GCIA

The GIAC Certified Intrusion Analyst (GCIA) exam focuses on the practical skills and knowledge needed to perform incident handling, intrusion detection, and security analysis. The main points covered are broad and intertwined, but can be categorized as follows:

I. Network Security Fundamentals:

• TCP/IP Model and Networking Protocols: Understanding how networks function at various layers is crucial. This includes understanding routing, subnetting, and common network protocols (TCP, UDP, ICMP, etc.).
• Network Topologies and Devices: Knowledge of different network layouts and the function of routers, switches, firewalls, and other devices is essential.
• Network Security Concepts: Firewall types, VPNs, and other security mechanisms are covered.

II. Intrusion Detection and Prevention:

• Intrusion Detection Systems (IDS): This is a core component. Expect questions on different IDS types (network-based, host-based), signature-based vs. anomaly-based detection, and how to analyze IDS alerts.
• Intrusion Prevention Systems (IPS): Understanding how IPS works and how it differs from IDS is vital.
• Security Information and Event Management (SIEM): Knowledge of SIEM systems, log analysis, and correlation is key.

III. Security Analysis and Incident Response:

• Log Analysis: A significant portion focuses on analyzing various types of logs (system, application, network) to identify security events. This includes understanding different log formats and using tools to parse and analyze them.
• Malware Analysis: Understanding malware behavior, types of malware, and techniques used for analysis (static and dynamic) are important.
• Incident Response Methodology: Familiarity with the incident response lifecycle (preparation, identification, containment, eradication, recovery, lessons learned) is essential.
• Vulnerability Assessment and Penetration Testing: Understanding how to identify vulnerabilities and the methods used in penetration testing is important, though not the primary focus.

IV. Forensics and System Security:

• Operating System Security: Understanding common operating systems (Windows, Linux) from a security perspective, including user permissions, file system structures, and security hardening techniques.
• Data Acquisition and Preservation: Basic knowledge of digital forensics principles, especially related to preserving evidence integrity.
• Data Recovery: Some understanding of data recovery techniques might be relevant.

V. Tools and Technologies:

The exam doesn't specifically test on particular vendor tools but expects familiarity with the types of tools used in the field. Expect questions about:

• Packet Analyzers (e.g., Wireshark): Analyzing network traffic captures is a critical skill.
• Security Monitoring Tools: Understanding how various monitoring tools work and their capabilities.

In summary: The GCIA exam is heavily practical. While theoretical knowledge is necessary, the emphasis is on being able to apply that knowledge to real-world scenarios involving log analysis, incident response, and security investigation. Hands-on experience with network security tools and technologies is highly recommended before attempting the exam.