GIAC Certified Intrusion Analyst Certification (GCIA)

The GIAC Certified Intrusion Analyst (GCIA) certification is designed for practitioners responsible for intrusion detection. It validates skills in network and host monitoring, traffic analysis, and intrusion detection.

Key Information:

• Exam Format: The certification exam is a proctored test with 106 questions to be completed in 4 hours. A minimum passing score of 67% is required.
• Areas Covered: The certification focuses on fundamentals of traffic analysis and application protocols, open-source IDS with Snort and Zeek, and network traffic forensics and monitoring.
• Target Audience: GCIA is suitable for intrusion detection practitioners, system analysts, security analysts, network engineers, network administrators, and hands-on security managers.
• Delivery: All GIAC Certification exams are web-based and require proctoring, with options for remote proctoring through ProctorU and onsite proctoring through PearsonVUE.
• Exam Activation: Certification attempts are activated in the GIAC account post-approval, and candidates have 120 days from activation to complete the exam.

CyberLive:

• GIAC offers CyberLive, a hands-on, real-world practical testing environment, allowing practitioners to validate knowledge and skills using actual programs, code, and virtual machines.

The GCIA certification serves to validate the practical expertise of individuals involved in intrusion detection, providing a recognized credential in the cybersecurity field.

Here’s a summary of the key objectives:

1. Advanced IDS Concepts:
   • Understand IDS tuning methods and correlation issues.
2. Application Protocols:
   • Demonstrate knowledge and skills in application layer protocol dissection and analysis.
3. Concepts of TCP/IP and the Link Layer:
   • Understand the TCP/IP communications model and link layer operations.
4. Fragmentation:
   • Understand how fragmentation works and identify fragmentation and fragmentation-based attacks in packet captures.
5. IDS Fundamentals and Network Architecture:
   • Demonstrate knowledge of fundamental IDS concepts, network architecture options, and benefits/weaknesses of common IDS systems.
6. Intrusion Detection System Rules:
   • Create effective IDS rules to detect various types of malicious activity.
7. IP Headers:
   • Dissect IP packet headers and analyze them for normal and anomalous values indicating security issues.
8. IPv6:
   • Demonstrate knowledge of IPv6 and its differences from IPv4.
9. Network Forensics and Traffic Analysis:
   • Analyze data from multiple sources (full packet capture, netflow, log files) to identify normal and malicious behaviors.
10. Packet Engineering:
    • Understand packet crafting and manipulation.
11. SiLK and Other Traffic Analysis Tools:
    • Understand SiLK and other tools for network traffic and flow analysis.
12. TCP:
    • Understand the TCP protocol and discern between typical and anomalous behavior.
13. Tcpdump Filters:
    • Craft tcpdump filters matching given criteria.
14. UDP and ICMP:
    • Understand UDP and ICMP protocols and discern between typical and anomalous behavior.
15. Wireshark Fundamentals:
    • Use Wireshark to analyze typical and malicious network traffic.

These objectives collectively cover a comprehensive set of skills and knowledge required for effective intrusion detection and network analysis, validating the proficiency of individuals in these critical areas.