🔍 GNFA – GIAC Network Forensic Analyst

🧠 1. Certification Name and Issuing Body

Full Name: GIAC Network Forensic Analyst (GNFA)
Issuing Organization: GIAC (Global Information Assurance Certification), part of SANS Institute
Official Website: https://www.giac.org/certification/network-forensic-analyst-gnfa/

🧩 2. Certification Level and Type

Level: Advanced
Type: Technical

📜 3. Purpose and Goals

Skills Certified:

• Advanced network traffic analysis

• Detection of suspicious and malicious communications

• Reconstruction of network sessions and activities

• Identification of exfiltration, malware communications, and encrypted threats

Target Roles:

• Network Forensic Analyst

• Incident Responder

• Threat Hunter

• SOC Analyst

• DFIR Specialist

Practical Application:

• Blue Team

• Threat Intelligence

• Network Monitoring and Defense

• Post-breach investigations

🎓 4. Prerequisites

Recommended Prior Certifications:

• GCIH or GCIA (for incident handling or intrusion analysis)

• GCFA (if transitioning from host forensics)

Suggested Experience:

• 2+ years in network administration or cybersecurity operations

• Hands-on experience with network traffic capture and analysis

Required Knowledge:

• TCP/IP protocols

• Network architecture and IDS/IPS technologies

• Familiarity with packet capture and protocol analysis tools

📚 5. Content and Curriculum

Key Domains/Modules:

1. Network forensics fundamentals

2. TCP/IP deep dive and session reconstruction

3. IDS/IPS log interpretation

4. PCAP analysis and packet carving

5. HTTP/S, DNS, SMB, and tunneling protocol analysis

6. Detection of beaconing, malware traffic, C2 communication

7. Encryption awareness and SSL/TLS inspection

8. NetFlow, Zeek (Bro), and Wireshark deep usage

9. Threat hunting via network patterns

Tools and Technologies:

• Wireshark

• Zeek (Bro)

• Suricata

• tcpdump

• Tshark

• NetworkMiner

• Argus

• Security Onion

• Snort

• NetWitness

Frameworks Mapping:

• MITRE ATT&CK (especially Network and Command & Control tactics)

• NIST SP 800-94 (Guide to Intrusion Detection and Prevention Systems)

• NICE Framework – Protect & Defend category

🧪 6. Learning Approach

Style: Mixed (Theoretical + Practical)
Labs: Yes – included in official training (SANS FOR572)
Official Materials:

• FOR572: Advanced Network Forensics and Analysis (SANS)

• Lab workbook with PCAPs and case scenarios

Recommended Platforms:

• SANS OnDemand

• Security Onion (for lab practice)

• CyberDefenders.org

• PacketTotal, PCAP analysis practice

• Zeek.org community and tutorials

📝 7. Exam Format and Details

Mode: Online proctored via GIAC exam portal
Duration: 3 hours
Format:

• 66–75 questions

• Multiple choice and scenario-based
  Languages: English
  Retake Policy: Retake allowed after 30 days (fee applies)
  Validity: 4 years

💰 8. Estimated Cost

Exam Fee: ~$949 USD
Course (SANS FOR572): ~$8,000 USD (includes course and one exam attempt)
Renewal Costs: $429 every 4 years

🌍 9. Industry Recognition

Demand: High across sectors with advanced network defense needs (finance, government, critical infrastructure)
Recognized By:

• Government defense and intelligence agencies

• Fortune 500 cybersecurity teams

• Managed Security Service Providers (MSSPs)

Compared to:

• GCIA (more IDS-focused, GNFA is deeper in forensic analysis)

• PCNSA, CCNA Security (vendor-specific and less forensic in nature)

• GNFA stands out for vendor-agnostic deep packet and protocol analysis

💼 10. Career Opportunities

Job Roles:

• Network Forensics Expert

• Cyber Threat Hunter

• SOC Tier 2/3 Analyst

• Incident Responder

• Network Security Engineer

Follow-Up Certifications:

• GCFA or GREM (for full-spectrum forensics)

• GCTI (Cyber Threat Intelligence)

• Offensive path: OSCP (to understand attacker traffic)

💵 11. Average Salary

USA: $110,000 – $145,000 USD
Europe: €70,000 – €110,000 EUR
LATAM: $40,000 – $65,000 USD
Post-Certification Increase: ~15% salary boost, especially in blue team or threat hunting roles

📅 12. Renewal and Maintenance

Validity: 4 years
Requirements:

• 36 CPEs (Continuing Professional Education credits)

• $429 renewal fee

• Optional re-exam instead of CPEs

🧭 13. Final Recommendations

Ideal For:

• Blue Team members seeking to level up in network-level threat detection

• SOC analysts moving into Tier 2+ or threat hunting roles

• DFIR professionals aiming to bridge endpoint and network evidence

Best Time to Pursue:

• After foundational knowledge in networking and cybersecurity

• Prior to or in parallel with GCFA if you want full forensic coverage

Tips and Advice:

• Master Wireshark filters and Zeek scripting early

• Build a lab with Security Onion to practice detection and analysis

• Study common malware traffic patterns and APT C2 frameworks

• Review PCAP-based case studies to build pattern recognition