EC-Council Certified Incident Handler ( ECIH ) .pdf

Transcript of EC-Council Certified Incident Handler ( ECIH ) .pdf · PDF fileEC-Council Certified... Due to the nature of this material, this document refers ... EC-CouncilCertifiedIncidentHandler(ECIH).pdf ·PDFfileEC-CouncilCertified...MatchcaseLimitresults1perpageClickheretoloadreaderdatepost09-Jul-2018CategoryDocumentsview747download41SHAREDownloadReportthisdocumentEmbedSize(px)344x292429x357514x422599x487TranscriptofEC-CouncilCertifiedIncidentHandler(ECIH).pdf ·PDFfileEC-CouncilCertified...Duetothenatureofthismaterial,thisdocumentreferstonumeroushardwareandsoftwareproductsbytheirtradenames.Referencestoothercompaniesandtheirproductsareforinformationalpurposesonly,andalltrademarksarethepropertiesoftheirrespectivecompanies.ItisnottheintentofProTechProfessionalTechnicalServices,Inc.touseanyofthesenamesgenerically"ChartingtheCourse......toYourSuccess!"EC-CouncilCertifiedIncidentHandler(ECIH)CourseSummaryDescriptionTheEC-CouncilCertifiedIncidentHandlerprogramisdesignedtoprovidethefundamentalskillstohandleandrespondtothecomputersecurityincidentsinaninformationsystem.Thecourseaddressesvariousunderlyingprinciplesandtechniquesfordetectingandrespondingtocurrentandemergingcomputersecuritythreats.Studentswilllearnhowtohandlevarioustypesofincidents,riskassessmentmethodologiesandvariouslawsandpolicyrelatedtoincidenthandling.Afterattendingthecourse,theywillbeabletocreateincidenthandlingandresponsepoliciesanddealwithvarioustypesofcomputersecurityincidents.Thecomprehensivetrainingprogramwillmakestudentsproficientinhandlingandrespondingtovarioussecurityincidentssuchasnetworksecurityincidents,maliciouscodeincidentsandinsiderattackthreats.Inaddition,thestudentswilllearnaboutcomputerforensicsanditsroleinhandlingandrespondingtoincidents.Thecoursealsocoversincidentresponseteams,incidentreportingmethodsandincidentrecoverytechniquesindetail.TheECIHcertificationwillprovideprofessionalsgreaterindustryacceptanceastheseasonedincidenthandler.TopicsIntroductiontoIncidentResponseandHandlingRiskAssessmentIncidentResponseandHandlingStepsCSIRTHandlingNetworkSecurityIncidentsHandlingMaliciousCodeIncidentsHandlingInsiderThreatsForensicAnalysisandIncidentResponseIncidentReportingIncidentRecoverySecurityPoliciesandLawsAudienceThiscoursewillsignificantlybenefitincidenthandlers,riskassessmentadministrators,penetrationtesters,cyberforensicinvestigators,venerabilityassessmentauditors,systemadministrators,systemengineers,firewalladministrators,networkmanagers,ITmanagers,ITprofessionalsandanyonewhoisinterestedinincidenthandlingandresponse.PrerequisitesTherearenoprerequisitesforthiscourse.DurationTwodaysDuetothenatureofthismaterial,thisdocumentreferstonumeroushardwareandsoftwareproductsbytheirtradenames.Referencestoothercompaniesandtheirproductsareforinformationalpurposesonly,andalltrademarksarethepropertiesoftheirrespectivecompanies.ItisnottheintentofProTechProfessionalTechnicalServices,Inc.touseanyofthesenamesgenerically"ChartingtheCourse......toYourSuccess!"EC-CouncilCertifiedIncidentHandlerCourseOutlineI.IntroductiontoIncidentResponseandHandlingA.CyberIncidentStatisticsB.ComputerSecurityIncidentC.InformationasBusinessAssetD.DataClassificationE.CommonTerminologiesF.InformationWarfareG.KeyConceptsofInformationSecurityH.Vulnerability,Threat,andAttackI.TypesofComputerSecurityIncidentsJ.ExamplesofComputerSecurityIncidentsK.VerizonDataBreachInvestigationsReport2008L.IncidentsThatRequiredtheExecutionofDisasterRecoveryPlansM.SignsofanIncidentN.IncidentCategories1.IncidentCategories:LowLevel2.IncidentCategories:MiddleLevel3.IncidentCategories:HighLevelO.IncidentPrioritizationP.IncidentResponseQ.IncidentHandlingR.UseofDisasterRecoveryTechnologiesS.ImpactofVirtualizationonIncidentResponseandHandlingT.EstimatingCostofanIncidentU.SymantecGlobalDisasterRecoverySurvey2009V.KeyFindingsofW.IncidentReportingX.IncidentReportingOrganizationsY.VulnerabilityResourcesII.RiskAssessmentA.RiskB.RiskPolicyC.RiskAssessmentD.NISTsRiskAssessmentMethodology1.Step1:SystemCharacterization2.Step2:ThreatsIdentification3.Step3:IdentifyVulnerabilities4.Step4:ControlAnalysis5.Step5:LikelihoodDetermination6.Step6:ImpactAnalysis7.Step7:RiskDetermination8.Step8:ControlRecommendations9.Step9:ResultsDocumentationE.StepstoAssessRisksatWorkPlace1.Step1:IdentifyHazard2.Step2:DetermineWhoWillbeHarmedandHow3.Step3:AnalyzeRisksandCheckforPrecautions4.Step4:ImplementResultsofRiskAssessment5.Step5:ReviewRiskAssessmentF.RiskAnalysis1.NeedforRiskAnalysis2.RiskAnalysis:ApproachG.RiskMitigation1.RiskMitigationStrategiesH.Cost/BenefitAnalysisI.NISTApproachforControlImplementationJ.ResidualRiskK.RiskManagementTools1.CRAMM2.AcuitySTREAM3.CallioSecura177994.EAR/PilarIII.IncidentResponseandHandlingStepsA.HowtoIdentifyanIncidentB.HandlingIncidentsC.NeedforIncidentResponseD.GoalsofIncidentResponseE.IncidentResponsePlan1.PurposeofIncidentResponsePlan2.RequirementsofIncidentResponsePlan3.PreparationF.IncidentResponseandHandlingSteps1.Step1:Identification2.Step2:IncidentRecording3.Step3:InitialResponse4.Step4:CommunicatingtheIncident5.Step5:Containment6.Step6:FormulatingaResponseStrategy7.Step7:IncidentClassification8.Step8:IncidentInvestigation9.Step9:DataCollection10.Step10:ForensicAnalysis11.Step11:EvidenceProtection12.Step12:NotifyExternalAgencies13.Step13:Eradication14.Step14:SystemsRecovery15.Step15:IncidentDocumentation16.Step16:IncidentDamageandCostAssessmentDuetothenatureofthismaterial,thisdocumentreferstonumeroushardwareandsoftwareproductsbytheirtradenames.Referencestoothercompaniesandtheirproductsareforinformationalpurposesonly,andalltrademarksarethepropertiesoftheirrespectivecompanies.ItisnottheintentofProTechProfessionalTechnicalServices,Inc.touseanyofthesenamesgenerically"ChartingtheCourse......toYourSuccess!"EC-CouncilCertifiedIncidentHandlerCourseOutline(cont)17.Step17:ReviewandUpdatetheResponsePoliciesG.TrainingandAwarenessH.SecurityAwarenessandTrainingChecklistI.IncidentManagement1.PurposeofIncidentManagement2.IncidentManagementProcess3.IncidentManagementTeamJ.IncidentResponseTeam1.IncidentResponseTeamMembers2.IncidentResponseTeamMembersRolesandResponsibilities3.DevelopingSkillsinIncidentResponsePersonnel4.IncidentResponseTeamStructure5.IncidentResponseTeamDependencies6.IncidentResponseTeamServicesK.DefiningtheRelationshipbetweenIncidentResponse,IncidentHandlingandIncidentManagementL.IncidentResponseBestPracticesM.IncidentResponsePolicyN.IncidentResponsePlanChecklistO.IncidentHandlingSystem:RTIRP.RPIER1stResponderFrameworkIV.CSIRTA.WhatisCSIRT?B.WhatistheNeedofanIncidentResponseTeam(IRT)C.CSIRTGoalsandStrategyD.CSIRTVisionE.CommonNamesofCSIRTF.CSIRTMissionStatementG.CSIRTConstituencyH.CSIRTPlaceintheOrganizationI.CSIRTRelationshipwithPeersJ.TypesofCSIRTEnvironmentsK.BestPracticesforcreatingaCSIRT1.Step1:ObtainManagementSupportandBuy-in2.Step2:DeterminetheCSIRTDevelopmentStrategicPlan3.Step3:GatherRelevantInformation4.Step4:DesignyourCSIRTVision5.Step5:CommunicatetheCSIRTVision6.Step6:BeginCSIRTImplementation7.Step7:AnnouncetheCSIRT8.Step8:EvaluateCSIRTEffectivenessL.RoleofCSIRTsM.RolesinanIncidentResponseTeamN.CSIRTServices1.ReactiveServices2.ProactiveServices3.SecurityQualityManagementServicesO.CSIRTPoliciesandProcedures1.Attributes2.Content3.Validity4.Implementation,MaintenanceandEnforcementP.HowCSIRTHandlesaCaseQ.CSIRTIncidentReportFormR.IncidentTrackingandReportingSystems1.ApplicationforIncidentResponseTeams(AIRT)2.BMCRemedyActionRequestSystem3.PGPDesktopEmail4.TheGNUPrivacyGuard(GnuPG)5.ListservS.CERTT.CERT-CCU.CERT(R)CoordinationCenter:IncidentReportingFormV.CERT:OCTAVE1.OCTAVEMethod2.OCTAVE-S3.OCTAVEAllegroW.WorldCERTs1.AustraliaCERT(AUSCERT)2.HongKongCERT(HKCERT/CC)3.IndonesianCSIRT(ID-CERT)4.JapanCERT-CC(JPCERT/CC)5.MalaysianCERT(MyCERT)6.PakistanCERT(PakCERT)7.SingaporeCERT(SingCERT)8.TaiwanCERT(TWCERT)9.ChinaCERT(CNCERT/CC)10.GovernmentForumofIncidentResponseandSecurityTeams(GFIRST)11.CanadianCERT12.ForumofIncidentResponseandSecurityTeams13.CAIS/RNP14.NICBRSecurityOfficeBrazilianCERT15.EuroCERT16.FUNETCERT17.SURFnet-CERTDuetothenatureofthismaterial,thisdocumentreferstonumeroushardwareandsoftwareproductsbytheirtradenames.Referencestoothercompaniesandtheirproductsareforinformationalpurposesonly,andalltrademarksarethepropertiesoftheirrespectivecompanies.ItisnottheintentofProTechProfessionalTechnicalServices,Inc.touseanyofthesenamesgenerically"ChartingtheCourse......toYourSuccess!"EC-CounciICSSeCurIty·PDFfileMBAinInternationalTechnologyandisaCISSPandSANSGIACcertifiedIncidentHandler(GCIH),IntrusionAnalyst(GCIA),andWebApplicationPenetrationTesterfileNEBOSHIGCUKfromTWIDubaiCertifiedofIncident&Investigation.CertifiedofAdvanceSafeAudit.CertifiedofFirstAidPage2of8.SafetyInductionGasTesting&MonitoringIncidentCommandSystem-Command IncidentCommandSystemImpactedbyHSPD-5GEMA-CertifiedPECBCertifiedISO/IEC27035IncidentManager...AfterunderstandingallthenecessaryconceptsofIncidentReviewProtocolIncidentReviewForm.IncidentReviewProtocolIncidentReviewForm.CertifiedTrafficIncidentManagementTechnicianEC-COUNCILCERTIFIEDINCIDENTHANDLEREC-CouncilCertifiedIncidentHandler...inhandlingandrespondingtovarioussecurityincidentssuchasnetworksecurity...SamplePostIncidentPECBCERTIFIEDLEADSECURITYINCIDENT.Foundedin2005,PECBisacertificationbodyforpersons2020HEMPREGISTRATIONAPPLICATIONHANDLER·PDFfileHempHandlerReciprocityRegistration$500.00$_____RegistrationsforHandlerandHempHandlerReciprocityRegistrationareOrganicHandlerCertificationSupportPackage-CCOFOrganicHandler... OrganicHandlerCertificationCurriculumVitaeMICHAELHILLELHANDLERM.D.,Handler... CurriculumVitaeMICHAELHILLELHANDLERRTIRFORINCIDENTMANAGEMENT-ITUResponderManagerHandlerIncidentReportedIncidentReportTicketIncidentTicketInvestigationTicketThisticketreachestotheRTIRsystemviaFirstquarterlygaininpayforITcertificationsinfour...–EC-CouncilNetworkSecurityAdministrator(ENSA)–GIACCertifiedIncidentHandler(GCIH)–GIACRSAIncidentResponse:EmergingThreatProfileRSAIncidentResponseincidentresponseRSAIncidentEC-CouncilCertifiedIncidentHandlerCertifiedIncidentHandler.P...handleandrespondtothecomputersecurityincidentsinaninformationsystem....ThecomprehensivetrainingCementation#1ShaftIncidentJuly6th2011.2IncidentoverviewIncidentTimelineIncidentCausationRecommendationsCementation#1ShaftIncidentGIACCertification-e-CertifiedIncidentHandler(GCIH)CorrespondingE-SPINCourse:SEC504:HackerTechniques,ExploitsIncidentHandlingCertificationisdesignedfor:HANDLERUNIVERSITY-Almond...6AlmondMarketingOrder(Part981)981.13HandlerHandlermeansanyIII.CertifiedNetworkDefenderC|ND4.CertifiedEthicalHackerC|EH5.CertifiedIncidentHandlerISO/IEC27035LeadIncidentManager-PECB.Theobjectiveofthe“PECBCertifiedISO/IEC27035Viewmore