EC - Council Courses

ECIH : EC-Council Certified Incident Handler

Course Duration

3 Days

Delivery

ILT/VILT

Overview

Overview Course Curriculum Training Schedule Exam & Certification FAQs

This latest iteration of Certified Incident Handler (E-CIH) program has been designed and developed in collaboration with cybersecurity and incident handling and response practitioners across the globe.

It is a comprehensive specialist-level program that imparts knowledge and skills that organizations need to effectively handle post breach consequences by reducing the impact of the incident, from both a financial and a reputational perspective. Following a rigorous development which included a careful Job Task Analysis (JTA) related to incident handling and incident first responder jobs, EC-Council developed a highly interactive, comprehensive, standards-based, intensive 3-day training program and certification that provides a structured approach to learning real-world incident handling and response requirements. Professionals interested in pursuing incident handling and response as a career require comprehensive training that not only imparts concepts but also allows them to experience real-scenarios.

The E-CIH program includes hands-on learning delivered through labs within the training program. True employability after earning a certification can only be achieved when the core of the curriculamaps to and is compliant with government and industry-published incident and response frameworks.

E-CIHis a method-driven program that uses a holistic approach to cover vast concepts concerning organizational incident handling and response from preparing and planning the incident handling response process to recovering organizational assets after a security incident. These concepts are essential for handling and responding to security incidents to protect organizations from future threats or attacks.

What You'll Learn

Key issues plaguing the information security world
Various types of cybersecurity threats, attack vectors, threat actors, and their motives, goals, and objectives of cybersecurity attacks
Various attack and defense frameworks (Cyber Kill Chain Methodology, MITRE ATT&CK Framework, etc.)
Fundamentals of information security concepts (vulnerability assessment, risk management, cyber threat intelligence, threat modeling, and threat hunting)
Fundamentals of incident management (information security incidents, signs and costs of an incident, incident handling and response, and incident response automation and orchestration)
Different incident handling and response best practices, standards, cybersecurity frameworks, laws, acts, and regulations
Various steps involved in planning an incident handling and response program (planning, recording and assignment, triage, notification, containment, evidence gathering and forensic analysis, eradication, recovery, and post-incident activities)
Importance of first response and first response procedure (evidence collection, documentation, preservation, packaging, and transportation)
How to handle and respond to different types of cybersecurity incidents in a systematic way (malware incidents, email security incidents, network security incidents, web application security incidents, cloud security incidents, insider threat-related incidents, and endpoint security incidents)

Who Should Attend

Any mid-level to high-level cyber security professionals with a minimum of 3 years of experience
Individuals from the information security profession and who want to enrich their skills and knowledge in the field of incident handling and response.
Individuals interested in preventing cyber threats.

Prerequisites

There are no prerequisites required to attend this course.

Learning Journey

Coming Soon...

MODULE 01: INTRODUCTION TO INCIDENT HANDLING AND RESPONSE

Understand Information Security Threats and Attack Vectors
Explain Various Attack and Defense Frameworks
Understand Information Security Concepts
Understand Information Security Incidents
Understand the Incident Management Process
Understand Incident Response Automation and Orchestration
Describe Various Incident Handling and Response Best Practices
Explain Various Standards Related to Incident Handling and Response
Explain Various Cybersecurity Frameworks
Understand Incident Handling Laws and Legal Compliance

MODULE 02: INCIDENT HANDLING AND RESPONSE PROCESS

Understand Incident Handling and Response (IH&R) Process
Explain Preparation Steps for Incident Handling and Response
Understand Incident Recording and Assignment
Understand Incident Triage
Explain the Process of Notification
Understand the Process of Containment
Describe Evidence Gathering and Forensics Analysis
Explain the Process of Eradication
Understand the Process of Recovery
Describe Various Post-Incident Activities
Explain the Importance of Information Sharing Activities

MODULE 03: FIRST RESPONSE

Explain the Concept of the First Response
Understand the Process of Securing and Documenting the Crime Scene
Understand the Process of Collecting Evidence at the Crime Scene
Explain the Process for Preserving, Packaging, and Transporting Evidence

MODULE 04: HANDLING AND RESPONDING TO MALWARE INCIDENTS

Understand the Handling of Malware Incidents
Explain Preparation for Handling Malware Incidents
Understand Detection of Malware Incidents
Explain the Containment of Malware Incidents
Describe How to Perform Malware Analysis
Understand Eradication of Malware Incidents
Explain Recovery After Malware Incidents
Understand the Handling of Malware Incidents -- Case Study
Describe Best Practices against Malware Incidents

MODULE 05: HANDLING AND RESPONDING TO EMAIL SECURITY INCIDENTS

Understand the Handling of Network Security Incidents
Prepare to Handle Network Security Incidents
Understand Detection and Validation of Network Security Incidents
Understand the Handling of Unauthorized Access Incidents
Understand the Handling of Inappropriate Usage Incidents
Understand the Handling of Denial-of-Service Incidents
Understand the Handling of Wireless Network Security Incidents
Understand the Handling of Network Security Incidents -- Case Study
Describe Best Practices Against Network Security Incidents

MODULE 06: HANDLING AND RESPONDING TO NETWORK SECURITY INCIDENTS

Understand the Handling of Network Security Incidents
Prepare to Handle Network Security Incidents
Understand Detection and Validation of Network Security Incidents
Understand the Handling of Unauthorized Access Incidents
Understand the Handling of Inappropriate Usage Incidents
Understand the Handling of Denial-of-Service Incidents
Understand the Handling of Wireless Network Security Incidents
Understand the Handling of Network Security Incidents - Case Study
Describe Best Practices against Network Security Incidents

MODULE 07: HANDLING AND RESPONDING TO WEB APPLICATION SECURITY INCIDENTS

Understand the Handling of Web Application Incidents
Explain Preparation for Handling Web Application Security Incidents
Understand Detection and Containment of Web Application Security Incidents
Explain Analysis of Web Application Security Incidents
Understand Eradication of Web Application Security Incidents
Explain Recovery After Web Application Security Incidents
Understand the Handling of Web Application Security Incidents -- Case Study
Describe Best Practices for Securing Web Applications

MODULE 08: HANDLING AND RESPONDING TO CLOUD SECURITY INCIDENTS

Understand the Handling of Cloud Security Incidents
Explain Various Steps Involved in Handling Cloud Security Incidents
Understand How to Handle Azure Security Incidents
Understand How to Handle AWS Security Incidents
Understand How to Handle Google Cloud Security Incidents
Understand the Handling of Cloud Security Incidents - - Case Study
Explain Best Practices Against Cloud Security Incidents

MODULE 09: HANDLING AND RESPONDING TO INSIDER THREATS

Understand the Handling of Insider Threats
Explain Preparation Steps for Handling Insider Threats
Understand the Detection and Containment of Insider Threats
Explain Analysis of Insider Threats
Understand the Eradication of Insider Threats
Understand the Process of Recovery After Insider Attacks
Understand the Handling of Insider Threats -- Case Study
Describe Best Practices Against Insider Threats

MODULE 10: HANDLING AND RESPONDING TO ENDPOINT SECURITY INCIDENTS

Understand the Handling of Endpoint Security Incidents
Explain the Handling of Mobile-Based Security Incidents
Explain the Handling of IoT-Based Security Incidents
Explain the Handling of OT-Based Security Incidents
Understand the Handling of Endpoint Security Incidents -- Case Study

Frequently Asked Questions (FAQs)

Why get EC-Council certified?

EC-Council certifications are globally recognized standards in cybersecurity, validating your skills and knowledge in ethical hacking, penetration testing, and other critical security domains.
These certifications enhance your career prospects, demonstrate your expertise to employers, and equip you with the knowledge to protect organizations from cyberthreats.
What to expect for the examination?

EC-Council certification exams rigorously assess your knowledge and skills in specific cybersecurity domains.
The exam format varies depending on the certification but can include multiple-choice questions, practical exercises, and scenario-based questions.
Note: Certification requirements and policies may be updated by EC-Council from time to time. We apologize for any discrepancies; do get in touch with us if you have any questions.
How long is EC-Council certification valid for?

EC-Council certifications are valid for three years from the date of certification.
To maintain your certification, you will need to fulfill EC-Council's Continuing Education (ECE) requirements within the validity period.
This can be done through various activities, such as attending training courses, conferences, or publishing whitepapers.
Note: Certification requirements and policies may be updated by EC-Council from time to time. We apologize for any discrepancies; do get in touch with us if you have any questions.
Why take this course with Trainocate?

Here’s what sets us apart:
- Global Reach, Localized Accessibility: Benefit from our geographically diverse training hubs in 24 countries (and counting!).
- Top-Rated Instructors: Our team of subject matter experts (with high average CSAT and MTM scores) are passionate to help you accelerate your digital transformation.
- Customized Training Solutions: Choose from on-site, virtual classrooms, or self-paced learning to fit your organization and individual needs.
- Experiential Learning: Dive into interactive training with our curated lesson plans. Participate in hands-on labs, solve real-world challenges, and take on comprehensive assessments.
- Learn From The Best: With 30+ authorized training partnerships and countless awards from Microsoft, AWS, Google – you're guaranteed learning from the industry's elite.
- Your Bridge To Success: We provide up-to-date course materials, helpful exam guides, and dedicated support to validate your expertise and elevate your career.