ECIH study plan
ECIH · Give each week a clear focus.
8 weeks · About 7 hours per week
Introduction to Incident Handling and Response & Incident Handling and Response Process
Map the phases of the incident handling and response lifecycle to one named framework and write the entry and exit criteria for each phase
Distinguish incident, event, and vulnerability, then classify 10 sample scenarios by incident category and severity
Outline an incident response policy naming roles (incident responder, SOC lead, HR, legal, communications) and each role's decision rights
Build a four-tier severity matrix with explicit escalation triggers
Your checkpoint
A one-page IR policy outline plus a four-tier severity matrix applied to 10 sample scenarios, self-scored against a checklist you write
First Response & Incident Handling and Response Process
Order volatile evidence sources from most to least volatile and write a justification for the sequence
Perform a mock first-response sequence on a compromised workstation in the correct order: state capture, memory, network connections, disk
Complete a chain-of-custody form for three evidence items including hash values and hand-off entries
Write eight interview questions to ask a user reporting a suspected incident without leading the witness
Draw an escalation and notification timeline that meets a one-hour containment target
Your checkpoint
A first-responder checklist plus a completed evidence log and chain-of-custody form for the mock scenario
Handling and Responding to Malware Incidents & Handling and Responding to Endpoint Security Incidents
Trace a malware incident end to end from detection through eradication and recovery, documenting decisions at each phase
Classify eight malware families by propagation and persistence mechanism, then select a containment action for each
Compare host isolation, network segmentation, and full reimage as containment options and state when each is appropriate
List the endpoint artifacts that confirm execution (process tree, autoruns, services, scheduled tasks, prefetch) and what each proves
Your checkpoint
A malware and endpoint IR playbook containing a containment decision table and an artifact-collection checklist
Handling and Responding to Email Security Incidents
Reconstruct an email header chain by reading Received lines and SPF, DKIM, and DMARC results from a header you write out yourself
Design a triage flow that separates phishing, business email compromise, and malicious attachment incidents
Draft user notification and mailbox remediation steps for a confirmed business email compromise
Define three response metrics for email incidents and state how each is measured
Your checkpoint
An email incident playbook with a header-analysis worksheet and a BEC remediation runbook
Handling and Responding to Network Security Incidents
Break a network intrusion into stages and name the log source that evidences each stage (NetFlow, IDS, DNS, proxy, firewall)
Write the containment options for lateral movement and C2 beaconing, including blocking scope and business impact of each
Map six network indicators of compromise to a concrete detection method and data source
Scope an incident by ordering a supplied list of connections into a chronological timeline
Your checkpoint
A network incident playbook with an indicator-to-detection mapping table and a containment decision guide
Handling and Responding to Web Application Security Incidents
Classify common web application attacks and describe how each appears in access logs, WAF logs, and application logs
Write a web triage checklist covering log review, isolation of the affected host, and virtual patching
Design an eradication plan for a webshell that also handles stolen session tokens and credentials
Identify the evidence that distinguishes defacement from data exfiltration in a web compromise
Your checkpoint
A web application IR playbook with a log-analysis checklist and a webshell eradication procedure
Handling and Responding to Cloud Security Incidents & Handling and Responding to Insider Threats
Map the shared responsibility model to the evidence you can and cannot collect in IaaS, SaaS, and on-premises environments
Draft cloud containment steps for a compromised identity: revoke sessions, rotate keys, and review audit logs
Identify behavioral and technical indicators of insider data exfiltration and specify the HR and legal hand-off points
Write five insider-threat investigation steps that preserve employee privacy and evidence admissibility
Your checkpoint
Two short playbooks: cloud identity compromise containment, and an insider-threat investigation checklist with legal hand-off points
Introduction to Incident Handling and Response & Incident Handling and Response Process & First Response & Handling and Responding to Malware Incidents & Handling and Responding to Email Security Incidents & Handling and Responding to Network Security Incidents & Handling and Responding to Web Application Security Incidents & Handling and Responding to Cloud Security Incidents & Handling and Responding to Insider Threats & Handling and Responding to Endpoint Security Incidents
Take a timed 50-question self-quiz and log every miss by domain and root cause
Consolidate your playbooks into a single quick-reference index usable during a live incident
Re-teach your two weakest domains from memory in ten-minute recorded summaries
Rewrite any playbook step you could not explain without notes
Your checkpoint
A consolidated quick-reference index plus a scored practice exam log showing your two weakest domains with a remediation note for each
Milestones
Week 2: Deliver a two-minute spoken walkthrough of the full incident lifecycle and the volatility order of evidence without referring to notes.
Week 4: Walk through a malware scenario and a phishing scenario end to end, naming the phase, the action, and the evidence at each step, with no reference material.
Week 6: Given two unfamiliar scenario prompts, correctly identify the incident type and select the appropriate containment action within 10 minutes each.
Week 8: Score 80 percent or higher on the timed mock exam and produce a one-line incident-type-to-containment mapping covering all 10 domains from memory.