Certified Incident Handling Engineer (CIHE)

Assess threats, vulnerabilities, and exploits, including malware such as viruses, worms, Trojans, spyware, adware, rootkits, and botnets. Learn defenses like anti-malware tools, ARP spoofing countermeasures, and intrusion detection.

Explore threats, vulnerabilities, and exploits such as arp poisoning, dns spoofing, session hijacking, buffer overflows, phishing, social engineering, and evil twins, with defenses like encryption and intrusion detection systems.

Explore wireless threats from wardriving and flawed WEP encryption to SQL injection and cross-site scripting, and learn vulnerability assessments, pen testing, and exploitation using tools like Nessus, Nmap, and Metasploit.

Develop incident handling with strong senior management support, a clear communication and reporting plan, per-incident type procedures, trained teams, and ongoing metrics.

Compare internal centralized, internal distributed, and combined incident handling team models, including coordinating team concepts. Understand incident communication, role responsibilities, contact lists, and escalation practices to prepare effective responses.

Explore identity management and ticketing systems, digital forensics, e-discovery, and data backup strategies, emphasizing enterprise antivirus, defense in depth, and log management for incident handling.

Explore how Request Tracker supports incident handling with a flexible ticketing workflow, email gateways, and an integrated Rtfm knowledge base.

Identify unusual log events, processes, and network usage to guide incident response. Assemble a responder toolkit and use netcat to pipe evidence to a separate system, preserving volatile data.

Explore Linux log analysis for preliminary incident response, identify promiscuous mode, logon failures, and suspicious processes using netstat, ps, top, lsof, arp, and crontab, and review Tripwire and hardening tools.

Identify whether an incident occurred, assess severity and nature, and apply a six-step process: categorize, receive, analyze, document, prioritize, and notify, using sensors, logs, and intrusion detection system and Wireshark.

Explore Sysinternals tool sets—free diagnostic and troubleshooting utilities for Windows, including Process Explorer, Process Monitor, AutoRuns, PS Tools, and Sigcheck, ideal for incident handling and digital forensics.

Containment focuses on stopping the spread of malware by securing the area, delaying or selecting a containment strategy, and blocking ongoing access while preserving evidence for recovery and legal actions.

Remove the incident's cause, preserve evidence, patch vulnerabilities to prevent the compromise from repeating, and assess the full scope and origin of the attack.

Eradicate the incident by removing malware across systems, isolating infected devices, and validating backups; implement containment, forensics, and offline patching before rebuilding with clean images and stronger security.

Execute the final stage of incident handling by producing timely follow-up reports, capturing lessons learned, archiving evidence, and closing incidents to prevent recurrence.