10. Profession card "Specialist criminalist on digital technologies":

Group code:

2524-0

Code of the name of occupation:

2524-0-008

Name of profession:

The specialist criminalist on digital technologies

Skill level on ORK:

6

qualification subtotal on ORK:

-

Skill level on ETKC, KC, etc. standard qualification characteristics:

Level of professional education:

Education level:

the higher education (bachelor degree, specialist programme, internship)

Specialty:

Information security

Qualification:

-

Requirements to work experience:

Connection with informal and formal education:

Additional professional courses of advanced training in the field of cyber security

Other possible names of profession:

Main objective of activities:

The analysis and investigation of events in which appear computer information as subject to encroachments, the computer as the crime execution tool, and also any digital proofs

Description of labor functions

List of labor functions:

Obligatory labor functions:

1. Investigation of computer crimes

2. Criminalistic examination of digital devices and equipment

Additional labor functions:

Labor function 1:

Investigation of computer crimes

Skill 1:

Primary response to computer crimes

Abilities:

1. Determine sources and origins of incidents;

2. Estimate consequences of the revealed incidents;

3. Identify penetrations into corporate network;

4. Eliminate all established methods of access for malefactors to network of the organization;

5. Analyze structure of origins and circumstance of event;

6. Determine the reason and conditions of change of the software;

7. Mark out properties and signs of information allowing to establish its accessory to certain source;

8. Reveal discrepancies to the available information to its arrangement in system.

Knowledge:

1. Main types of computer crimes;

2. Methods of access for malefactors to network of the organization;

3. The main safety hazards of information and the violator's model in IS of the organization;

4. Principles of creation and functioning of systems and networks of information transfer;

5. the national standard in the sphere of ensuring information security;

6. Technical channels of "leakage" of information;

7. Regulatory legal acts in the field of information security;

8. Reference model of interaction of open systems;

9. Main methods of the organization and carrying out maintenance of technical means of informatization;

10. Organizational measures for information security;

11. Regulations of accounting of the revealed incidents;

12. Formats of storage of information in the analyzed computer system;

13. The main formats of files used in computer systems;

14. Procedure for fixing and documentation of traces of computer crimes, offenses and incidents;

15. Penal legislation of the Republic of Kazakhstan;

16. The legislation in the area administrative offenses of the Republic of Kazakhstan.

Possibility of recognition of skill:

It is not required

Skill 2:

Planning of measures for prevention of breakings and unauthorized access

Abilities:

1. Develop measures for prevention and timely detection of breakings;

2. Run for search of ulikovy information on computers;

3. Reveal methods and means of counter criminalistics: disk enciphering, remote storage of information full;

4. Perform collection of evidential base and its registration / storage;

5. Model real attack to the organization with taking measures to minimization of damage.

Knowledge:

1. Principles of creation and functioning of systems and networks of information transfer;

2. Reference model of interaction of open systems;

3. The national standard in the sphere of information security;

4. The main safety hazards of information and the violator's model in IS of the organization;

5. Methods and means of counter criminalistics;

6. The principles of creation of means of information protection from "leakage" on technical channels;

7. Regulatory legal acts in the field of information security;

8. The main cryptographic methods, algorithms, protocols used for information security in IS;

9. Methods of concealment of ulikovy data from detection;

10. Documentation of information on investigation.

Possibility of recognition of skill:

It is not required

Labor function 2:

Criminalistic examination of digital devices and equipment

Skill 1:

Criminalistic examination of computers

Abilities:

1. Investigate incidents of information security;

2. Fix incident time;

3. Carry out primary diagnostics of the computer device;

4. Work with hardware locks of record and duplicators of data carriers;

5. Work with distribution kits for the criminalistic analysis;

6. Make removal of image (the identical copy) of the hard drive (NMZhD) and other data carriers, including removal of image from the Section or the certain sector of the hard drive;

7. Make processing of the created images of disks;

8. Perform data collection from hard drives;

9. Perform the analysis of the files found on hard drives;

10. Make extraction of data from files;

11. Make research of dump of random access memory;

12. Run for search of artifacts on the hard drive and the periphery;

13. Work with system ravines and magazines of operating systems and application programs;

14. Recover remote data;

15. Perform collection of evidential base and its registration / storage;

16. Conduct researches on availability of PEMIN in means of SVT.

Knowledge:

1. File systems;

2. Operating systems;

3. Basic principles of information security and methods of work of remedies;

4. Tools of computer criminalistics;

5. Device of hard drives and other stores;

6. Architecture and user interfaces of operating systems;

7. Architecture, device and functioning of computing systems;

8. Tools for work with file system, including recovery of data;

9. The main cryptographic methods, algorithms, protocols used for ensuring information security;

10. Methods of interception of information on TKUI;

11. Technique of research of funds of SVT for availability of PEMIN;

12. Technique of carrying out researches of funds of SVT for availability of not declared technical capabilities.

Possibility of recognition of skill:

It is not required

Skill 2:

Criminalistic examination of network devices

Abilities:

1. Make the analysis of network stack and browsers;

2. Make the analysis of email-messages and establish accessory of the e-mail address;

3. Work with tools for creation of dump of network traffic;

4. Perform interception and research of network traffic;

5. Perform research of log of web servers;

6. Establish accessory and arrangement of the IP address;

7. Establish accessory of domain name.

Knowledge:

1. Principles of creation and functioning of systems and networks of information transfer;

2. Reference model of interaction of open systems;

3. Methods and protocols of identification, authentication and authorization in computer networks;

4. Basic principles of carrying out network criminalistics;

6. Data sources for carrying out network criminalistics and their research;

7. Features of tools for creation of dump of network traffic.

Possibility of recognition of skill:

It is not required

Skill 3:

Criminalistic examination of mobile devices

Abilities:

1. Perform identification of the device of mobile communication;

2. Perform cloning of all data from the digital device, the peripheral equipment and stores of information;

3. Perform receipt of information from mobile phones;

4. Perform receipt of information from the SIM card;

5. Perform receipt of information from the built-in and external memory card;

6. Exercise control of mailings, cable and other messages;

8. Work with program and hardware tools for access to data of the mobile phone.

Knowledge:

1. Principles and devices of mobile communication;

2. Hardware-software tools for access to data of the mobile phone;

3. The main cryptographic methods, algorithms, protocols used for ensuring information security;

4. Mobile operating systems;

5. File systems of mobile devices.

Possibility of recognition of skill:

It is not required

Requirements to personal competences:

Responsibility

Resistance to stress

Ability to work in team

Analytical thinking

Critical thinking