Growing in Digital Forensics - Practical Mentorship and Resources

Written By Jessica Hyde

As part of the presentation I was honored to deliver at the Magnet Virtual Summit this year, I was able to provide my thoughts on mentorship as it pertains to DFIR, a practical process that I utilize in formal mentorship sessions, and resources. Remember you can be a mentor and mentee at every stage in your journey.

Value of Mentorship

Mentorship is valuable in a variety of ways.  Chances are throughout your schooling and professional career you have encountered someone who has guided you along the way. As you approach mentorship, I encourage you to ask yourself three questions to help you get the most out of your mentorship relationships.

•       What do you plan to get out of mentorship?

•       Has mentorship been of value to you?

•       What are you looking to improve?

Mentors can help with a variety of areas in your career including:

•       Goal Setting

•       Resume reviews

•       Building portfolio

•       How to get noticed

•       Skill growth identification

•       How to produce something

•       How to grow

•       Connections

•       Resources

Types of Mentorships

Mentorship can exist in a variety of contexts – both informal and formal.  Formal mentorship could be with your employer or could be an external relationship. It could be part of a formal program or it could be a relationship between you and your mentor directly where you meet at a regular cadence to work on your growth. There is also informal mentorship. This is anytime you seek advice from others. This could be someone in your field or in another area who can help guide you. Informal relationships often exist between peers and can be bidirectional. Even if you didn’t intent do have these, you may have naturally entered informal mentorship with others.

There is great value to having a mentor within the structure of your employment. An internal mentor can serve as your advocate for reviews, promotions, and even when there is an adverse action. They can help you navigate workplace politics and the nuance of your organization’s hierarchy. Sometimes, workplace mentors are assigned – this can be a positive or negative depending on if your assigned mentor takes initiative or is merely mediocre. If you don’t feel your mentor is providing the advocacy or value that you need, I encourage you to seek out other mentors in your organization – even if they aren’t assigned that role formally. Remember, these folks do not need to be in the same role or career path as you. They could be valuable in other aspects of your growth. Of course, it is great to have external relationships as well and I recommend that you additionally have mentor relationships external to your workspace.

Practical Mentorship

The following is the process that I use in the formal mentorship relationships I have – both with my internal and external teams. I hope that this process can provide value to you and that you can tweak it to make it work with your personal leadership style.

Before you start – Resume Review

I always request new and prospective mentees send me their resume BEFORE our first meeting. This provides a starting point for when you meet. This, along with some OSINT (Open Source Intelligence) can help you get to know them a bit better. It is also a great way to draft some questions about areas where you want to know more about their experience. Folks sometimes struggle to talk about all their strengths on their resume. Having reviewed it and being able to provide some feedback and ask questions bout their skills can help. For those folks that are sending a resume to your mentor – remember this should be all encompassing, not the same as what you would select to send to an employer.

First meeting - Introduction

I recommend that the first meeting be around 30-45 minutes. This is a listening session to learn about your mentee. Focus on open ended questions and natural conversation to get to know them. This is a great opportunity to walk through the resume provide feedback and suggest areas for improvement to the resume. The next few minutes can be spent inquiring about what the mentee hopes to gain from the mentorship. Based on this, the mentee should walk away with two action items 1) update resume and 2) draft professional and personal goals.  The mentee should send the update resume to the mentor before the second meeting.

Keys for the first meeting:

  • 30-45 minutes in length

  • Open ended questions

  • Get to know you session.

  • Resume review

  • Goals for mentorship

  • Action steps for next meeting:

    • Update resume

    • Draft personal/professional goals.

               

Second meeting – Goal Setting

The goal of the second meeting is to draft goals. I find this tends to be a longer session at 45-55 minutes in length. This is a great time to discuss regular updates to a curriculum vitae (CV) and to your Linked In profile. I recommend that since a mentor is actively growing, that they should be updating this at least monthly. During this meeting, based on the goals that the mentee thought about since the first meeting, the mentor and mentee can work together to determine three specific goals. Goals should be specific, time based, and focus on areas that the mentee is passionate about or areas to help them get to the next step they are trying to obtain professionally or personally. Additionally, if mutually agreeable, this session should conclude with a cadence of maintenance meetings to work toward goals.

Keys for the Second Meeting

  • 45-55 minutes in length

  • Discussion of CV maintenance

  • Development of 3 goals

  • Determine maintenance meeting cadence.

  • Action steps for next meeting:

    • Based on goals that were developed

 

Check-in Meetings

Maintenance meetings can be either 15 or 30 minutes depending on the needs of the mentee. I have this scheduled differently with each mentee. However, the structure of the meeting is the same. These regular sessions have 4 steps – discuss actions taken to goals, identify missed opportunities, discuss what help the mentor can provide, and then device next steps.  The mentee answers the 3 first 3 questions, the mentor then answers the same three questions and then they both work to develop the next steps before the next meeting. Here is the outline I use each session. I use this as a template and fill in the answers on a living document with each mentee.

1)      Goal Review

2)      Mentee answers:

a.       What have I done towards my goal?

b.      What are missed opportunities towards my goal?

c.       How can my mentor help me?

3)      Mentor Answers

a.       How have I observed you meeting goal

b.      What are areas for refinement?

c.       How can I help the mentee?

4)      Draft Action Steps

 

Creating action items from goals is a critical step.  Goals should be the larger item that takes 6 months to a year to complete where the action items are the discrete steps that can be taken to reach that coal. For example, if the goal is to obtain a digital forensics certification, some of the steps may include researching desired roles and the certs that are required for those positions, determining which certification to obtain, determine prerequisites for the certification, create a study plan, register for the certification, specific study section, practice tests, take the exam.  I wouldn’t typically draft those all out as steps at once but add one action item each session to the discussion. These action items should be developed by both the mentor and mentee in collaboration.

Goal adjustment meetings

It is important throughout the maintenance check-in phase to assess goals at regular intervals. I will typically schedule a longer session to work through and discuss if original goals are still a good fit. This is a great opportunity to make goals more specific. Here we can adapt changes from learnings or due to life changes. As goals are adjusted, ensure they are measurable. A common framework that is used is SMART goals which stands for specific, measurable, achievable, relevant, and time bound.

Finding a mentor

A lot of folks will seek out a mentor as someone to aid with advice, connection, seeing things that the mentee doesn’t see in themselves, help prepare for a professional or personal change, have someone in your corner, and to obtain critical feedback.   I recommend that mentees seek out someone who they share an interest. This is an opportunity to find someone who is doing what you want to be doing – be it immediately or in the distant future. A great way to connect is to offer to collaborate. Remember, a mentor is more likely to help someone who does the work and shares information.

Please don’t be discouraged if the person you identify for mentorship is unavailable. Some folks receive many of these requests per week and cannot possibly respond to and help all of them. Please respect that they may not have the cycles to help at this time or at all. That is okay! You may need to reach out to other folks. In general, forensics examiners are very giving with their time to the community but work and family demands can ebb and flow.  

 

Formal Mentorship Programs

Another way to find a mentor is through formal mentorship programs. These are programs where mentors or mentees can apply WiCyS (Women in Cybersecurity) Mentor Mentee Program Applications for 2023 open March 1, 2023!  Another great program that I have participated in is #ShareTheMicInCyber. This program pairs allies with Black cyber practitioners to help promote the practitioner’s work and contributions. There are also programs like Play Like a Girl that pair mentors with youth. Of course there are programs like the Magnet Mentorship Day each year and Resume Review Clinics at a variety of conferences. I have met great folks and formed long term relationships with folks from both events. I encourage you to participate in these programs as a mentor or mentee. Some additionally offer mentor training and structure which I have found very helpful.

Resources

There are a variety of blogs and resources to help folks with mentorship.  Below is a list of several that may be helpful.

 Networking groups

 Conferences

Keeping Current

Standards Groups

Journals and Peer Reviewed Works

 I hope that you find the practical mentorship format discussed here and the rescources provided useful in your journey in Digital Forensics and in working with others. If you have any questions - feel free to reach out to us at hexordia@hexordia.com or on social media.

 

Jessica Hyde
Previous

What's brewing with IPAs - Working with IPA files for Forensic Examiners
Next

Pathway to Digital Forensics