On top of all that, most of the larger botnets are like playing whack-a-mole, where killing off one “head” leads to the generation of 5 more.

There are other (and better) ways to crack this nut.

It would be far better to analyze the protocol and command structure and pass that to to law enforcement or folks in the security community that track and act on discovered botnets.

Remember that a discovered active botnet should be treated like any other e-crime evidence.

A problem I have with certain certifications is that many of them are “business interests” created by businesses or business people with the purpose to make a profit. While this is no different to a university in a certain sense, there is generally some level of regulatory oversight. So if I wanted to, I could set up a business, and with some slick marketing create the next big thing in computer forensics, design a certification, and make money (not that I plan to before I get flamed into oblivion).

What I think we need are certifications created by non-profit bodies (and the non-profit will limit the numbers of these I am sure), who are made up of the members of the body, and who self-regulate themselves and the certification. In other words, a self-regulating professional body, which could issue appropriate certifications, enforce a code of practice or conduct etc. I know there is some work being done in this regard, but as digital forensic practitioners who are passionate about our discipline, we need to do more.

Since then over the years, I have found the same with many certifications, SANS, Cisco, CISSP you name it. Sure, you have your ones that are good, but the number of bad ones is staggering to me. Your statement about needing base knowledge is nice, but unfortunately I don’t think that will help.
I have some certifications in BGP, protocol analysis, switching. I got them because the company forced me to in order to work with the products. They have been of no value to me, just a bunch of “letters” and a incremental count for the marketing departments on “the number of people certified on our system.”

Recently, I was told that I should really have a ‘certification’ in order to look at network traffic. I have been doing research and analysis on network traffic, attack patterns, botnets, protocol analysis for years as part of my daily activities. I have trained many companies on network analysis. Really, I need to be certified? If I need to I will, but I think it is silly. It ends up giving employers a false sense of security. They will take the guy who is certified with 3 years experience, over the individual that has 10 years experience and think they are better off — rarely is that the case in my experience.

You comment on needing a drivers license, babysitters license, plumbing license etc. etc. Just because everyone does it, doesn’t make it the right thing to do. Heck, I can get a firearm license without ever having to lay my eyes on a firearm, let alone use one. My father never had a firearm license, but I’d suggest you are safer with him working one than I (even if I had a license, which I do not) — he grew up using them regularly.
Another ‘problem’ I have noticed with certifications are that overtime they get “watered down”. One of the reasons this happens is that there becomes pressure to get large numbers certified due to multiple certifications and competition with other businesses and certification standards.

My hope is that if there are certifications in forensics, they don’t end up following the path of the multitude of other certifications. Don’t do it. Use word of mouth, references, and experience to determine the best fit. If you must do it, Do it right, spend lots of money, time, and transparency determining the best solution and don’t let business and politics get in the way.

In my 12 years in IT, and 8 in security, I’ve found that the only certifications that produce consistently reliable professionals are those which strictly require demonstrated application of knowledge. I was one of the ones screaming when SANS split certifications to Silver and Gold, because I felt it would cheapen the certification. I feared the many with Silver would not specify the level of their cert, and the public would only see “GCIA” for example. I still feel this way, and sadly, believe that this has played out over time.

Application of knowledge is one thing that distinguishes the CCIE from the myriad other Cisco certifications, to give a slightly different example. While I’m sure they exist, I’ve never met an unqualified CCIE. I’ve met plenty of unqualified SANS cert holders. Because the distinction between applied knowledge and lack thereof is so difficult to see, of course, I have no idea whether these folks have gone through the practical – although I certainly doubt it.

I do not put much weight in test-only certifications because anyone can memorize some stuff for a short period of time. If SANS wants to raise the bar, they need to make the difference between demonstrated applied knowledge and multiple-choice, test-only certifications unambiguous – especially for someone not in our industry like HR generalists, contract authors, proposal writers, and policymakers.

-Mike