTK (Forensics Toolkit) and am currently looking at Netwitness for more network forensics work. I personally prefer working with FTK. It's a little more intuitive than EnCase for me.  Encase, in their latest version, do have the ability to access drives and perform forensic work across a network which is a great feature. I know that the FBI uses both products.

The technical aspect of forensics is very, very interesting and satisfying (recreating purposely corrupted files, hunting for data hidden in "bad blocks", etc...) but Chris is right and sometimes you find things you would rather not.

As Don said forensics now includes the network and not just the disk. This means that a broader skillset is going to be needed. Whatever direction you decide on remember that the skills from one discipline can be used to augment another. File Forensic analysis skills are invaluable when doing static or behavioral analysis of malware for example.

-dean-
<<

estriches

Newbie
Newbie

Posts: 29

Joined: Mon Apr 16, 2007 1:56 pm

Post Mon Apr 16, 2007 4:26 pm

Re: Forensics or Ethical hacking?

;) get both and be that much further ahead. while in our C|EH class though we had a young lady that was also taking Forensics at the time and told us that if she had taken the C|EH first then some of the forensics class would have made a little more sense. this was my two cents worth.

Play Hard Play Loyal!
C|EH, C++ programmer

Return to Forensics

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software