Brett's Ramblings

Font size: +
9 minutes reading time (1774 words)

Should you improve your DFIR skills on your personal time?

Almost two years ago, I wrote about burning out in DFIR (“Only race cars should burn out"). I still stand by what I wrote at the time and if you haven’t read the post, take a read of it to maybe get a tip or two that could be helpful for you or someone you know.

I want to peel back one aspect of preventing burning out that some take too far, which is not doing any DFIR activities on your personal time. There is a fine line between work and personal time, in that keeping both separate from each other is healthy and necessary. However, that line is different for each person and it shifts back and forth during each person’s career. The more skilled that you become, the less time you need to maintain your skills. I find it difficult to have a bright line that no DFIR professional development using some personal time is reasonable.

The short version

You may want to consider doing DFIR professional development on your personal time, but that doesn’t mean giving up a good work-life balance.

The longer version.

This post is inspired from several tweets on Twitter that I disagree concerning doing anything in your personal time that is ‘work’ related.  One tweet was that in their personal time, they will sit and watch tv and then come to work and to work hard (paraphrased).  Other tweets were antagonistic to companies who expect applicants to improve job skills on their own time (again, paraphrased).  The attitude is basically, “I will not do anything related to my work skills on my personal time and you can’t make me.”
This is where things get murky. For entry-level peeps fighting to get a toe into the field, there is lots of competition. But read any market analysis and you’ll be shown that there are thousands upon thousands of unfilled positions across the globe. In fact, the more you read and research, it sounds like any person simply thinking about working in DFIR can call any company and be hired sight-unseen. Ask entry-level applicants how they feel about the accuracy of these reports and you may get a different picture. Conversely, hiring managers appear to have the darndest time of finding anyone to fill empty spots. Yes, I understand the intricacies of unreasonable job descriptions, not reaching the target audience, false perceptions, and unreasonable expectations. That is a different topic.

What does this have to do with doing DFIR stuff on your own time?

While in the Marines, I married and my new wife made sure that work and home were separate, and that both lives supported each other. Later, in police work (especially when doing undercover work for years), the line between work and home was still solid, and still supportive of each other.  By supportive, I mean that each life (work and home) had focus during each respective shift, in that, when at work I focused on work and when at home I was an active and involved family participant.  I did my best to avoid working at home and also avoid bringing my family life into work. That was my bright line. Your mileage may vary. Understandably, some things are unavoidable no matter what you do.

Working at home (not working from home)

Working from home is not the same as working at home. By working at home, I mean bringing your work into your home when it should be left at work. You know what I mean…working on that exam or report in your off time, away from work because you “need” to get it done, many times without compensation from your employer.  Doing this on a regular basis cracks open the burnout door. This is working at home when you should be working on home. Any employer who overtly or subtly requires this type of unhealthy work ethic will eventually see the destruction of that employee's home and work life.

Back to those tweets and the competition

I have hired and managed people in the field (and let some go) and although I have never implied or required anyone to work at home, I have fully supported their professional development outside of work hours. This is the difference that I feel is imperative to state. If you want to be a competitive hire, advance in your field, or improve your skills, you probably need to spend some of your off-work time on professional development.

For entry-level positions, it is cutthroat. For higher-level positions, it is cutthroat. For promotions, it is cutthroat. Unless other factors are in play, such as favoritism, every single person competes with everyone else to get the job, the promotion, or even be assigned the “best” cases.  Doesn’t this make sense? Shouldn’t the most qualified person be selected? Of course, it does!

Side note on qualifications: When I say “qualified”, I mean that as competent, which many times has nothing to do with degrees or certifications or tests, but everything to do with being able to do a good job.
Be careful with advice

Listening to advice is risky, but necessary. It is risky because the advice may not apply to you and only apply to the person giving you the advice. It is necessary because none of us know what all of us know. For example, you might be told to “never improve your skills on your own time unless your work pays for it”, or that “you should only improve yourself at work”. This might be good advice to someone who already has a high skill level but terrible advice for someone without experience or recently learned skills.

Take advice with a grain of salt. Maybe it applies to you. Maybe it does not. Either way, you won’t know for sure until the results are in on whether the advice was good or bad (for you) after it is too late to change your mind. In the end, we are each responsible for the decisions we make. Even fully taking the advice from any person that results in absolute failure is the responsibility of the person making the final decision, not the advice-giver.

Professional development

When I hear DFIR professionals encourage new or not-so-new practitioners to not improve themselves on their personal time, I take a look at who is giving that advice. Have they not taken professional development, continuing education, or college courses on their own time away from work? Have they not read a technical book in their free time, or paid for books with their own money? Have they not ever turned on a computer to test a theory that popped in their head while at home? Or have they held true to their advice of only improving their skills while being paid at work which resulted in their current success? My guess is that most have spent quite a bit of time in their personal life to at least be competitive enough to create opportunities for themselves.

Side story: I was given a comp registration (free!) to a DFIR conference that I was speaking at a few years ago to give away. I offered the seat to someone that I felt could use it since he worked less than 10 miles away from the conference venue. His agency approved his attendance at the conference to attend on his work time (vacation not needed!) but the agency wouldn’t pay for his meals as it was physically a 5-minute drive from his office. What was his response? He turned down the conference! He said that he will not spend any time or money outside of work to learn forensics because he expects his agency to pay for everything. I found someone else that took the offer..and they paid for their meals.

I tell this story as an example that there are some decisions on how much sacrifice you are willing to make to improve your skills. In this example, it was the cost of 2 lunches and 1 dinner, which he paid anyway since he certainly ate during those days of the conference while he was at work instead of attending the conference .  For him, his line was absolutely not a penny spent from his pocket or second used from his personal time to better his skills.

The point

Know the distinction between:

** Working at home

** Working from home

** Improving your skills in your personal time

** Improving your skills on your work time

There is a time and place for everything. Manage the time. Manage the place. If you have the belief that your employer is responsible for improving your skills, I can promise that you will be stunted in your skill growth.

It is within your personal time that balance is important to manage. If your personal life fails, your work life will not be far behind. Balance results in the exponential growth of personal and professional, while the imbalance in one or the other will wreck both.

Generally, work time is immovable, and you should only work during work time (minus breaks). You are being paid to work, so this makes sense. Good management ensures that you have a good work workload balance.

Your sleep time should be solid too. Some nights might be shorter than others because of emergencies, but again, generally, you need to maintain good sleep habits. This is your responsibility.

But for your personal time, balance is much more difficult! Family time, hobby time, vacation time, and basic free-to-do-nothing time is bunched together here. This is 100% your responsibility to maintain and balance. You can’t increase it without affecting something else, but you can manage the best use of it. Anything you add to it will decrease some other parts of it.  If you add too much, then sleep gets whittled away. Add more and perhaps work becomes negatively affected.  Or if you stretch out work, your sleep and your personal time gets robbed.

You and I both have 24 hours in a day and cannot change it. It is how we fill that time that matters.

Summed up!

You make your own decisions based on the information you have at your disposal. Balance your personal life with your work life. Maintain balance within your personal life with professional development that benefits your entire timeline and does not detract from it.

You can have a career without any professional development and without ever spending a minute outside of work on your competence building. But you can also choose to spend time, as needed and as reasonable, to develop your skills using some of your personal time.

Stay Informed

When you subscribe to the blog, we will send you an e-mail when there are new updates on the site so you wouldn't miss them.

An expert is just one page in a book ahead of you
TikTok is like a big, greasy cheeseburger. We know...