Certified Incident Handling Engineer (CIHE)

Assess threats, vulnerabilities, and exploits, including malware such as viruses, worms, Trojans, spyware, adware, rootkits, and botnets. Learn defenses like anti-malware tools, ARP spoofing countermeasures, and intrusion detection.

Explore wireless threats from wardriving and flawed WEP encryption to SQL injection and cross-site scripting, and learn vulnerability assessments, pen testing, and exploitation using tools like Nessus, Nmap, and Metasploit.

Develop incident handling with strong senior management support, a clear communication and reporting plan, per-incident type procedures, trained teams, and ongoing metrics.

Identify unusual log events, processes, and network usage to guide incident response. Assemble a responder toolkit and use netcat to pipe evidence to a separate system, preserving volatile data.

Explore Linux log analysis for preliminary incident response, identify promiscuous mode, logon failures, and suspicious processes using netstat, ps, top, lsof, arp, and crontab, and review Tripwire and hardening tools.

Identify whether an incident occurred, assess severity and nature, and apply a six-step process: categorize, receive, analyze, document, prioritize, and notify, using sensors, logs, and intrusion detection system and Wireshark.

Explore Sysinternals tool sets—free diagnostic and troubleshooting utilities for Windows, including Process Explorer, Process Monitor, AutoRuns, PS Tools, and Sigcheck, ideal for incident handling and digital forensics.