ECIHv3

Certified Incident Handler

The EC-Council Certified Incident Handler (ECIH) program is designed to provide the fundamental skills to manage and respond to security incidents in information systems, while preparing you to pass the ECIH exam. The course provides incident response training by covering various fundamental principles and techniques for detecting and responding to current and emerging computer security threats. After attending the course, you will be able to create incident handling and response policies and deal with different types of security incidents.

The ECIH certification fully meets the requirements of the NICE 2.0 and CREST frameworks and is internationally recognized. This provides you with valuable confirmation of your knowledge of incident management. In this practice-oriented intensive course, you will learn how to recognize, control and resolve cyber attacks.

Course Contents

Introduction to Incident Handling and Response
Incident Handling and Response Process
First Response
Handling and Responding to Malware Incidents
Handling and Responding to Email Security Incidents
Handling and Responding to Network Security Incidents
Handling and Responding to Web Application Security Incidents
Handling and Responding to Cloud Security Incidents
Handling and Responding to Insider Threats
Handling and Responding to Endpoint Security Incidents

Target Group

All mid to senior level cyber security professionals with at least 3 years of experience
Information security professionals looking to expand their skills and knowledge in incident handling and response
Persons interested in preventing cyber threats

Knowledge Prerequisites

At least one year of experience in the administration of Windows/Unix/Linux systems
Understanding of common network and security services

Course Objective

ECIH V3 certification (EC-Council Certified Incident Handler)

Introduction to Incident Handling and Response

Understand Information Security Threats and Attack Vectors

Explain Various Attack and Defence Frameworks

Understand Information Security Concepts

Understand Information Security Incidents

Understand the Incident Management Process

Understand Incident Response Automation and Orchestration

Describe Various Incident Handling and Response Best Practices

Explain Various Standards Related to Incident Handling and Response

Explain Various Cybersecurity Frameworks

Understand Incident Handling Laws and Legal Compliance

Incident Handling and Response Process

Understand Incident Handling and Response (IH&R) Process

Explain Preparation Steps for Incident Handling and Response

Understand Incident Recording and Assignment

Understand Incident Triage

Explain the Process of Notification

Understand the Process of Containment

Describe Evidence Gathering and Forensics Analysis

Explain the Process of Eradication

Understand the Process of Recovery

Describe Various Post-Incident Activities

Explain the Importance of Information Sharing Activities

First Response

Explain the Concept of First Response

Understand the Process of Securing and Documenting the Crime Scene

Understand the Process of Collecting Evidence at the Crime Scene

Explain the Process for Preserving, Packaging, and Transporting Evidence

Handling and Responding to Malware Incidents

Understand the Handling of Malware Incidents

Explain Preparation for Handling Malware Incidents

Understand Detection of Malware Incidents

Explain Containment of Malware Incidents

Describe How to Perform Malware Analysis

Understand Eradication of Malware Incidents

Explain Recovery after Malware Incidents

Understand the Handling of Malware Incidents - Case Study

Describe Best Practices against Malware Incidents

Handling and Responding to Email Security Incidents

Understand Email Security Incidents

Explain Preparation Steps for Handling Email Security Incidents

Understand Detection and Containment of Email Security Incidents

Understand Analysis of Email Security Incidents

Explain Eradication of Email Security Incidents

Understand the Process of Recovery after Email Security Incidents

Understand the Handling of Email Security Incidents - Case Study

Explain Best Practices against Email Security Incidents

Handling and Responding to Network Security Incidents

Understand the Handling of Network Security Incidents

Prepare to Handle Network Security Incidents

Understand Detection and Validation of Network Security Incidents

Understand the Handling of Unauthorized Access Incidents

Understand the Handling of Inappropriate Usage Incidents

Understand the Handling of Denial-of-Service Incidents

Understand the Handling of Wireless Network Security Incidents

Understand the Handling of Network Security Incidents - Case Study

Describe Best Practices against Network Security Incidents

Handling and Responding to Web Application Security Incidents

Understand the Handling of Web Application Incidents

Explain Preparation for Handling Web Application Security Incidents

Understand Detection and Containment of Web Application Security Incidents

Explain Analysis of Web Application Security Incidents

Understand Eradication of Web Application Security Incidents

Explain Recovery after Web Application Security Incidents

Understand the Handling of Web Application Security Incidents - Case Study

Describe Best Practices for Securing Web Applications

Handling and Responding to Cloud Security Incidents

Understand the Handling of Cloud Security Incidents

Explain Various Steps Involved in Handling Cloud Security Incidents

Understand How to Handle Azure Security Incidents

Understand How to Handle AWS Security Incidents

Understand How to Handle Google Cloud Security Incidents

Understand the Handling of Cloud Security Incidents - Case Study

Explain Best Practices against Cloud Security Incidents

Handling and Responding to Insider Threats

Understand the Handling of Insider Threats

Explain Preparation Steps for Handling Insider Threats

Understand Detection and Containment of Insider Threats

Explain Analysis of Insider Threats

Understand Eradication of Insider Threats

Understand the Process of Recovery after Insider Attacks

Understand the Handling of Insider Threats - Case Study

Describe Best Practices against Insider Threats

Handling and Responding to Endpoint Security Incidents

Understand the Handling of Endpoint Security Incidents

Explain the Handling of Mobile-based Security Incidents

Explain the Handling of IoT-based Security Incidents

Explain the Handling of OT-based Security Incidents

Understand the Handling of Endpoint Security Incidents - Case Study

Classroom training: Do you prefer the classic training method? A course in one of our Training Centers, with a competent trainer and the direct exchange between all course participants? Then you should book one of our classroom training dates!
Online training: You wish to attend a course in online mode? We offer you online course dates for this course topic. To attend these seminars, you need to have a PC with Internet access (minimum data rate 1Mbps), a headset when working via VoIP and optionally a camera. For further information and technical recommendations, please refer to.
Tailor-made courses: You need a special course for your team? In addition to our standard offer, we will also support you in creating your customized courses, which precisely meet your individual demands. We will be glad to consult you and create an individual offer for you.

You can find the complete description of this course with dates and prices ready for download at as PDF.