Part of the BPP Education Group
+44 207 907 1120EC-Council - Certified Incident Handler (ECIH) v3 certification
Overview
Get EC-Council Certified Incident Handler (ECIH) v3 certified in just three days and get the skills you need to be an expert in incident management, handling and response.
100% compliant with the NICE 2.0 & CREST Frameworks, the ECIH certification is internationally recognised - giving you valuable credibility in incident management. You’ll learn how to identify, control and recover from cyber security attacks on this hands-on accelerated course.
Get 50% more training time than traditional 9-5pm courses. Using Firebrand's unique Lecture | Lab | Review technique, you'll spend more time practicing techniques to detect and respond to current cyber security threats.
On this accelerated ECIH certification course you’ll learn:
- Structured incident handling and first response plans and procedures
- Forensic readiness, evidence gathering and analysis
- Incident validation, escalation procedures and writing incident reports
- Incident containment and systems recovery
You’ll sit your ECIH exam during the course, just steps away from the classroom. As an official EC-Council partner, you’ll learn from an EC-Council ECIH certified instructor and benefit from official EC-Council courseware and labs.
This accelerated ECIH course is perfect if you’re an incident handler, risk assessment administrator, pen tester, cyber forensic investigator, vunerability assessment auditor, system administrator, system engineer, firewall administrator or network manager.
ECIH v3 was created using job task analysis related to incident handling and incident first responder roles and meets industry-wide incident handling standards.
9x Accredited Training Centre of the Year
Firebrand Training has again won the EC-Council Accredited Training Centre of the Year Award, from a Training Partner network that has more than 700 training centres across 107 countries. This extends a record-breaking run of successive awards to nine years.
Jay Bavisi, President of EC-Council said: “The annual EC-Council Awards highlights the commitment and achievements of our global partners and trainers that have contributed to the information security community.”
Benefits
Seven reasons why you should sit your course with Firebrand Training
- Two options of training. Choose between residential classroom-based, or online courses
- You'll be certified fast. With us, you’ll be trained in record time
- Our course is all-inclusive. A one-off fee covers all course materials, exams**, accommodation* and meals*. No hidden extras.
- Pass the first time or train again for free. This is our guarantee. We’re confident you’ll pass your course the first time. But if not, come back within a year and only pay for accommodation, exams and incidental costs
- You’ll learn more. A day with a traditional training provider generally runs from 9 am – 5 pm, with a nice long break for lunch. With Firebrand Training you’ll get at least 12 hours/day of quality learning time, with your instructor
- You’ll learn faster. Chances are, you’ll have a different learning style to those around you. We combine visual, auditory and tactile styles to deliver the material in a way that ensures you will learn faster and more easily
- You’ll be studying with the best. We’ve been named in the Training Industry’s “Top 20 IT Training Companies of the Year” every year since 2010. As well as winning many more awards, we’ve trained and certified over 135,000 professionals
- * For residential training only. Doesn't apply for online courses
- ** Some exceptions apply. Please refer to the Exam Track or speak with our experts
Curriculum
Module 01: Introduction to Incident Handling and Response
- Understand Information Security Threats and Attack Vectors
- Explain Various Attack and Defence Frameworks
- Understand Information Security Concepts
- Understand Information Security Incidents
- Understand the Incident Management Process
- Understand Incident Response Automation and Orchestration
- Describe Various Incident Handling and Response Best Practices
- Explain Various Standards Related to Incident Handling and Response
- Explain Various Cybersecurity Frameworks
- Understand Incident Handling Laws and Legal Compliance
Module 02: Incident Handling and Response Process
- Understand Incident Handling and Response (IH&R) Process
- Explain Preparation Steps for Incident Handling and Response
- Understand Incident Recording and Assignment
- Understand Incident Triage
- Explain the Process of Notification
- Understand the Process of Containment
- Describe Evidence Gathering and Forensics Analysis
- Explain the Process of Eradication
- Understand the Process of Recovery
- Describe Various Post-Incident Activities
- Explain the Importance of Information Sharing Activities
Module 03: First Response
- Explain the Concept of First Response
- Understand the Process of Securing and Documenting the Crime Scene
- Understand the Process of Collecting Evidence at the Crime Scene
- Explain the Process for Preserving, Packaging, and Transporting Evidence
Module 04: Handling and Responding to Malware Incidents
- Understand the Handling of Malware Incidents
- Explain Preparation for Handling Malware Incidents
- Understand Detection of Malware Incidents
- Explain Containment of Malware Incidents
- Describe How to Perform Malware Analysis
- Understand Eradication of Malware Incidents
- Explain Recovery after Malware Incidents
- Understand the Handling of Malware Incidents - Case Study
- Describe Best Practices against Malware Incidents
Module 05: Handling and Responding to Email Security Incidents
- Understand Email Security Incidents
- Explain Preparation Steps for Handling Email Security Incidents
- Understand Detection and Containment of Email Security Incidents
- Understand Analysis of Email Security Incidents
- Explain Eradication of Email Security Incidents
- Understand the Process of Recovery after Email Security Incidents
- Understand the Handling of Email Security Incidents - Case Study
- Explain Best Practices against Email Security Incidents
Module 06: Handling and Responding to Network Security Incidents
- Understand the Handling of Network Security Incidents
- Prepare to Handle Network Security Incidents
- Understand Detection and Validation of Network Security Incidents
- Understand the Handling of Unauthorized Access Incidents
- Understand the Handling of Inappropriate Usage Incidents
- Understand the Handling of Denial-of-Service Incidents
- Understand the Handling of Wireless Network Security Incidents
- Understand the Handling of Network Security Incidents - Case Study
- Describe Best Practices against Network Security Incidents
Module 07: Handling and Responding to Web Application Security Incidents
- Understand the Handling of Web Application Incidents
- Explain Preparation for Handling Web Application Security Incidents
- Understand Detection and Containment of Web Application Security Incidents
- Explain Analysis of Web Application Security Incidents
- Understand Eradication of Web Application Security Incidents
- Explain Recovery after Web Application Security Incidents
- Understand the Handling of Web Application Security Incidents - Case Study
- Describe Best Practices for Securing Web Applications
Module 08: Handling and Responding to Cloud Security Incidents
- Understand the Handling of Cloud Security Incidents
- Explain Various Steps Involved in Handling Cloud Security Incidents
- Understand How to Handle Azure Security Incidents
- Understand How to Handle AWS Security Incidents
- Understand How to Handle Google Cloud Security Incidents
- Understand the Handling of Cloud Security Incidents - Case Study
- Explain Best Practices against Cloud Security Incidents
Module 09: Handling and Responding to Insider Threats
- Understand the Handling of Insider Threats
- Explain Preparation Steps for Handling Insider Threats
- Understand Detection and Containment of Insider Threats
- Explain Analysis of Insider Threats
- Understand Eradication of Insider Threats
- Understand the Process of Recovery after Insider Attacks
- Understand the Handling of Insider Threats - Case Study
- Describe Best Practices against Insider Threats
Module 10: Handling and Responding to Endpoint Security Incidents
- Understand the Handling of Endpoint Security Incidents
- Explain the Handling of Mobile-based Security Incidents
- Explain the Handling of IoT-based Security Incidents
- Explain the Handling of OT-based Security Incidents
- Understand the Handling of Endpoint Security Incidents - Case Study
Exam Track
You'll sit the following exam on-site as part of the course:
- ECIH: exam code 212-89
- Number of Questions: 100
- Passing Score: 70%
- Test Duration: 3 hours
- Test Format: Multiple choice
What's Included
On this accelerated, all-inclusive course you'll get:
- EC-Council ECIH Certified Instructor
- Official EC-Council ECIH course materials
- Official ECIH lab access
- Instructor-led ECIH exam preparation
- EC-Council ECIH exam, which you'll take on the final day of the course
When you achieve your ECIH certification, you will be awarded a digital badge. This can be downloaded from EC-Council’s Aspen Portal.
Your accelerated course includes:
- Accommodation *
- Meals, unlimited snacks, beverages, tea and coffee *
- On-site exams **
- Exam vouchers **
- Practice tests **
- Certification Guarantee ***
- Courseware
- Up-to 12 hours of instructor-led training each day
- 24-hour lab access
- Digital courseware **
- * For residential training only. Accommodation is included from the night before the course starts. This doesn't apply for online courses.
- ** Some exceptions apply. Please refer to the Exam Track or speak with our experts
- *** Pass first time or train again free as many times as it takes, unlimited for 1 year. Just pay for accommodation, exams, and incidental costs.
Prerequisites
You should have the following experience before attending this course:
- A minimum of one year of experience managing Windows/Unix/Linux systems
- An understanding of common network and security services
Unsure whether you meet the prerequisites? Don’t worry. Your training consultant will discuss your background with you to understand if this course is right for you.
Reviews
Here's the Firebrand Training review section. Since 2001 we've trained exactly 134561 students and asked them all to review our Accelerated Learning. Currently, 96.41% have said Firebrand exceeded their expectations.
Read reviews from recent accelerated courses below or visit Firebrand Stories for written and video interviews from our alumni.
"The course was well-structured and covered a wide range of topics, all of which were relevant to my professional development. Throughout the course, I had access to a knowledgeable and supportive instructor who was always willing to answer any questions I had. The instructor provided engaging lectures, insightful examples, and practical exercises that will allow me to apply the concepts I learned in real-world situations."
MH. (12/4/2023 (Wednesday) to 14/4/2023 (Friday))
"Excellent training provided by the instructor on behalf of Firebrand. Highly recommended."
AM. (12/4/2023 (Wednesday) to 14/4/2023 (Friday))
"good instructor , course was heavy in terms of literature , prep reading would be recommended"
Nathan Smith, SOUTH WALES POLICE. (12/4/2023 (Wednesday) to 14/4/2023 (Friday))
"The staff are knowledgeable and try to make the courses fun. You will come away will tools and knowledge for your day to day business."
G.M.. (19/9/2019 (Thursday) to 21/9/2019 (Saturday))
"Full on."
Alistair Toomey, BBC. (19/9/2019 (Thursday) to 21/9/2019 (Saturday))
Course Dates
Start |
Finish |
Status |
Book now |
|---|---|---|---|
|
10/4/2024 (Wednesday) |
12/4/2024 (Friday) |
Finished - Leave feedback |
|
|
1/7/2024 (Monday) |
3/7/2024 (Wednesday) |
Open |
|
|
23/9/2024 (Monday) |
25/9/2024 (Wednesday) |
Open |
|
|
21/10/2024 (Monday) |
23/10/2024 (Wednesday) |
Open |
|
|
16/12/2024 (Monday) |
18/12/2024 (Wednesday) |
Open |