GIAC Certified Intrusion Analyst (GCIA) Training

The GIAC Certified Intrusion Analyst (GCIA) is an intermediate skill level certification that was created to provide assurance that a certified individual has the knowledge, skills, and abilities to configure and monitor intrusion detection systems, and to read, interpret, and analyze network traffic and related log files. GCIAs are individuals who are responsible for network and host monitoring, traffic analysis, and intrusion detection.

EXAM INFORMATION

• 1 proctored exam
• 106 questions
• 4 hours
• A minimum passing score of 67%

• GIAC Certified Incident Handler (GCIH) Training
• GIAC Security Essentials Certification (GSEC) Training
• GIAC Security Leadership Certificate (GSLC) Training
• Computer Forensics Training
• Certified Powershell Hacker (CPSH) Training
• Cybersecurity Foundations Training
• Cyber Threats Detection and Mitigation Training
• Cyber Threats Hunting (CCTHP) Training
• Cyber Threat Intelligence Analysis Training
• Cybersecurity Investigations and Network Forensics Analysis

Advanced IDS Concepts

• Demonstrate an understanding of IDS tuning methods and correlation issues (e.g., snort, bro)

Application Protocols

• The candidate will demonstrate knowledge, skill, and ability relating to application layer protocol dissection and analysis including HTTP, SMTP, and various Microsoft protocols

Concepts of TCP/IP and the Link Layer

• The candidate will understand the TCP/IP communications model and link layer operations

GIAC Certified Intrusion Analyst (GCIA) Training – DNS

• The candidate will demonstrate a thorough understanding of how DNS works for both legitimate and malicious purposes

Fragmentation

• The candidate will demonstrate comprehension of how fragmentation works through theory and packet capture examples, as well as the concepts behind fragmentation-based attacks

IDS Fundamentals and Initial Deployment (e.g., snort, bro)

• Understand the architecture, benefits/weaknesses, and configuration options of common IDS systems. Demonstrate ability to configure and deploy IDS (e.g., snort, bro)

IDS Rules (e.g., snort, bro)

• Create effective IDS (e.g., snort, bro) rules to detect varied types of malicious activity

IP Headers

• The candidate will demonstrate the ability to dissect IP packet headers and analyze them for normal and anomalous values that may point to security issues

IPv6

• The candidate will demonstrate knowledge, skill, and ability relating to the analysis of IPv6 as well as issues involving IP6 over IPv4

Network Architecture and Event Correlation

• The candidate will demonstrate competence with issues relating to IDS/IPS management, network architecture as it pertains to intrusion detection, and event correlation and management. GIAC Certified Intrusion Analyst (GCIA) Training

Network Traffic Analysis and Forensics 

• The candidate will demonstrate the ability to analyze real traffic and associated artifacts: malicious, normal, and application traffic; and demonstrate the ability to discern malicious traffic from false positives

Packet Engineering

• The candidate will demonstrate knowledge, skill, and ability relating to packet engineering and manipulation including packet crafting, OS fingerprinting, and IDS Evasion/Insertion

Silk and Other Traffic Analysis Tools

• The candidate will demonstrate the ability to use Silk and other tools to perform network traffic and flow analysis

TCP

• The candidate will understand TCP communications as well as expected responses to given stimuli at this layer

Tcpdump Filters

• The candidate will demonstrate the skill and ability to craft tcpdump filters that match on given criteria

UDP and ICMP

• The candidate will demonstrate the ability to analyze both UDP and ICMP packets and recognize common issues

Wireshark Fundamentals

• The candidate will demonstrate the knowledge, skills, and abilities associated with traffic analysis using wireshark from an intermediate to a high degree of proficiency

GIAC Certified Intrusion Analyst (GCIA) Training Course Recap, Q/A, and Evaluations