EC-Council Certified Incident Handler® (ECIH® v3)

Get EC-Council Certified Incident Handler (ECIH) v3 certified in just three days and get the skills you need to be an expert in incident management, handling and response.

100% compliant with the NICE 2.0 & CREST Frameworks, the ECIH certification is internationally recognised - giving you valuable credibility in incident management. You’ll learn how to identify, control and recover from cyber security attacks on this hands-on accelerated course.

Get 50% more training time than traditional 9-5pm courses. Using Firebrand's unique Lecture | Lab | Review technique, you'll spend more time practicing techniques to detect and respond to current cyber security threats.

On this accelerated ECIH certification course you’ll learn:

• Structured incident handling and first response plans and procedures
• Forensic readiness, evidence gathering and analysis
• Incident validation, escalation procedures and writing incident reports
• Incident containment and systems recovery

You’ll sit your ECIH exam during the course, just steps away from the classroom. As an official EC-Council partner, you’ll learn from an EC-Council ECIH certified instructor and benefit from official EC-Council courseware and labs.

This accelerated ECIH course is perfect if you’re an incident handler, risk assessment administrator, pen tester, cyber forensic investigator, vunerability assessment auditor, system administrator, system engineer, firewall administrator or network manager.

ECIH v3 was created using job task analysis related to incident handling and incident first responder roles and meets industry-wide incident handling standards.

9x Accredited Training Centre of the Year

Firebrand Training has again won the EC-Council Accredited Training Centre of the Year Award, from a Training Partner network that has more than 700 training centres across 107 countries. This extends a record-breaking run of successive awards to nine years.

Jay Bavisi, President of EC-Council said: “The annual EC-Council Awards highlights the commitment and achievements of our global partners and trainers that have contributed to the information security community.”

Module 01: Introduction to Incident Handling and Response

• Understand Information Security Threats and Attack Vectors
• Explain Various Attack and Defence Frameworks
• Understand Information Security Concepts
• Understand Information Security Incidents
• Understand the Incident Management Process
• Understand Incident Response Automation and Orchestration
• Describe Various Incident Handling and Response Best Practices
• Explain Various Standards Related to Incident Handling and Response
• Explain Various Cybersecurity Frameworks
• Understand Incident Handling Laws and Legal Compliance

Module 02: Incident Handling and Response Process

• Understand Incident Handling and Response (IH&R) Process
• Explain Preparation Steps for Incident Handling and Response
• Understand Incident Recording and Assignment
• Understand Incident Triage
• Explain the Process of Notification
• Understand the Process of Containment
• Describe Evidence Gathering and Forensics Analysis
• Explain the Process of Eradication
• Understand the Process of Recovery
• Describe Various Post-Incident Activities
• Explain the Importance of Information Sharing Activities

Module 03: First Response

• Explain the Concept of First Response
• Understand the Process of Securing and Documenting the Crime Scene
• Understand the Process of Collecting Evidence at the Crime Scene
• Explain the Process for Preserving, Packaging, and Transporting Evidence

Module 04: Handling and Responding to Malware Incidents

• Understand the Handling of Malware Incidents
• Explain Preparation for Handling Malware Incidents
• Understand Detection of Malware Incidents
• Explain Containment of Malware Incidents
• Describe How to Perform Malware Analysis
• Understand Eradication of Malware Incidents
• Explain Recovery after Malware Incidents
• Understand the Handling of Malware Incidents - Case Study
• Describe Best Practices against Malware Incidents

Module 05: Handling and Responding to Email Security Incidents

• Understand Email Security Incidents
• Explain Preparation Steps for Handling Email Security Incidents
• Understand Detection and Containment of Email Security Incidents
• Understand Analysis of Email Security Incidents
• Explain Eradication of Email Security Incidents
• Understand the Process of Recovery after Email Security Incidents
• Understand the Handling of Email Security Incidents - Case Study
• Explain Best Practices against Email Security Incidents

Module 06: Handling and Responding to Network Security Incidents

• Understand the Handling of Network Security Incidents
• Prepare to Handle Network Security Incidents
• Understand Detection and Validation of Network Security Incidents
• Understand the Handling of Unauthorized Access Incidents
• Understand the Handling of Inappropriate Usage Incidents
• Understand the Handling of Denial-of-Service Incidents
• Understand the Handling of Wireless Network Security Incidents
• Understand the Handling of Network Security Incidents - Case Study
• Describe Best Practices against Network Security Incidents

Module 07: Handling and Responding to Web Application Security Incidents

• Understand the Handling of Web Application Incidents
• Explain Preparation for Handling Web Application Security Incidents
• Understand Detection and Containment of Web Application Security Incidents
• Explain Analysis of Web Application Security Incidents
• Understand Eradication of Web Application Security Incidents
• Explain Recovery after Web Application Security Incidents
• Understand the Handling of Web Application Security Incidents - Case Study
• Describe Best Practices for Securing Web Applications

Module 08: Handling and Responding to Cloud Security Incidents

• Understand the Handling of Cloud Security Incidents
• Explain Various Steps Involved in Handling Cloud Security Incidents
• Understand How to Handle Azure Security Incidents
• Understand How to Handle AWS Security Incidents
• Understand How to Handle Google Cloud Security Incidents
• Understand the Handling of Cloud Security Incidents - Case Study
• Explain Best Practices against Cloud Security Incidents

Module 09: Handling and Responding to Insider Threats

• Understand the Handling of Insider Threats
• Explain Preparation Steps for Handling Insider Threats
• Understand Detection and Containment of Insider Threats
• Explain Analysis of Insider Threats
• Understand Eradication of Insider Threats
• Understand the Process of Recovery after Insider Attacks
• Understand the Handling of Insider Threats - Case Study
• Describe Best Practices against Insider Threats

Module 10: Handling and Responding to Endpoint Security Incidents

• Understand the Handling of Endpoint Security Incidents
• Explain the Handling of Mobile-based Security Incidents
• Explain the Handling of IoT-based Security Incidents
• Explain the Handling of OT-based Security Incidents
• Understand the Handling of Endpoint Security Incidents - Case Study

You should have the following experience before attending this course:

• A minimum of one year of experience managing Windows/Unix/Linux systems
• An understanding of common network and security services

You'll sit the following exam on-site as part of the course:

• ECIH: exam code 212-89
• Number of Questions: 100
• Passing Score: 65% to 80% (depending on question bank*)
• Test Duration: 3 hours
• Test Format: Multiple choice

*In order to maintain the high integrity of our certifications exams, EC-Council Exams are provided in multiple forms (I.e. different question banks). Each form is carefully analysed through beta testing with an appropriate sample group under the purview of a committee of subject matter experts that ensure that each of our exams not only have academic rigor but also have “real world” applicability. EC-Council have a process to determine the difficulty rating of each question . The individual rating then contributes to an overall “Cut Score” for each exam form. To ensure each form has equal assessment standards, cut scores are set on a “per exam form” basis. Depending on which exam form is challenged, cut scores can range from 60% to 85%.