Cert Prep: EC-Council Certified Incident Handler (ECIH) v2 (212-89)

Course details

This course from ITProTV takes an in-depth look at the skills and knowledge you need to become a successful incident handler and response team member, with an eye on taking and passing the EC-Council's Certified Incident Handler v2 (ECIH) exam. ITProTV instructors Daniel Lowrie and Adam Gordon discuss the basic skills needed to handle and respond to security events and address various underlying principles and techniques for detecting and responding to current and emerging computer security threats. The incident handling skills taught in E|CIH are useful for a wide array of cybersecurity jobs and tasks, like penetration testing, vulnerability assessment, risk assessment, network administrators, cyber forensic investigators, and more.

Concepts

Introduction

Overview
ECIH v2 EC-Council certification overview

Incident Handling and Response Process

Information security and incident management
What is vulnerability management
What are threat assessments
Risk management - Vocabulary
Risk management - The process
Risk management - The NIST RMF
Incident handling best practices, standards, and frameworks
Incident handling and legal compliance

Forensic Readiness and First Response

Step one - Prepare for incident handling and response
Step two - Incident recording and assignment
Step three - Incident triage
Step four - Notification
Step five - Containment
Step six - Evidence gathering and forensic analysis
Step seven - Eradication
Step eight - Recovery
Step nine - Postincident activities

Handling and Responding to Malware Incidents

Forensics and first response
Principles of digital evidence collection
Data acquisition
Volatile evidence collection
Static evidence collection and anti-forensics

Handling and Responding to Email Security Incidents

Preparation for handling malware incidents
Detection of malware incidents
Containment of malware incidents
Eradication of malware incidents
Recovery after malware incidents

Handling and Responding to Network Security Incidents

Handling email security incidents

Handling and Responding to Web Application Security Incidents

Preparation handling network security incidents
Detection and validation of network security incidents
Handling unauthorized access incidents
Handling inappropriate usage incidents
Handling denial-of-service incidents
Handling wireless network security incidents

Handling and Responding to Cloud Security Incidents

Preparation to handle web app security incidents
Detecting and analyzing web app security incidents
Containment of web app security incidents
Eradication of web app security incidents
Recovery from web app security incidents
Web app security threats and attacks

Handling and Responding to Insider Threats

Cloud computing concepts
Best practices against cloud security incidents

Hands-On with ECIH Tools

Best practices against insider threats

Conclusion

Security checks using buck-security in Linux
Volatile evidence collection in Linux and Windows
Using OSForensics to find hidden material
Analyzing nonvolatile data using the Autopsy tool
Malware analysis
Collecting information by tracing emails
Using OSSIM
Using Wireshark and Nmap
Using Suricata IDS
What does a SQL injection attack look like
What does a XSS attack look like