Higher Certificate in Computer Forensics

Purpose

The purpose of the Higher Certificate in Computer Forensics is to provide learners with the necessary expertise and knowledge to take on appropriate professional positions in the information technology industry and in particular the field of Computer Forensics. This qualification seeks to provide learners with the aptitude and fortitude to deal with the responsibilities connected to the computer forensics field and respond to challenges, both internal and external to the organisation, including the international environment.

It will also equip learners with the technical skills and reflective competences to deal with the broad based cybercrime issues related to optimising the competitive positions of the organisation by acquiring competences relating to computer forensics. In essence, the focus of this qualification is to improve the practice of information security with a special focus on computer forensics. Learners will be able to apply critical technical skills; interrogate specific case situations and apply various computer forensic techniques in the investigation of cybercrime. This approach facilitates the application of theory to practice and practice to theory. Further, the qualification together with the specific mode of delivery seeks to prepare the learners as an effective Computer Forensic Analyst capable of being pro-active and responding positively to dynamically evolving cybersecurity environment, intersecting national and international business practice to ensure uniformity, growth and sustainability.

Rationale

The introduction of Information Commutation and Technology (ICT) into many aspects of everyday life has led to the development of the modern concept of the information society. The availability of ICTs and network-based services offer a number of advantages for society in general, especially for developing countries. ICT applications, such as e-government, e-commerce, e-education, e-health and e-environment, are seen as enablers for development, as they provide an efficient channel to deliver a wide range of services. ICT applications can facilitate the achievement of the Sustainable Development Goals, reducing poverty and improving health and environmental conditions in developing countries. However, the growth of the information society is accompanied by new and serious threats. Essential services such as water and electricity supply now rely on ICTs, as do most businesses and organisations, as well as citizens.

Attacks against information infrastructure and internet services have already taken place, while online fraud and hacking attacks are just some examples of computer-related crimes that are committed on a large scale every day. The financial damage caused by cybercrime is reported to be enormous. This 'digital paradox' means that while governments and organisations can offer more services, more quickly, than ever before, yet at the same time cybercrime has become a powerful countervailing force that's limiting that potential. This has led to an urgent need to find the necessary preventive measures to combat these crimes. As a result, this has led to the comprehensive development of new and improved computer forensic investigation tools and techniques that will assist in the investigation process of these crimes. While technological introduces greater variety and convenience into our lives, it also opens more and more avenues for people to be targeted by cyber criminals. International and domestic cyber criminals increasingly view businesses and private individuals as attractive targets for a range of cybercrime.

Therefore, the rationale for this qualification is based on the need to develop skills in the globally critical area of Computer Forensics. The urgent demand for competent personnel has been increasing over time with the proliferation of cybercrime. This demand is coupled with the need for Computer Forensic expertise in order to apply various computer forensic techniques in the investigation of these crimes. The Higher Certificate qualification is expected to sustain continuous learning and development of learners as well as meet needs of other stakeholders.

The qualification is also designed to address the five critical areas to building a developmental information society as identified by the South African Department of Communications:

• Governance.
• E- Skills Development.
• Small, Medium and Micro Enterprise (SMME) Development.
• Information Ethics.
• ICT Rural Development.

The demand coupled with the statistics of the National Scarce Skills list for South Africa (2015), published by the Department of Labour also identifies scarce and critical skills required by the country. The national demand for Information Technology skills is extracted from this report. With the proliferation of cyber-attacks and the increasing effectiveness of cyber criminals, organisations and indeed nation states are increasingly finding themselves vulnerable and at risk. There is an urgent need to investigate these crimes. Knowledge of the cyber domain, is the first and vital step in being able to analyse a cyber-attack.

Recognition of Prior Learning (RPL)

Recognition of Prior Learning (RPL) is seen as having the capacity to widen access to education and training and to enhance the qualification status of historically disadvantaged adults and youths. By enabling people to apply what they already know and can do, RPL can reduce barriers and create opportunities that will lead to greater social and economic prosperity. The institution recognises the importance of RPL as an admission requirement.

The qualification may be obtained in part through the Recognition of Prior Learning.

In cases where prior learning will be recognised for gaining entrance into the qualification, the following criteria must be satisfied:

• That the learning acquired through work and life experiences will be clearly articulated and supported by evidence in their portfolios, for examination, during the interview process.
• A recommendation from their senior or line managers will be considered.
• Emphasis will be placed on motivation and aspiration of the learner; prior and current job experiences; details of in-house company training, short courses attended, the future vision of the learner.

Entry Requirements

The minimum entry requirement for this qualification is

• National Certificate Vocational, NQF Level 4, granting access to Higher Certificate studies.
• National Senior Certificate, NQF Level 4, granting access to Higher Certificate studies.

This qualification consists of the following compulsory modules at National Qualifications Framework Level 5 totalling 125 Credits:

• Forensic Exploitation and Intelligence, 15 Credits.
• Forensic Science, 15 Credits.
• Forensic Computing Foundations, 15 Credits.
• Internet Forensics, 15 Credits.
• Courtroom Skills, 10 Credits.
• Digital Crime and Investigation, 10 Credits.
• Network Forensics, 15 Credits.
• Advanced Forensic Computing, 15 Credits.
• Work Integrated Learning, 15 Credits.

1. Understand the concepts of digital forensic science.
2. Gain knowledge and understanding of the processes involved in digital forensics investigation.
3. Demonstrate the ability to conduct digital investigations that conform to accepted professional standards.
4. Identify and document potential security breaches of systems and data that suggest violations of acceptable standards.
5. Demonstrate ability to use various tools and techniques for data collection and computer forensic investigations.
6. Demonstrate an understanding of the statutory and regulatory requirements of computer forensic investigation.
7. Demonstrate knowledge of emerging trends in the area of computer forensics.

Associated Assessment Criteria for Exit Level Outcome 1

• Explain the different concepts pertaining to digital forensic science.
• Define terms and explain types of digital forensic science.

Associated Assessment Criteria for Exit Level Outcome 2

• Describe a range of different processes that are used in digital forensics investigation.
• Apply the processes to conduct an investigation.

Associated Assessment Criteria for Exit Level Outcome 3

• Explain the legal, ethical, moral, policy and/or societal standards pertaining to computer forensics investigation.
• Evaluate an investigation as per the expected standards.

Associated Assessment Criteria for Exit Level Outcome 4

• Explain various possible security breaches of systems and data.
• Document the security breaches in a way that lends itself to evaluation and analysis techniques.

Associated Assessment Criteria for Exit Level Outcome 5

• Identify a range of different tools and techniques used in investigating computer crime as well as data collection and analysis.
• Explain how these tools and techniques are used to carry out a forensic investigation.

Associated Assessment Criteria for Exit Level Outcome 6

• Understand the statutory and regulatory requirements of computer forensic investigation.
• Identify laws and regulatory bodies/frameworks that pertain to computer forensic investigation.
• Explain a range of different legal and statutory constraints for computer forensic activity.

Associated Assessment Criteria for Exit Level Outcome 7

• Identify the emerging trends in computer forensics.
• Explain the impact of these trends to the field of computer forensic.

Integrated Assessment

Assessment is integrated with most modules and learners will complete a series of assignments as they progress to build a portfolio. Assignments and tasks are marked and feedback will be given to learners. The feedback will support their learning, achievement of Exit Level Outcomes and prepare them for examinations. Tasks included in portfolios may include projects, case studies, essays, simulations, experiments, assignments, online activities interactions, and presentations. Portfolios will be assessed to determine a module year/semester mark. A minimum of 40% is required for entry into the examination which serves as the summative assessment which evaluates the achievement of outcomes and mastery of the larger body of knowledge which forms part of the curricula. The final examination will be undertaken under normal examination conditions.