Nick Mitropoulos - GCIH GIAC Certified Incident Handler All-in-One Exam Guide

Copyright 2020 by McGraw Hill. All rights reserved. Except as permitted under the United States Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication.

ISBN: 978-1-26-046163-3
MHID: 1-26-046163-7

The material in this eBook also appears in the print version of this title: ISBN: 978-1-26-046162-6, MHID: 1-26-046162-9.

eBook conversion by codeMantra
Version 1.0

All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a trademarked name, we use names in an editorial fashion only, and to the benefit of the trademark owner, with no intention of infringement of the trademark. Where such designations appear in this book, they have been printed with initial caps.

McGraw-Hill Education eBooks are available at special quantity discounts to use as premiums and sales promotions or for use in corporate training programs. To contact a representative, please visit the Contact Us page at www.mhprofessional.com.

Information has been obtained by McGraw Hill from sources believed to be reliable. However, because of the possibility of human or mechanical error by our sources, McGraw Hill, or others, McGraw Hill does not guarantee the accuracy, adequacy, or completeness of any information and is not responsible for any errors or omissions or the results obtained from the use of such information.

TERMS OF USE

This is a copyrighted work and McGraw-Hill Education and its licensors reserve all rights in and to the work. Use of this work is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and retrieve one copy of the work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works based upon, transmit, distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill Educations prior consent. You may use the work for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your right to use the work may be terminated if you fail to comply with these terms.

THE WORK IS PROVIDED AS IS. McGRAW-HILL EDUCATION AND ITS LICENSORS MAKE NO GUARANTEES OR WARRANTIES AS TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED FROM USING THE WORK, INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK VIA HYPERLINK OR OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. McGraw-Hill Education and its licensors do not warrant or guarantee that the functions contained in the work will meet your requirements or that its operation will be uninterrupted or error free. Neither McGraw-Hill Education nor its licensors shall be liable to you or anyone else for any inaccuracy, error or omission, regardless of cause, in the work or for any damages resulting therefrom. McGraw-Hill Education has no responsibility for the content of any information accessed through the work. Under no circumstances shall McGraw-Hill Education and/or its licensors be liable for any indirect, incidental, special, punitive, consequential or similar damages that result from the use of or inability to use the work, even if any of them has been advised of the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or cause arises in contract, tort or otherwise.

This book is dedicated to my beautiful wife, Elizabeth, for all her support and encouragement.

Nick Mitropoulos is the CEO of Scarlet Dragonfly and has more than 14 years of experience in security training, cybersecurity, incident handling, vulnerability management, security operations, threat intelligence, and data loss prevention. He has worked for a variety of companies (including the Greek Ministry of Education, AT&T, F5 Networks, JPMorgan Chase, KPMG, and Deloitte) and has provided critical advice to many clients regarding various aspects of their security. Hes SC/NATO security cleared, a certified (ISC)2 and EC-Council instructor, Cisco champion, and senior IEEE member, as well as a GIAC advisory board member, and has an MSc (with distinction) in Advanced Security and Digital Forensics from Edinburgh Napier University. He holds over 25 security certifications, including GCIH, GPEN, GWAPT, GISF, Security+, SSCP, CBE, CMO, CCNA Cyber Ops, CCNA Security, CCNA Routing & Switching, CCDA, CEH, CEI, Palo Alto (ACE), Qualys (Certified Specialist in AssetView and ThreatPROTECT, Cloud Agent, PCI Compliance, Policy Compliance, Vulnerability Management, Web Application Scanning), and Splunk Certified User.

If you have any questions or want to provide any feedback, please feel free to reach out via ), or Twitter (@MitropoulosNick).

Paul Joseph, MEng, CISSP, GCIA, and GCHQ-certified cloud practitioner, has been in the IT industry since 2004. He is currently an independent cybersecurity technical consultant. Paul began his career as a technician and trainer, where he supported various technologies. Over the years, he has worked as a security engineer, security analyst, incident responder, and security operations consultant for critical UK infrastructure, financial services, and global service providers in the UK and abroad. Paul is a passionate blue teamer and cloud enthusiast.

I would like to extend my thanks to Wendy Rinaldi from McGraw Hill for entrusting me to write another book, as well as Emily Walters for her vigilant support and prompt feedback, and Patty Mon for reaching out with valuable suggestions on how to make the content as helpful as possible for the readers.

Everyone has a different mindset about taking exams. Some need the related certifications to progress in their careers or because their employers demand it. Others just want to attend associated courses to accumulate knowledge and dont necessarily mind the exams or the certifications that come with them. Before you start reading this book, you need to decide what exactly you want to do. Do you want to just get some basic knowledge around incident response, or do you want to fully prepare for the GIAC Certified Incident Handler (GCIH) exam? Hopefully, you will be satisfied either way, but if you are aiming to take the exam, a more methodic approach will be warranted. If thats the case, keep on reading.

Before you read this section, a clarification needs to be provided. This book is not here to give you a shortcut to the exam or to provide any details that give unlawful insight into the exam itself. Everything mentioned here is public information that Global Information Assurance Certification (GIAC) has published to aid exam takers in preparing for the exam.

First of all, the good news: The exam is open book. Oh yes, thats right. Now for some bad news: The exam is open book. This can easily make you have a false sense of confidence because you think you can answer all questions, since the answers are in this book or any other resources you bring in the room. However, if you dont study hard, spending time understanding the material and practicing everything in the lab, you will undoubtedly find out the hard way how difficult an open-book exam can be. You really dont want to go into that room underprepared.