Hey, so I’m not sure who needs to hear this, but there’s a debate in cybersecurity as to if incident response can even ^be* an entry level job. I won’t even wade into that, but at a minimum to do traditionally defined DFIR / incident response you need some fundamentals.. (thread)
An “entry level” incident responder already has strong high level knowledge of security concepts like how hackers work, common attack and lateral movement vectors, and ways systems can be infected / exploited.
They should also have moderate knowledge of disk, memory, and network forensics. Being able to analyze evidence and figure out if and how a computer was infected is an important part of our jobs.
Of course, this means good foundational knowledge of how computers and orgs work. From how the internet, packets, and networks work, to how operating systems, system administration, ops, scripts, and programs work.
That’s needed to understand and analyze how incidents happened.
That’s needed to understand and analyze how incidents happened.
After *all that* comes the incident response and handling skills - IR methodology, investigation processes, time-lining, report writing, and presenting findings. Those are crucial, but the tech and experiential fundamentals glue them all together.
I *personally* think it’s totally possible to create a training pipeline that takes someone off the street and gets them to this end state. But first, both employers and candidates have to realize there *is* a substantial pipeline with a lot of requisite skills and ops exposure.
I’m not trying to turn this into a “can you / can’t you” debate on entry level DFIR. However, I see more candidates and orgs trying to put people into IR roles without the tools they need. We should do much better at getting people the training and experience they deserve. (FIN)
• • •
Missing some Tweet in this thread? You can try to
force a refresh
