Information security and forensics analyst: What I do
About this video
Ramel Prasad, 20, works at CI Security as both an information security analyst and a forensics analyst. He explains how analysts watch network data for suspicious activity, how forensics work investigates whether data was stolen from a compromised machine, and why learning from experienced colleagues matters.
You'll be able to
- describe what an information security analyst does.
- explain the steps of a forensics investigation.
- explain why learning from experienced colleagues helps a new analyst grow.
Key words
- Information security analyst
- Someone who monitors computer systems and network data to spot suspicious activity.
- Forensics analyst
- Someone who investigates a computer after an incident to find out what happened.
- Dashboard
- A screen that shows key data and statistics in one place.
- Compromised
- Broken into or taken over by an attacker.
- Exfiltrated
- Secretly copied or taken out of a network by an attacker.
- Evidence
- Information that is kept carefully to show what really happened.
Transcript
My name is Ramel Prasad. I am 20 years old and I work at CI Security and I play a hybrid role of being an information security analyst and a forensics analyst. So CI Security, we strictly focus on computer security. Being a security analyst, being a forensics analyst you know, you're solving puzzles, you're trying to see what happened next, you're trying to put a timeline of events that occurred.
We have all of these statistics on a dashboard so it's my job as an analyst to dive into the dashboard and really use my knowledge to see, what is suspicious, what's normal. We have to really disintegrate that traffic. It's extremely important that you learn in the process of investigating.
I think just having that people around me, that's been in this industry for like 20, 25 years and just like asking them, hey what would you do because I'm in this scenario right now? And just having that advise from them, I think it helps me a lot and it helps me grow in this company and not only the company but my career in general.
Say that I'm a information security analyst and I see something that's compromised and according to the client, it's like a very critical system on their network and say that they had sensitive information on that laptop or something. If they want to proceed with forensics and see if any data was exfiltrated off the network or any other inbound connections coming from other places like Russia and stuff that would be my responsibility too, to go in to the client's site, preserve the evidence, bring it back to the forensics lab and analyze it, just digest through the whole hard drive and conclude everything, wrap it up in a report and deliver it back to say yes data was in fact exfiltrated or no it wasn't,
you guys are good and you guys can reimage the machine or whatever you want with it. The thing I love the most about this company, is that they let me do what I want, when I want. And what I mean by that is, like I'm still in school right now, so being a security analyst is a little bit more laid back, being a consultant.
Because consultant is heavy work, you know, you're working with the client, you have deadlines to meet, you have report writing to do, as compared to being a security analyst, you know you just simply monitoring the data. When summer comes and when I have more time that's when I really dive into, you got any clients in the funnel, let's do some security, let's do some forensics work, and let's knock out some clients and make our company look great, right?
Video © Khan Academy, used under CC BY-NC-SA. Watch on Khan Academy. Puzzicle is not affiliated with Khan Academy.