Overview
The EC-Council Certified Incident Handler (ECIH) program is designed to provide the fundamental skills to handle and respond to the computer security incidents in an information system. The course addresses various underlying principles and techniques for detecting and responding to current and emerging computer security threats.
Students will learn how to handle various types of incidents, risk assessment methodologies, and various laws and policies related to incident handling. After attending this course, they will be able to create incident handling and response policies as well as deal with various types of computer security incidents.
The IT incident management training program will enable students to be proficient in handling and responding to various security incidents such as network security incidents, malicious code incidents, and insider attack threats. In addition, students will learn about computer forensics and its role in handling and responding to incidents. The course also covers incident response teams, incident management training methods, and incident recovery techniques in detail.
The ECIH certification will provide professionals greater industry acceptance as the seasoned incident handler.
Target Audience
This course will significantly benefit incident handlers, risk assessment administrators, penetration testers, cyber forensic investigators, vulnerability assessment auditors, system administrators, system engineers, firewall administrators, network managers, IT managers, IT professionals and anyone who is interested in incident handling and response.
Outline
Module 01: Introduction to Incident Response and Handling
- Cyber Incident Statistics
- Computer Security Incident
- Information as Business Asset
- Data Classification
- Common Terminologies
- Information Warfare
- Key Concepts of Information Security
- Vulnerability, Threat, and Attack
- Types of Computer Security Incidents
- Examples of Computer Security Incidents
- Verizon Data Breach Investigations Report – 2008
- Incidents That Required the Execution of Disaster Recovery Plans
- Signs of an Incident
- Incident Categories
- Incident Categories: Low Level
- Incident Categories: Middle Level
- Incident Categories: High Level
Incident Prioritization
Incident Response
Incident Handling
- Use of Disaster Recovery Technologies
- Impact of Virtualization on Incident Response and Handling
- Estimating Cost of an Incident
- Key Findings of Symantec Global Disaster Recovery Survey - 2009
- Incident Reporting
- Incident Reporting Organizations
- Vulnerability Resources
Module 02: Risk Assessment
- Risk
- Risk Policy
- Risk Assessment
- NIST’s Risk Assessment Methodology
Step 1: System Characterization
Step 2: Threats Identification
Step 3: Identify Vulnerabilities
Step 4: Control Analysis
Step 5: Likelihood Determination
Step 6: Impact Analysis
Step 7: Risk Determination
Step 8: Control Recommendations
Step 9: Results Documentation
- Steps to Assess Risks at Work Place
Step 1: Identify Hazard
Step 2: Determine Who Will be Harmed and How
Step 3: Analyze Risks and Check for Precautions
Step 4: Implement Results of Risk Assessment
Step 5: Review Risk Assessment
- Risk Analysis
Need for Risk Analysis
Risk Analysis: Approach
- Risk Mitigation
Risk Mitigation Strategies
- Cost/Benefit Analysis
- NIST Approach for Control Implementation
- Residual Risk
- Risk Management Tools
CRAMM
Acuity STREAM
Callio Secura 17799
EAR / Pilar
Module 03: Incident Response and Handling Steps
- How to Identify an Incident
- Handling Incidents
- Need for Incident Response
- Goals of Incident Response
- Incident Response Plan
Purpose of Incident Response Plan
Requirements of Incident Response Plan
Preparation
- Incident Response and Handling Steps
Step 1: Identification
Step 2: Incident Recording
Step 3: Initial Response
Step 4: Communicating the Incident
Step 5: Containment
Step 6: Formulating a Response Strategy
Step 7: Incident Classification
Step 8: Incident Investigation
Step 9: Data Collection
Step 10: Forensic Analysis
Step 11: Evidence Protection
Step 12: Notify External Agencies
Step 13: Eradication
Step 14: Systems Recovery
Step 15: Incident Documentation
Step 16: Incident Damage and Cost Assessment
Step 17: Review and Update the Response Policies
- Training and Awareness
- Security Awareness and Training Checklist
- Incident Management
Purpose of Incident Management
Incident Management Process
Incident Management Team
- Incident Response Team
Incident Response Team Members
Incident Response Team Members Roles and Responsibilities
Developing Skills in Incident Response Personnel
Incident Response Team Structure
Incident Response Team Dependencies
Incident Response Team Services
- Defining the Relationship between Incident Response, Incident Handling, and Incident Management
Incident Response Best Practices
Incident Response Policy
Incident Response Plan Checklist
Incident Handling System: RTIR
RPIER 1st Responder Framework
Module 04: CSIRT
- What is CSIRT?
- What is the Need of an Incident Response Team (IRT)
- CSIRT Goals and Strategy
- CSIRT Vision
- Common Names of CSIRT
- CSIRT Mission Statement
- CSIRT Constituency
- CSIRT Place in the Organization
- CSIRT Relationship with Peers
- Types of CSIRT Environments
- Best Practices for creating a CSIRT
Step 1: Obtain Management Support and Buy-in
Step 2: Determine the CSIRT Development Strategic Plan
Step 3: Gather Relevant Information
Step 4: Design your CSIRT Vision
Step 5: Communicate the CSIRT Vision
Step 6: Begin CSIRT Implementation
Step 7: Announce the CSIRT
Step 8: Evaluate CSIRT Effectiveness
- Role of CSIRTs
- Roles in an Incident Response Team
- CSIRT Services
Reactive Services
Proactive Services
Security Quality Management Services
- CSIRT Policies and Procedures
Attributes
Content
Validity
Implementation, Maintenance, and Enforcement
- How CSIRT Handles a Case
- CSIRT Incident Report Form
- Incident Tracking and Reporting Systems
Application for Incident Response Teams (AIRT)
BMC Remedy Action Request System
PGP Desktop Email
The GNU Privacy Guard (GnuPG)
Listserv
- CERT
- CERT-CC
- CERT(R) Coordination Center: Incident Reporting Form
- CERT:OCTAVE
OCTAVE Method
OCTAVE-S
OCTAVE Allegro
- World CERTs
Australia CERT (AUSCERT)
Hong Kong CERT (HKCERT/CC)
Indonesian CSIRT (ID-CERT)
Japan CERT-CC (JPCERT/CC)
Malaysian CERT (MyCERT)
Pakistan CERT (PakCERT)
Singapore CERT (SingCERT)
Taiwan CERT (TWCERT)
China CERT (CNCERT/CC)
US-CERT
Government Forum of Incident Response and Security Teams (GFIRST)
Canadian CERT
Forum of Incident Response and Security Teams
CAIS/RNP
NIC BR Security Office Brazilian CERT
EuroCERT
FUNET CERT
SURFnet-CERT
DFN-CERT
JANET-CERT
CERT POLSKA
Swiss Academic and Research Network CERT
- http://www.first.org/about/organization/teams/
- http://www.apcert.org/about/structure/members.html
- IRTs Around the World
Module 05: Handling Network Security Incidents
- Denial-of-Service Incidents
- Distributed Denial-of-Service Attack
- Detecting DoS Attack
- Incident Handling Preparation for DoS
DoS Response Strategies
Preventing a DoS Incident
Following the Containment Strategy to Stop DoS
- Unauthorized Access Incident
Detecting Unauthorized Access Incident
Incident Handling Preparation
Incident Prevention
Following the Containment Strategy to Stop Unauthorized Access
Eradication and Recovery
Recommendations
- Inappropriate Usage Incidents
Detecting the Inappropriate Usage Incidents
Incident Handling Preparation
Incident Prevention
Recommendations
- Multiple Component Incidents
Preparation for Multiple Component Incidents
Following the Containment Strategy to Stop Multiple Component Incidents
Recommendations
- Network Traffic Monitoring Tools
Ntop
EtherApe
Ngrep
SolarWinds: Orion NetFlow Traffic Analyzer
Nagios: op5 Monitor
CyberCop Scanner
- Network Auditing Tools
Nessus
Security Administrator's Integrated Network Tool (SAINT)
Security Auditor's Research Assistant (SARA)
Nmap
Netcat
Wireshark
Argus - Audit Record Generation and Utilization System
Snort
- Network Protection Tools
Iptables
Proventia Network Intrusion Prevention System (IPS)
NetDetector
TigerGuard
Module 06: Handling Malicious Code Incidents
- Count of Malware Samples
- Virus
- Worms
- Trojans and Spywares
- Incident Handling Preparation
- Incident Prevention
- Detection of Malicious Code
- Containment Strategy
- Evidence Gathering and Handling
- Eradication and Recovery
- Recommendations
- Antivirus Systems
Symantec: Norton AntiVirus 2009
Kaspersky Anti-Virus 2010
AVG Anti-Virus
McAfee VirusScan Plus
BitDefender Antivirus 2009
F-Secure Anti-Virus 2009
Trend Micro AntiVirus plus AntiSpyware 2009
HijackThis
Tripwire Enterprise
Stinger
Module 07: Handling Insider Threats
- Insider Threats
- Anatomy of an Insider Attack
- Insider Risk Matrix
- Insider Threats Detection
- Insider Threats Response
- Insider’s Incident Response Plan
- Guidelines for Detecting and Preventing Insider Threats
Human Resources
Network Security
Access Controls
Security Awareness Program
Administrators and Privileged Users
Backups
- Audit Trails and Log Monitoring
- Employee Monitoring Tools
Activity Monitor
Net Spy Pro
Spector Pro
SpyAgent
Handy Keylogger
Anti Keylogger
Actual Spy
IamBigBrother
007 Spy Software
SpyBuddy
SoftActivity Keylogger
Elite Keylogger
Spy Sweeper
Module 08: Forensic Analysis and Incident Response
- Computer Forensics
- Objectives of Forensics Analysis
- Role of Forensics Analysis in Incident Response
- Forensic Readiness
- Forensic Readiness And Business Continuity
- Types of Computer Forensics
- Computer Forensic Investigator
- People Involved in Computer Forensics
- Computer Forensics Process
- Digital Evidence
- Characteristics of Digital Evidence
- Collecting Electronic Evidence
- Challenging Aspects of Digital Evidence
- Forensic Policy
- Forensics in the Information System Life Cycle
- Forensic Analysis Guidelines
- Forensics Analysis Tools
Helix
- Tools Present in Helix CD for Windows Forensics
Windows Forensic Toolchest
Knoppix Linux
The Coroner's Toolkit (TCT)
EnCase Forensic
THE FARMER'S BOOT CD (FBCD)
DumpReg
DumpSec
DumpEvt
Foundstone Forensic ToolKit
Sysinternals Suite
NSLOOKUP
dig – DNS Lookup Utility
Whois
VisualRoute
Netstat Command
Linux: DD Command
Linux: Find Command
Linux: Arp Command
Linux: ps, ls, lsof, and ifconfig Commands
Linux: Top Command
Linux: Grep Command
Linux: Strings Command
Module 09: Incident Reporting
- Incident Reporting
- Why to Report an Incident
- Why Organizations do not Report Computer Crimes
- Whom to Report an Incident
- How to Report an Incident
- Details to be Reported
- Preliminary Information Security Incident Reporting Form
- CERT Incident Reference Numbers
- Contact Information
Sample Report Showing Contact Information
- Summary of Hosts Involved
Sample Report Showing Summary of Hosts Involved
- Description of the Activity
Sample Report Showing Description of the Activity
- Log Extracts Showing the Activity
Example Showing the Log Extracts of an Activity
- Time Zone
- Federal Agency Incident Categories
- Organizations to Report Computer Incident
United State Internet Crime Task Force
Internet Crime Complaint Center (IC3)
Computer Crime & Intellectual Property Section
Internet Watch Foundation (IWF)
- Incident Reporting Guidelines
- Sample Incident Reporting Form
- Sample Post Incident Report Form
Module 10: Incident Recovery
- Incident Recovery
- Principles of Incident Recovery
- Incident Recovery Steps
- Contingency/Continuity of Operations Planning
- Business Continuity Planning
- Incident Recovery Plan
- Incident Recovery Planning Process
Incident Recovery Planning Team
Business Impact Analysis
Incident Recovery Plan Implementation
Incident Recovery Training
Incident Recovery Testing
Module 11: Security Policies and Laws
- Security Policy
- Key Elements of Security Policy
- Goals of a Security Policy
- Characteristics of a Security Policy
- Design of Security Policy
- Implementing Security Policies
- Acceptable Use Policy (AUP)
- Access Control Policy
Sample Access Control Policy
Importance of Access Control Policies
- Asset Control Policy
- Audit Trail Policy
Sample Audit Trail Policy 1
Importance of Audit Trail Policy
- Logging Policy
Importance of Logging Policies
- Documentation Policy
- Evidence Collection Policy
- Evidence Preservation Policy
- Information Security Policy
Information Security Policy: University of California
Information Security Policy: Pearce & Pearce, Inc.
Importance of Information Security Policy
- National Information Assurance Certification & Accreditation Process (NIACAP) Policy
Importance of NIACAP Policy
- Physical Security Policy
Sample Physical Security Policy 1
Sample Physical Security Policy 2
Importance of Physical Security Policies
- Physical Security Guidelines
- Personnel Security Policies & Guidance
- Law and Incident Handling
Role of Law in Incident Handling
Legal Issues When Dealing With an Incident
Law Enforcement Agencies
- Laws and Acts
Searching and Seizing Computers without a Warrant
- A: Fourth Amendment’s “Reasonable Expectation of Privacy” in Cases Involving Computers: General Principles
- A.4: Private Searches
The Privacy Protection Act
Federal Information Security Management Act (FISMA)
Mexico
Brazilian Laws
Canadian Laws
United Kingdom’s Laws
Belgium Laws
German Laws
Italian Laws
Cybercrime Act 2001
Information Technology Act
Singapore Laws
Sarbanes-Oxley Act
Social Security Act
Gramm-Leach-Bliley Act
Health Insurance Portability and Accountability Act (HIPAA)
- Intellectual Property Laws
Intellectual Property
US Laws for Trademarks and Copyright
Australia Laws For Trademarks and Copyright
UK Laws for Trademarks and Copyright
China Laws for Trademarks and Copyright
Indian Laws for Trademarks and Copyright
Japanese Laws for Trademarks and Copyright
Canada Laws for Trademarks and Copyright
South African Laws for Trademarks and Copyright
South Korean Laws for Trademarks and Copyright
Belgium Laws for Trademarks and Copyright
Hong Kong Laws for Intellectual Property
Cyber Security learning paths
Want to boost your career in cyber security? Click on the roles below to see QA's learning pathways, specially designed to give you the skills to succeed.
= Required
= Certification
AppSec
Cloud Security
Cyber Management
Cyber Security Risk
Cyber Tech
DFIR Digital Forensics & Incident Response
Industrial Controls OT
NIST Pathway
Offensive Security
Privacy
Security Auditor
Secure Coding
Cyber Blue Team
Vulnerability Assessment & Penetration Testing
Emerging Tech
Business Continuity & Resilience
Counter Fraud
AppSec
Average salary: £67,250
Fundamentals
Fundamentals
Intermediate
Intermediate
Cloud Security
Average salary: £80,000
Fundamentals
Fundamentals
Intermediate
Intermediate
Certified Lead Cloud Security Manager
QACLCSM
4 Days
£2,450 ex VAT
View course
Certificate in Cloud Security Knowledge(CCSK+)
CCSKPLUS
3 Days
£2,070 ex VAT
View course
Hacking and Securing Cloud Infrastructure
QACLOUDHA
4 Days
£2,280 ex VAT
View course
Application Security in the Cloud
QASCACLS
3 Days
£2,775 ex VAT
View course
Cyber Management
Average salary: £80,000
Fundamentals
Fundamentals
Intermediate
Intermediate
Cyber Security Risk
Average salary: £57,000
Fundamentals
Fundamentals
Intermediate
Intermediate
Cyber Tech
Average salary: £72,000
Fundamentals
Fundamentals
Intermediate
Intermediate
DFIR Digital Forensics & Incident Response
Average salary: £74,000
Fundamentals
Fundamentals
Intermediate
Intermediate
Industrial Controls OT
Average salary: £55,000
Fundamentals
Fundamentals
Intermediate
Intermediate
NIST Pathway
Average salary: £68,000
Fundamentals
Fundamentals
Intermediate
Intermediate
Offensive Security
Average salary: £75,500
Intermediate
Intermediate
Privacy
Average salary: £55,000
Fundamentals
Fundamentals
Certified Information Privacy Professional
QACIPP
2 Days
£2,965 ex VAT
View course
Certified Data Protection Foundation (GDPR)
QACDPF
2 Days
£1,465 ex VAT
View course
Certified Information Privacy Professional Online
CIPPE-ONLINE
£1,150 ex VAT
View course
Foundations of Privacy and Data Protection
QAPRIVFOU
1 Day
£565 ex VAT
View course
Security Auditor
Average salary: £65,000
Fundamentals
Fundamentals
Intermediate
Intermediate
Secure Coding
Average salary: £67,250
Fundamentals
Fundamentals
Intermediate
Intermediate
Expert
Expert
Cyber Blue Team
Average salary: £42,000
Fundamentals
Fundamentals
Intermediate
Intermediate
Security Operations and Defensive Analysis (SOC-200)
QAOSDA
£1,800 ex VAT
View course
Defending Enterprises for Threat Hunters
QAINSECDEB
2 Days
£1,700 ex VAT
View course
Certified Blue Team Level 2
QACBTL2OL
£1,999 ex VAT
View course
Certified Cyber Defence Operator
QACCDOOL
£2,564 ex VAT
View course
Vulnerability Assessment & Penetration Testing
Average salary: £65,000
Fundamentals
Fundamentals
Intermediate
Intermediate
Emerging Tech
Average salary: £48,000
Fundamentals
Fundamentals
Intermediate
Intermediate
Expert
Expert
Business Continuity & Resilience
Average salary: £52,500
Fundamentals
Fundamentals
Counter Fraud
Average salary: £62,500
Fundamentals
Fundamentals
Intermediate
Intermediate
Expert
Expert
Frequently asked questions
See all of our FAQsHow can I create an account on myQA.com?
There are a number of ways to create an account. If you are a self-funder, simply select the "Create account" option on the login page.
If you have been booked onto a course by your company, you will receive a confirmation email. From this email, select "Sign into myQA" and you will be taken to the "Create account" page. Complete all of the details and select "Create account".
If you have the booking number you can also go here and select the "I have a booking number" option. Enter the booking reference and your surname. If the details match, you will be taken to the "Create account" page from where you can enter your details and confirm your account.
Find more answers to frequently asked questions in our FAQs: Bookings & Cancellations page.
How do QA’s virtual classroom courses work?
Our virtual classroom courses allow you to access award-winning classroom training, without leaving your home or office. Our learning professionals are specially trained on how to interact with remote attendees and our remote labs ensure all participants can take part in hands-on exercises wherever they are.
We use the WebEx video conferencing platform by Cisco. Before you book, check that you meet the WebEx system requirements and run a test meeting (more details in the link below) to ensure the software is compatible with your firewall settings. If it doesn’t work, try adjusting your settings or contact your IT department about permitting the website.
Learn more about our Virtual Classrooms.
How do QA’s online courses work?
QA online courses, also commonly known as distance learning courses or elearning courses, take the form of interactive software designed for individual learning, but you will also have access to full support from our subject-matter experts for the duration of your course. When you book a QA online learning course you will receive immediate access to it through our e-learning platform and you can start to learn straight away, from any compatible device. Access to the online learning platform is valid for one year from the booking date.
All courses are built around case studies and presented in an engaging format, which includes storytelling elements, video, audio and humour. Every case study is supported by sample documents and a collection of Knowledge Nuggets that provide more in-depth detail on the wider processes.
Learn more about QA’s online courses.
When will I receive my joining instructions?
Joining instructions for QA courses are sent two weeks prior to the course start date, or immediately if the booking is confirmed within this timeframe. For course bookings made via QA but delivered by a third-party supplier, joining instructions are sent to attendees prior to the training course, but timescales vary depending on each supplier’s terms. Read more FAQs.
When will I receive my certificate?
Certificates of Achievement are issued at the end the course, either as a hard copy or via email. Read more here.