Certification: GCIH

Certification:

GIAC Certified Incident Handler (GCIH)

Security Professionals that want to demonstrate they are qualified for IT systems hands-on roles with respect to security tasks. Candidates are required to demonstrate an understanding of information security beyond simple terminology and concepts.

See the GIAC website for additional details on the GCIH certification.

Exam Certification Objectives
Objectives Objective Outcome Statement
Covering Tracks on Hosts The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against methods attackers use to remove evidence of compromise on hosts.
Covering Tracks on the Network The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against methods attackers use to remove evidence of compromise on the network.
Domain Attacks The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against Domain attacks in Windows environments.
Drive-By Attacks The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against drive-by attacks in modern environments.
Endpoint Attacks and Pivoting The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against attacks against endpoints and attack pivoting.
Incident Handling and Digital Investigations The candidate will demonstrate an understanding of what Incident Handling is, why it is important, an understanding of the PICERL incident handling process, and industry best practices in Incident Handling and Digital Investigations.
Memory and Malware Investigations The candidate will demonstrate an understanding of the steps necessary to perform basic memory forensics, including collection and analysis of processes and network connections and basic malware analysis.
Metasploit The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against the use of Metasploit.
Netcat The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against the use of covert tools such as netcat.
Network Investigations The candidate will demonstrate an understanding of the steps necessary to perform effective digital investigations of network data.
Password Attacks The candidate will demonstrate a detailed understanding of the three methods of password cracking.
Physical Access Attacks The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against physical access attacks.
Reconnaissance and Open-Source Intelligence The candidate will demonstrate an understanding of how to identify, defend against, and mitigate public and open source reconnaissance techniques.
Scanning and Mapping The candidate will demonstrate an understanding the fundamentals of how to identify, defend against, and mitigate against scanning; to discover and map networks and hosts, and reveal services and vulnerabilities.
SMB Scanning The candidate will demonstrate an understanding of how to identify, defend against, and mitigate reconnaissance and scanning of SMB services.
Web App Attacks The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against Web Application Attacks.