From 31 March to 5 April 2014 EDA organised together with the SANS Institute a six days pilot course for digital forensics as part of the EDA Cyber Defence Programme to strengthen EU’s Cyber Defence capabilities for CSDP operations. Students from 14 EDA Member States and EDA took part in the course.
On the details of the course and the course delivery one student says: “This was a mind blowing exercise. All the challenges and technical details were covered to a very deep extent.”
The course provided the students with the foundational competencies and skills to enable them to pass the exam for the widely recognised certification as GIAC (Global Information Assurance Certification) Certified Forensic Examiner (GCFE) in the weeks to come.
The course instructor, Mr. Chad Tilbury from SANS Institute says: “As a former military and long-time cyber-defence practitioner, teaching a digital forensics class for the European Defence Agency was an honour. Students from EU member countries conducted in-depth analysis and media exploitation of multiple systems. Attendees conducted data triage and learned to extract forensic meaning from computer memory, files system and operating system artifacts, the Windows registry, email, removable devices, chat clients, web browsers, and event logs. During the final day, students divided into teams and competed in a realistic forensic challenge requiring thousands of artifacts to be recovered, authenticated, and analysed. From the results presented at the end of the forensic challenge, I am confident that this team can take their new skills home and immediately put them to use in real world operations.”
This course is the starting point for a new EDA initiative to pool the demand of EDA Member States for such specialist training that should lead to certifications. Pooling the demand will allow Member States to benefit from economies of scale”.
The EDA Progamme Manager Cyber Defence, Mr. Wolfgang Roehrig says: “In a lot of areas of cyber defence specialist training the military will continue to rely on private sector training capacities and expertise. Therefore EDA is looking for ways for streamlining military training requirements in these fields. The starting point for further exploration was this on-site pilot course at EDA premises for data collection in an area of Cyber Defence expertise, in which the military most probably will continue to rely on industry-expertise, such as Digital Forensics. Digital Forensics training is a highly specialised field, in which, even putting the requirements of all EDA Member States together, relative small numbers of military students per year can be expected. Trainers in that field require special hands-on expertise that has to follow latest trends in attack techniques and technology - mere theoretical knowledge would not bring much benefit. Building-up and maintaining such trainer expertise within the military even at a European level is expected to be difficult and would be very expensive.”
The initiative will be launched within the EDA framework after the final course evaluation.
Background
Heads of State and Government endorsed the EDA Cyber Defence Programme as one of four critical capabilities programmes during the European Council in December 2013. For more information on this programme, read the factsheet.
More information