EC-Council Certified Incident Handler (ECIH)
EC-Council's Certified Incident Handler program equips students with the knowledge, skills, and abilities to effectively prepare for, deal with, and eradicate threats and threat actors in an incident.
This program provides the entire process of incident handling and response and hands-on labs that teach the tactical procedures and techniques required to effectively plan, record, triage, notify and contain. Students will learn the handling of various types of incidents, risk assessment methodologies, as well as laws and policies related to incident handling. After attending the course, students will be able to create IH&R policies and deal with different types of security incidents such as malware, email security, network security, web application security, cloud security, and insider threat-related incidents.
The E|CIH (EC-Council Certified Incident Handler) also covers post incident activities such as containment, eradication, evidence gathering and forensic analysis, leading to prosecution or countermeasures to ensure the incident is not repeated.
After attending the course, they will be able to create incident handling and response policies and deal with various types of computer security incidents. The comprehensive training program will make students proficient in handling and responding to various security incidents such as network security incidents, malicious code incidents, and insider attack threats.
E|CIH is a specialist-level program that caters to mid-level to high-level cybersecurity professionals. In order to increase your chances of success, it is recommended that you have at least 1 year of experience in the cybersecurity domain. E|CIH members are ambitious security professionals who work in Fortune 500 organizations globally.
-
must have 1 year of work experience in the Information Security domain
-
Be able to provide proof of that work experience during the application process
- Information Security Threats and Attack Vectors
- Attack and Defense Frameworks
- Information Security Concepts
- Information Security Incidents
- Incident Management Process
- Incident Response Automation and Orchestration
- Best Practices for Incident Handling and Response
- Standards and Cybersecurity Frameworks
- Incident Handling Laws and Legal Compliance
- Overview of the IH&R Process
- Step 1: Preparation
- Step 2: Incident Recording and Assignment
- Step 3: Incident Triage
- Step 4: Notification
- Step 5: Containment
- Step 6: Evidence Gathering and Forensic Analysis
- Step 7: Eradication
- Step 8: Recovery
- Step 9: Post-Incident Activities
- Information Sharing Activities
- Concept of First Response
- Securing and Documenting the Crime Scene
- Collecting Evidence at the Crime Scene
- Preserving, Packaging, and Transporting Evidence
- Preparation for Handling Malware Incidents
- Detection of Malware Incidents
- Containment of Malware Incidents
- Malware Analysis
- Eradication and Recovery
- Case Study: Malware Incidents
- Best Practices against Malware Incidents
- Preparation for Email Security Incidents
- Detection and Containment
- Analysis of Email Security Incidents
- Eradication and Recovery
- Case Study: Email Security Incidents
- Best Practices against Email Security Incidents
- Preparation for Network Security Incidents
- Detection and Validation
- Unauthorized Access Incidents
- Inappropriate Usage Incidents
- Denial-of-Service Incidents
- Wireless Network Security Incidents
- Case Study: Network Security Incidents
- Best Practices against Network Security Incidents
- Preparation for Web Application Security Incidents
- Detection and Containment
- Analysis of Web Application Security Incidents
- Eradication and Recovery
- Case Study: Web Application Security Incidents
- Best Practices for Web Applications
- Steps in Handling Cloud Security Incidents
- Azure Security Incidents
- AWS Security Incidents
- Google Cloud Security Incidents
- Case Study: Cloud Security Incidents
- Best Practices against Cloud Security Incidents
- Preparation for Insider Threats
- Detection and Containment
- Analysis of Insider Threats
- Eradication and Recovery
- Case Study: Insider Threats
- Best Practices against Insider Threats
- Handling Endpoint Security Incidents
- Mobile-based Security Incidents
- IoT-based Security Incidents
- OT-based Security Incidents
- Case Study: Endpoint Security Incidents