EC-Council Certified Incident Handler (E|CIH): key terms

Flashcards for this exam EC-Council Certified Incident Handler (E|CIH) guide Class dates

• After-Action Report (AAR)A formal document summarizing an incident or exercise, its timeline, outcomes and recommendations.Intermediate
• Chain of CustodyDocumentation that records every person who handled evidence, when, why and how, from collection to presentation.Foundational
• Communication PlanThe part of the IR plan defining who is notified, how, when and by whom during an incident.Foundational
• ContainmentThe incident response phase that limits the spread and impact of an incident while preserving evidence.Foundational
• Cyber Kill ChainLockheed Martin's seven-stage model of an intrusion from reconnaissance to actions on objectives.Foundational
• Data BreachA security incident resulting in confirmed unauthorized access to or disclosure of sensitive data.Foundational
• Data Breach NotificationLegal or contractual obligations to inform regulators, affected individuals or partners after a qualifying data breach.Intermediate
• Detection and AnalysisThe incident response phase focused on identifying potential incidents, validating them and determining scope and impact.Foundational
• Double ExtortionA ransomware tactic that both encrypts data and threatens to leak stolen copies unless a ransom is paid.Intermediate
• Dwell TimeThe length of time an attacker remains undetected in an environment from initial compromise to detection.Intermediate
• EradicationThe incident response phase that removes the threat, including malware, backdoors and compromised accounts, from the environment.Foundational
• EscalationTransferring an alert or incident to a higher tier, specialist team or management according to defined criteria.Foundational
• Host IsolationDisconnecting an endpoint from the network except for the security management channel to contain a threat.Foundational
• Incident Commander (IC)The person who coordinates the overall response to a major incident, delegating work and managing communication rather than fixing the issue directly.Intermediate
• Incident Response (IR)The organized approach to preparing for, detecting, containing, eradicating and recovering from security incidents.Foundational
• Incident Response Plan (IRP)A documented set of policies, roles and procedures guiding how an organization responds to security incidents.Foundational
• Incident Response Team (CSIRT)The group responsible for handling security incidents, also called a computer security incident response team.Foundational
• Incident SeverityA classification of an incident's urgency and impact used to prioritize response and escalation.Foundational
• Jump BagA pre-assembled kit of tools, media and documentation that incident responders can grab immediately.Intermediate
• Lessons LearnedA review conducted after an incident to identify what happened, what worked, what failed and how to improve.Foundational
• Mean Time to Detect (MTTD)The average time between when an incident begins and when it is detected.Foundational
• Mean Time to Respond (MTTR)The average time between detecting an incident and containing or resolving it.Foundational
• NIST SP 800-61The NIST publication providing guidance on computer security incident handling and response.Intermediate
• Out-of-Band CommunicationCommunication through channels separate from potentially compromised production systems during an incident.Intermediate
• PlaybookA documented or automated set of steps for responding to a specific type of security incident or alert.Foundational
• Post-Incident ActivityThe final incident response phase covering lessons learned, reporting, evidence retention and process improvement.Foundational
• PrecursorA sign that an incident may occur in the future.Intermediate
• PreparationThe incident response phase in which an organization establishes capabilities, tools, plans and training before incidents occur.Foundational
• Ransomware-as-a-Service (RaaS)A criminal business model in which ransomware developers lease their malware and infrastructure to affiliates for a share of ransoms.Intermediate
• RecoveryThe incident response phase that restores systems and operations to normal and verifies they are functioning securely.Foundational
• Root Cause Analysis (RCA)A structured investigation to identify the underlying causes of an incident so they can be eliminated.Foundational
• SANS PICERLThe SANS six-step incident response model: Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned.Intermediate
• ScopingDetermining which controls or requirements apply to a system, process, or assessment.Intermediate
• Security EventAny observable occurrence in a system or network that may have security relevance.Foundational
• Security IncidentAn occurrence that actually or potentially jeopardizes the confidentiality, integrity or availability of information or systems, or violates security policy.Foundational
• Tabletop Exercise (TTX)A discussion-based exercise in which participants walk through a simulated incident scenario to test plans and roles.Foundational
• TriageRapidly assessing alerts or incidents to determine validity, severity and priority for response.Foundational