GIAC - Firebrand Training for GIAC Certified Incident Handler certification

Curriculum

Incident Handling: Identification

• Get an understanding of important strategies to gather events, analyse them, and determine if you have an incident

Incident Handling: Overview and Preparation

• Prove your understanding of Incident Handling, why it is important, and gain an understanding of best practices to take in preparation for an incident

Buffer Overflows and Format String Attacks

• Demonstrate an understanding of how buffer overflows and format string attacks work and how to defend against them

Client Attacks

• Gain an understanding of various client attacks and how to defend against them

Covering Tracks: Networks

• Learn how attackers use tunnelling and covert channels to cover their tracks on a network, and the strategies involved in defending against them

Covering Tracks: Systems

• Discover how attackers hide files and directories on Windows and Linux hosts and how they attempt to cover their tracks

Denial of Service Attacks

• Get a comprehensive understanding of the different kinds of Denial of Service attacks and how to defend against them

Incident Handling: Containment

• You’ll demonstrate an understanding of high-level strategies to prevent an attacker from causing further damage to the victim after discovering the incident.

Incident Handling: Eradication, Recovery, and Lessons Learned

• Gain an understanding of the general approaches to get rid of the attacker's artefacts on compromised machines, the general strategy to safely restore operations, and the importance of the incident report and lessons learned meetings

Network Attacks

• You’ll get an understanding of various network attacks and how to defend against them

Password Attacks

• Prove your detailed understanding of the three methods of password cracking

Reconnaissance

• Demonstrate your understanding of public and open source reconnaissance techniques

Scanning: Discovery and Mapping

• Get introduced to scanning fundamentals; to discover and map networks and hosts, and reveal services and vulnerabilities

Scanning: Techniques and Defence

• Learn the techniques and tools used in scanning, and how to response and prepare against scanning

Session Hijacking and Cache Poisoning

• Demonstrate an understanding of tools and techniques used to perform session hijacking and cache poisoning, and how to respond and prepare against these attacks

Techniques for maintaining access

• Learn how Trojan horses and rootkits operate, what their capabilities are and how to defend against them

Web Application Attacks

• Demonstrate an understanding of the value of the Open Web Application Security Project (OWASP), as well as different Web App attacks such as account harvesting, SQL injection, Cross-Site Scripting and other Web Session attacks

Worms, Bots & Bot-Nets

• Demonstrate a detailed understanding of what worms, bots and bot-nets are, and how to protect against them