* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of basic concepts and practices of processing digital forensic data.

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Skill in preserving evidence integrity according to standard operating procedures or national standards.

Knowledge of investigative implications of hardware, Operating Systems, and network technologies.

Skill in analyzing memory dumps to extract information.

Skill in using forensic tool suites (e.g., EnCase, Sleuthkit, FTK).

Collect and analyze intrusion artifacts (e.g., source code, malware, and system configuration) and use discovered data to enable mitigation of potential cyber defense incidents within the enterprise.

Conduct analysis of log files, evidence, and other information in order to determine best methods for identifying the perpetrator(s) of a network intrusion.

Confirm what is known about an intrusion and discover new information, if possible, after identifying intrusion via dynamic analysis.

Provide technical summary of findings in accordance with established reporting procedures.

Examine recovered data for information of relevance to the issue at hand.

Perform file signature analysis.

Skill in conducting forensic analyses in multiple operating system environments (e.g., mobile device systems).

Perform file system forensic analysis.

Knowledge of data carving tools and techniques (e.g., Foremost).

Skill in deep analysis of captured malicious code (e.g., malware forensics).

Skill in using binary analysis tools (e.g., Hexedit, command code xxd, hexdump).

Knowledge of reverse engineering concepts.

Knowledge of anti-forensics tactics, techniques, and procedures.

Knowledge of malware analysis tools (e.g., Oily Debug, Ida Pro).

Skill in analyzing anomalous code as malicious or benign.

Skill in analyzing volatile data.

Skill in identifying obfuscation techniques.

Skill in interpreting results of debugger to ascertain tactics, techniques, and procedures.

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

Knowledge of binary analysis.

Skill in analyzing malware.

Skill in conducting bit-level analysis.

Skill in processing digital evidence, to include protecting and making legally sound copies of evidence.

Ability to conduct forensic analyses in and for both Windows and Unix/Linux environments.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Knowledge of encryption algorithms (e.g., Internet Protocol Security [IPSEC], Advanced Encryption Standard [AES], Generic Routing Encapsulation [GRE], Internet Key Exchange [IKE], Message Digest Algorithm [MD5], Secure Hash Algorithm [SHA], Triple Data Encryption Standard [3DES]).

Knowledge of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.

Knowledge of incident response and handling methodologies.

Knowledge of operating systems.

Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

Knowledge of server and client operating systems.

Knowledge of server diagnostic tools and fault identification techniques.

Knowledge of the common networking protocols (e.g., TCP/IP), services (e.g., web, mail, Domain Name Server), and how they interact to provide network communications.

Skill in developing, testing, and implementing network infrastructure contingency and recovery plans.

Skill in performing packet-level analysis.

Knowledge of basic physical computer components and architectures, including the functions of various components and peripherals (e.g., CPUs, Network Interface Cards, data storage).

Knowledge of file system implementations (e.g., New Technology File System [NTFS], File Allocation Table [FAT], File Extension [EXT]).

Knowledge of processes for seizing and preserving digital evidence (e.g., chain of custody).

Knowledge of hacking methodologies in Windows or Unix/Linux environment.

Knowledge of legal governance related to admissibility (e.g., Federal Rules of Evidence).

Knowledge of processes for collecting, packaging, transporting, and storing electronic evidence to avoid alteration, loss, physical damage, or destruction of data.

Knowledge of types and collection of persistent data.

Knowledge of web mail collection, searching/analyzing techniques, tools, and cookies.

Knowledge of which system files (e.g., log files, registry files, configuration files) contain relevant information and where to find those system files.

Skill in identifying and extracting data of forensic interest in diverse media (i.e., media forensics).

Skill in identifying, modifying, and manipulating applicable system components within Windows, Unix, or Linux (e.g., passwords, user accounts, files).

Skill in collecting, processing, packaging, transporting, and storing electronic evidence to avoid alteration, loss, physical damage, or destruction of data.

Skill in setting up a forensic workstation.

Skill in using virtual machines.

Skill in physically disassembling PCs.

Create a forensically sound duplicate of the evidence (i.e., forensic image) that ensures the original evidence is not unintentionally modified, to use for data recovery and analysis processes. This includes, but is not limited to, hard drives, floppy diskettes, CD, PDA, mobile phones, GPS, and all tape formats.

Decrypt seized data using technical means.

Ensure chain of custody is followed for all digital media acquired in accordance with the Federal Rules of Evidence.

Identify digital evidence for examination and analysis in such a way as to avoid unintentional alteration.

Perform dynamic analysis to boot an “image” of a drive (without necessarily having the original drive) to see the intrusion as the user may have seen it, in a native environment.

Perform hash comparison against established database.

Perform real-time forensic analysis (e.g., using Helix in conjunction with LiveView).

Perform timeline analysis.

Perform real-time cyber defense incident handling (e.g., forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) tasks to support deployable Incident Response Teams (IRTs).

Perform static media analysis.

Perform tier 1, 2, and 3 malware analysis.

Prepare digital media for imaging by ensuring data integrity (e.g., write blockers in accordance with standard operating procedures).

Provide technical assistance on digital evidence matters to appropriate personnel.

Recognize and accurately report forensic artifacts indicative of a particular operating system.

Review forensic images and other data sources (e.g., volatile data) for recovery of potentially relevant information.

Use data carving techniques (e.g., FTK-Foremost) to extract data for further analysis.

Capture and analyze network traffic associated with malicious activities using network monitoring tools.

Use specialized equipment and techniques to catalog, document, extract, collect, package, and preserve digital evidence.

Write and publish cyber defense recommendations, reports, and white papers on incident findings to appropriate constituencies.

Knowledge of types of digital forensics data and how to recognize them.

Knowledge of deployable forensics.

Ability to decrypt digital data collections.

Knowledge of security event correlation tools.

Conduct cursory binary analysis.

Knowledge of legal rules of evidence and court procedure.

Serve as technical expert and liaison to law enforcement personnel and explain incident details as required.

Knowledge of basic system administration, network, and operating system hardening techniques.

Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

Perform virus scanning on digital media.

Perform static analysis to mount an “image” of a drive (without necessarily having the original drive).

Perform static malware analysis.

Utilize deployable forensics tool kit to support operations as necessary.

Skill in one way hash functions (e.g., Secure Hash Algorithm [SHA], Message Digest Algorithm [MD5]).

Knowledge of common forensics tool configuration and support applications (e.g., VMWare, WIRESHARK).

Knowledge of debugging procedures and tools.

Knowledge of how different file types can be used for anomalous behavior.

Knowledge of virtual machine aware malware, debugger aware malware, and packing.

Coordinate with intelligence analysts to correlate threat assessment data.

Knowledge of relevant laws, legal authorities, restrictions, and regulations pertaining to cyber defense activities.

Knowledge of system administration concepts for Unix/Linux and/or Windows operating systems.

Process image with appropriate tools depending on analyst’s goals.

Perform Windows registry analysis.

Perform file and registry monitoring on the running system after identifying intrusion via dynamic analysis.

Enter media information into tracking database (e.g. Product Tracker Tool) for digital media that has been acquired.

Correlate incident data and perform cyber defense reporting.

Maintain deployable cyber defense toolkit (e.g. specialized cyber defense software/hardware) to support IRT mission.

Knowledge of cloud service models and possible limitations for an incident response.

Knowledge of network architecture concepts including topology, protocols, and components.