Certification CEH or GCIH?

[unsupported]

While waiting for my CISSP results I am looking for my next certification. The next major cert I want is something related to incident handling. Right now I do log monitoring and vulnerability scanning. Through the next cert, I want to better understand how threat agents exploit vulnerabilities in order to better detect, track, report, and prevent them. I've looked at the GCIH and there is a lack of self-study material. The GCIH certification appears to be selling the training more than anything else. I have only found one book and a Exam Cram supplement. On the flip side there is CEH with more training options, more books, and a lot of support for self-study.

In regards to the basic attacks and defences I feel that GCIH and CEH are very similar, if not the same. Does CEH offer any depth on how to handle incidents? Would anyone mind sharing their thoughts and experience on these certifications?

Thanks!
-un

[cdupuis]

Comparing the CEH and the GCIH is like saying cat and dogs are the same.

They are two very different certifications, the GCIH starts with one full day on incident handling. Then you get into different type of attacks one by one for almost two days. Then you get into specifics of windows, linux, web apps vulnerabilities, and others. The last day has a capture the flag exercise.

The GCIH shows you the defensive side first and a bit of offensive side.

The CEH is pure offensive and do not cover the defensive side. It does not talk about changes you can make to your system, hardening, etc....

If you wish to work in Incident Response I would recommend you take the GCIH.

Best regards

Clement

[unsupported]

Clement,

Thank you very much for the clear difference between the two certifications. That is the detail that I was looking for.

Now, in addition to the GCIH, I also found CERT's CSIH... but I am leaning more towards GCIH 'cause SANS is bringing it to Orlando in March. My manager would be more willing to pay for the cert if there is no travel expenses.

Thanks again!

[unsupported]

Unfortunately, my hopes for GCIH were dashed when our training budget did not get approved for the year. I am falling back and looking at the CEH because I want to get some penetration/defense under my belt.

-Un
CISSP, Sec+, Net+, MCP