GIAC Certified Enterprise Defender (GCED)

The GIAC Certified Enterprise Defender (GCED) certification is designed for individuals seeking advanced technical skills in cybersecurity to defend enterprise environments. It builds upon the foundation established by the GIAC Security Essentials certification. The certification covers topics such as defensive network infrastructure, packet analysis, penetration testing, incident handling, and malware removal.

Key Information:

Exam Format: The certification exam is a proctored test with 115 questions to be completed in 3 hours. A minimum passing score of 69% is required.

Target Audience: The GCED certification is suitable for incident responders, penetration testers, security operations center engineers and analysts, network security professionals, and anyone seeking in-depth technical knowledge of comprehensive security solutions.

Delivery: Exams are web-based and proctored, with options for remote proctoring through ProctorU or onsite proctoring through PearsonVUE. Certification attempts are activated in the GIAC account after approval, and candidates have 120 days to complete the exam.

Exam Certification Objectives: The certification covers various objectives, including defending network protocols, understanding defensive infrastructure and tactics, digital forensics concepts, incident response concepts, malware analysis, intrusion detection, and packet analysis.

Other Resources: Training is available through various modalities, including live training and OnDemand. Practical work experience, college-level courses, or self-paced study can contribute to mastering the necessary skills for certification.

The Exam Certification Objectives for the GIAC Certified Enterprise Defender (GCED) certification cover a range of cybersecurity topics.

1. Defending Network Protocols:
   • Understand commonly used network protocols.
   • Demonstrate defense against protocol attacks.
   • Exhibit knowledge of audit techniques and adhere to the Center for Internet Security’s benchmarks and Critical Security Controls.
2. Defensive Infrastructure and Tactics:
   • Demonstrate basic knowledge of defensive measures for network and cloud-based infrastructure.
   • Understand common detective and preventive controls.
3. Digital Forensics Concepts and Application:
   • Understand methods and practices of digital forensics.
   • Demonstrate proficiency in identifying forensic artifacts.
4. Incident Response Concepts and Application:
   • Understand continuous incident response processes.
   • Recognize the relationship between incident response, threat intelligence practices, and the Cyber Kill Chain.
5. Interactive and Manual Malware Analyses:
   • Understand interactive malware behavior analysis.
   • Demonstrate knowledge of analysis tools and interpret analysis results.
   • Understand manual malware code reversal, disassembly, decompiling, and code obfuscation techniques.
6. Intrusion Detection and Packet Analysis:
   • Understand intrusion prevention systems.
   • Know the placement, configuration, and tuning of these systems.
   • Demonstrate proficiency in taking action in response to alerts.
7. Malware Analysis Concepts and Basic Analysis Techniques:
   • Understand various types of malware.
   • Identify symptoms of infection and methods to analyze malware safely.
   • Understand the benefits and disadvantages of automated and static malware analysis techniques and interpret their results.
8. Network Forensics, Logging, and Event Management:
   • Understand the use of logs and flows in network forensics.
   • Recognize the importance of logging and event management in security operations.
   • Understand the usage of SIEM (Security Information and Event Management) and Security Analytics.
9. Network Security Monitoring Concepts and Application:
   • Demonstrate knowledge of devices used in Security Operations Centers (SOCs) to monitor networks.
   • Understand packet types, packet capture tools, continuous network monitoring, and advanced issues like monitoring encrypted traffic.
10. Penetration Testing Application:
    • Demonstrate familiarity and proficiency in using penetration testing tactics and tools against typical types of penetration test targets.
11. Penetration Testing Concepts:
    • Understand penetration testing scoping.
    • Adhere to rules of engagement in penetration tests.
    • Demonstrate knowledge of tools and tactics used in penetration tests and reporting the test results to the intended audience.