EC-Council Certified Incident Handler ECIH

canvas eccouncil2canvas2014 2canvas incidentcanvas ecsp

ecih-banner

ecih-text3

The ECIH certification will provide professionals with greater industry acceptance as incident handler,risk administrators, pen testers, forensic investigators, etc.
Computek is one of the largest and first Ec-council learning solution in egypt with 20 years of experience delivering training and certifications in all technologies.All Ec-Council Training in computek is held by Ec-Council Certified Instructors with over than 10 years experience in the technical and training field .
The EC-Council Certified Incident Handler program is designed to provide the fundamental skills to handle and respond to the computer security incidents in an information system.  The course addresses various underlying principles and techniques for detecting and responding to current and emerging computer security threats. Students will learn how to handle various types of incidents, risk assessment methodologies, and various laws and policy related to incident handling. After attending the course, they will be able to create incident handling and response policies and deal with various types of computer security incidents. ecih-images
Insider-Attacks-Threat

 

The IT incident management training program will make students proficient in handling and responding to various security incidents such as network security incidents, malicious code incidents, and insider attack threats. 

In addition, the students will learn about computer forensics and its role in handling and responding to incidents. The course also covers incident response teams, it incident management training methods, and incident recovery techniques in detail.

The ECIH certification will provide professionals greater industry acceptance as the seasoned incident handler.

target-audience-center

This course will significantly benefit incident handlers, risk assessment administrators, penetration testers, cyber forensic investigators, venerability assessment auditors, system administrators, system engineers, firewall administrators, network managers, IT managers, IT professionals and anyone who is interested in incident handling and response.

Course Duration: 2 days (9:00 – 5:00)

target-ecih
ecih-certification
lpt-certificate333
 
The ECIH 212-89 exam will be conducted on the last day of training. Students need to pass the online Prometric exam to receive the ECIH certification.
 
 
ceh-Course-Description
ecih course-description-cehThe EC-Council Certified Incident Handler program is designed to provide the fundamental skills to handle and respond to the computer security incidents in an information system.  The course addresses various underlying principles and techniques for detecting and responding to current and emerging computer security threats. Students will learn how to handle various types of incidents, risk assessment methodologies, and various laws and policy related to incident handling. After attending the course, they will be able to create incident handling and response policies and deal with various types of computer security incidents.
The comprehensive training program will make students proficient in handling and responding to various security incidents such as network security incidents, malicious code incidents, and insider attack threats.
In addition, the students will learn about computer forensics and its role in handling and responding to incidents. The course also covers incident response teams, incident reporting methods, and incident recovery techniques in detail. When a student leaves this intensive 2 day class they will have hands on understanding and experience in Incident Handling.
This course prepares you for EC-Council Certified Incident Handler exam 212-89
 
canvas ecihcourse222outline333
 
Introduction to Incident Response and Handling

Introduction-Incident-Response

protocal-analysisCyber Incident Statistics

Computer Security Incident

Information as Business Asset

Data Classification

Common Terminologies

Information Warfare

Key Concepts of Information Security

Vulnerability, Threat, and Attack

Types of Computer Security Incidents

Examples of Computer Security Incidents

Verizon Data Breach Investigations Report – 2008

Incidents That Required the Execution of Disaster Recovery Plans

Signs of an Incident

Incident Categories

Incident Categories: Low Level

Incident Categories: Middle Level

Incident Categories: High Level

Incident Prioritization

Incident Response

Incident Handling

Use of Disaster Recovery Technologies

Impact of Virtualization  on Incident Response and Handling

Estimating Cost of an Incident

Key Findings of Symantec Global Disaster Recovery Survey - 2009

Incident Reporting

Incident Reporting Organizations

Vulnerability Resources

back to top

Risk Assessment

Risk-Assessment-ecih-text

prize-icon4Risk

Risk Policy

Risk Assessment

NIST’s Risk Assessment Methodology

Step 1: System Characterization

Step 2: Threats Identification

Step 3: Identify Vulnerabilities

Step 4: Control Analysis

Step 5: Likelihood Determination

Step 6: Impact Analysis

Step 7: Risk Determination

Step 8: Control Recommendations

Step 9: Results Documentation

Steps to Assess Risks at Work Place

Step1: Identify Hazard

Step 2: Determine Who Will be Harmed and How

Step 3: Analyze Risks and Check for Precautions

Step 4: Implement Results of Risk Assessment

Step 5: Review Risk Assessment

Risk Analysis

Need for Risk Analysis

Risk Analysis: Approach

Risk Mitigation

Risk Mitigation Strategies

Cost/Benefit Analysis

NIST Approach for Control Implementation

Residual Risk

Risk Management Tools

CRAMM

Acuity STREAM

Callio Secura 17799

EAR / Pilar

back to top

Incident Response and Handling Steps

Incident-Response-and-Handling

log-analysis22How to Identify an Incident

Handling Incidents

Need for Incident Response

Goals of Incident Response

Incident Response Plan

Purpose of Incident Response Plan

Requirements of Incident Response Plan

Preparation

Incident Response and Handling Steps

Step 1: Identification

Step 2: Incident Recording

Step 3: Initial Response

Step 4: Communicating the Incident

Step 5: Containment

Step 6: Formulating a Response Strategy

Step 7: Incident Classification

Step 8: Incident Investigation

Step 9: Data Collection

Step 10: Forensic Analysis

Step 11: Evidence Protection

Step 12: Notify External Agencies

Step 13: Eradication

Step 14: Systems Recovery

Step 15: Incident Documentation

Step 16: Incident Damage and Cost Assessment

Step 17: Review and Update  the Response Policies

Training and Awareness

Security Awareness and Training Checklist

Incident Management

Purpose of Incident Management

Incident Management Process

Incident Management Team

Incident Response Team

Incident Response Team Members

Incident Response Team Members Roles and Responsibilities

Developing Skills in Incident Response Personnel

Incident Response Team Structure

Incident Response Team Dependencies

Incident Response Team Services

Defining the Relationship between Incident Response, Incident Handling, and Incident Management

Incident Response Best Practices

Incident Response Policy

Incident Response Plan Checklist

Incident Handling System: RTIR

RPIER 1st Responder Framework

back to top

CSIRT

CSIRT1

encaseWhat is CSIRT?

What is the Need of an Incident Response Team (IRT)

CSIRT Goals and Strategy

CSIRT Vision

Common Names of CSIRT

CSIRT Mission Statement

CSIRT Constituency

CSIRT Place in the Organization

CSIRT Relationship with Peers

Types of CSIRT Environments

Best Practices for creating a CSIRT

Step 1: Obtain Management Support and Buy-in

Step 2: Determine the CSIRT Development Strategic Plan

Step 3: Gather Relevant Information

Step 4: Design your CSIRT Vision

Step 5: Communicate the CSIRT Vision

Step 6: Begin CSIRT Implementation

Step 7: Announce the CSIRT

Step 8: Evaluate CSIRT Effectiveness

Role of CSIRTs

Roles in an Incident Response Team

CSIRT Services

Reactive Services

Proactive Services

Security Quality Management Services

CSIRT Policies and Procedures

Attributes

Content

Validity

Implementation, Maintenance, and Enforcement

How CSIRT Handles a Case

CSIRT Incident Report Form

Incident Tracking and Reporting Systems

Application for Incident Response Teams (AIRT)

BMC Remedy Action Request System

PGP Desktop Email

The GNU Privacy Guard (GnuPG)

Listserv

CERT

CERT-CC

CERT(R) Coordination Center: Incident Reporting Form

CERT:OCTAVE

OCTAVE Method

OCTAVE-S

OCTAVE Allegro

World CERTs

Australia CERT (AUSCERT)

Hong Kong CERT (HKCERT/CC)

Indonesian CSIRT (ID-CERT)

Japan CERT-CC (JPCERT/CC)

Malaysian CERT (MyCERT)

Pakistan CERT (PakCERT)

Singapore CERT (SingCERT)

Taiwan CERT (TWCERT)

China CERT (CNCERT/CC)

US-CERT

Government Forum of Incident Response and Security Teams (GFIRST)

Canadian CERT

Forum of Incident Response and Security Teams

CAIS/RNP

NIC BR Security Office Brazilian CERT

EuroCERT  

FUNET CERT

SURFnet-CERT

DFN-CERT    

JANET-CERT    

CERT POLSKA

Swiss Academic and Research Network CERT

http://www.first.org/about/organization/teams/

http://www.apcert.org/about/structure/members.html

IRTs Around the World

back to top

Handling Network Security

Handling-Network-Security-Incidents1

windows-forensicsDenial-of-Service Incidents

Distributed Denial-of-Service Attack

Detecting DoS Attack

Incident Handling Preparation for DoS

DoS Response Strategies

Preventing a DoS Incident

Following the Containment Strategy to Stop DoS

Unauthorized Access Incident

Detecting Unauthorized Access Incident  

Incident Handling Preparation

Incident Prevention

Following the Containment Strategy to Stop Unauthorized Access

Eradication and Recovery

Recommendations

Inappropriate Usage Incidents

Detecting the Inappropriate Usage Incidents  

Incident Handling Preparation

Incident Prevention

Recommendations

Multiple Component Incidents

Preparation for Multiple Component Incidents

Following the Containment Strategy to Stop Multiple Component Incidents

Recommendations

Network Traffic Monitoring Tools

Ntop

EtherApe

Ngrep

SolarWinds: Orion NetFlow Traffic Analyzer

Nagios: op5 Monitor

CyberCop Scanner

Network Auditing Tools

Nessus

Security Administrator's Integrated Network Tool (SAINT)

Security Auditor's Research Assistant (SARA)

Nmap

Netcat

Wireshark

Argus - Audit Record Generation and Utilization System

Snort

Network Protection Tools

Iptables

Proventia Network Intrusion Prevention System (IPS)

NetDetector

TigerGuard

back to top

Handling Malicious Code Incidents

Handling-Malicious-Code-Incidents1

web-securityCount of Malware Samples

Virus

Worms

Trojans and Spywares

Incident Handling Preparation

Incident Prevention

Detection of Malicious Code

Containment Strategy

Evidence Gathering and Handling

Eradication and Recovery

Recommendations

Antivirus Systems

Symantec: Norton AntiVirus 2009

Kaspersky Anti-Virus 2010

AVG Anti-Virus

McAfee VirusScan Plus

BitDefender Antivirus 2009

F-Secure Anti-Virus 2009

Trend Micro AntiVirus plus AntiSpyware 2009

HijackThis

Tripwire Enterprise

Stinger

Handling Insider Threats

Handling-Insider-Threats1

Trojan-virusInsider Threats

Anatomy of an Insider Attack

Insider Risk Matrix

Insider Threats Detection

Insider Threats Response

Insider’s Incident Response Plan

Guidelines for Detecting and Preventing Insider Threats

Human Resources

Network Security

Access Controls

Security Awareness Program

Administrators and Privileged Users

Backups

Audit Trails and Log Monitoring

Employee Monitoring Tools

Activity Monitor

Net Spy Pro

Spector Pro

SpyAgent

Handy Keylogger

Anti Keylogger

Actual Spy

IamBigBrother

007 Spy Software

SpyBuddy

SoftActivity Keylogger

Elite Keylogger

Spy Sweeper

Forensic Analysis and incident response

Forensic-Analysis and incident response

first-responder-proceduresComputer Forensics

Objectives of Forensics Analysis

Role of Forensics Analysis in Incident Response

Forensic Readiness

Forensic Readiness And Business Continuity

Types of Computer Forensics

Computer Forensic Investigator

People Involved in Computer Forensics

Computer Forensics Process

Digital Evidence

Characteristics of Digital Evidence

Collecting Electronic Evidence

Challenging Aspects of Digital Evidence

Forensic Policy

Forensics in the Information System Life Cycle

Forensic Analysis Guidelines

Forensics Analysis Tools

Helix

Tools Present in Helix CD for Windows Forensics

Windows Forensic Toolchest

Knoppix Linux

The Coroner's Toolkit (TCT)

EnCase Forensic

THE FARMER'S BOOT CD (FBCD)

DumpReg

DumpSec

DumpEvt

Foundstone Forensic ToolKit

Sysinternals Suite

NSLOOKUP

dig – DNS Lookup Utility

Whois

VisualRoute

Netstat Command

Linux: DD Command

Linux: Find Command

Linux: Arp Command

Linux: ps, ls, lsof, and ifconfig Commands

Linux: Top Command

Linux: Grep Command

Linux: Strings Command

back to top

Incident Reporting

Incident-Reporting1

authenticationIncident Reporting

Why to Report an Incident

Why Organizations do not Report Computer Crimes

Whom to Report an Incident

How to Report an Incident

Details to be Reported

Preliminary Information Security Incident Reporting Form

CERT Incident Reference Numbers

Contact Information

Sample Report Showing Contact Information

Summary of Hosts Involved

Sample Report Showing Summary of Hosts Involved

Description of the Activity

Sample Report Showing Description of the Activity

Log Extracts Showing the Activity

Example Showing the Log Extracts of an Activity

Time Zone

Federal Agency Incident Categories

Organizations to Report Computer Incident

United State Internet Crime Task Force

Internet Crime Complaint Center (IC3)

Computer Crime & Intellectual Property Section

Internet Watch Foundation (IWF)

Incident Reporting Guidelines

Sample Incident Reporting Form

Sample Post Incident Report Form

Incident Recovery

Incident-Recovery2

developing-it-securityIncident Recovery

Principles of Incident Recovery

Incident Recovery Steps

Contingency/Continuity of Operations Planning

Business Continuity Planning

Incident Recovery Plan

Incident Recovery Planning Process

Incident Recovery Planning Team

Business Impact Analysis

Incident Recovery Plan Implementation

Incident Recovery Training

Incident Recovery Testing

Security Policies and Laws

Security-Policies-and-Laws2

security-policiesSecurity Policy

Key Elements of Security Policy

Goals of a Security Policy

Characteristics of a Security Policy

Design of Security Policy

Implementing Security Policies

Acceptable Use Policy (AUP)

Access Control Policy

Sample Access Control Policy

Importance of Access Control Policies

Asset Control Policy

Audit Trail Policy

Sample Audit Trail Policy 1

Importance of Audit Trail Policy

Logging Policy

Importance of Logging Policies

Documentation Policy

Evidence Collection Policy

Evidence Preservation Policy

Information Security Policy

Information Security Policy: University of California

Information Security Policy: Pearce & Pearce, Inc.

Importance of Information Security Policy

National Information Assurance Certification & Accreditation Process (NIACAP) Policy

Importance of NIACAP Policy

Physical Security Policy

Sample Physical Security Policy 1

Sample Physical Security Policy 2

Importance of Physical Security Policies

Physical Security Guidelines

Personnel Security Policies & Guidance

Law and Incident Handling

Role of Law in Incident Handling

Legal Issues When Dealing With an Incident

Law Enforcement Agencies

Laws and Acts

Searching and Seizing Computers without a Warrant

§ A: Fourth Amendment’s “Reasonable Expectation of Privacy” in Cases Involving Computers: General Principles

§ A.4: Private Searches

The Privacy Protection Act

Federal Information Security Management Act (FISMA)

Mexico

Brazilian Laws

Canadian Laws

United Kingdom’s Laws

Belgium Laws

German Laws

Italian Laws

Cybercrime Act 2001

Information Technology Act

Singapore Laws

Sarbanes-Oxley Act

Social Security Act

Gramm-Leach-Bliley Act

Health Insurance Portability and Accountability Act  (HIPAA)

Intellectual Property Laws

Intellectual Property

US Laws for Trademarks and Copyright

Australia Laws For Trademarks and Copyright

UK Laws for Trademarks and Copyright

China Laws for Trademarks and Copyright

Indian Laws for Trademarks and Copyright

Japanese Laws for Trademarks and Copyright

Canada Laws for Trademarks and Copyright

South African Laws for Trademarks and Copyright

South Korean Laws for Trademarks and Copyright

Belgium Laws for  Trademarks  and Copyright

Hong Kong Laws for Intellectual Property

back to top

 
become an ethical hackerbecoma a forensic Investigator
become a secure computer userbecome an Enryption Specialist
become a network security administratorBecome a Network Defense Architect
 

sat-guaranteed

We are committed to providing our customers with the best service and products available.

100% satisfaction guarantee

why students prefer computek as the best training center in egypt new

1.Computek Training Center has trained over 1,000,000 trainees in Egypt and over 100,000 trainees in Middle East and africa.

2.Our programs are designed to meet our clients' training necessities including budget and time limitation.

3.We will cooperate with you to bring out effective programs fitting your organization.

4.Computek Training Center provides customer-focus training in mutable deliverymethods offering top quality training and high qualified instructor to meet individual learning styles and organization profession training.

5.Computek instructors are selected from the best of training professional instructors in Egypt who awarded the trust worthy certified international companies, Computek instructors not only provide superior education but also reliable work experience in the field of giving courses

6.Trainees prefer Computek Training Center not only due to our high quality training but also for our reasonable and cost-effective price list.

7.Computek Classroom is designed with cutting edge facilities strong from hardware and software technologies to the most sophisticated educational aids.

8.The information desk with our friendly and professional customers support representative is highly qualified to answer any questions and also deliver your unique requirements.

9.Computek Training Center staff is available 7 days in week from 10:00 AM to 10:00 PM to deal with any inquiries and assist student with anything they need.

10.Computek Training Center is partner of world's technology leads such as Microsoft, Cisco, Compatia, EC Council ,Adobe , Autodesk, prometric and Pearson VUE.

 
All Rights Reseved © Computekeg.com