{"id":77337,"date":"2022-04-22T10:54:46","date_gmt":"2022-04-22T10:54:46","guid":{"rendered":"https:\/\/www.eccouncil.org\/cybersecurity-exchange\/?p=77337"},"modified":"2026-03-24T06:34:12","modified_gmt":"2026-03-24T06:34:12","slug":"incident-handler-why-getting-certified-matters","status":"publish","type":"post","link":"https:\/\/www.eccouncil.org\/cybersecurity-exchange\/incident-handling\/incident-handler-why-getting-certified-matters\/","title":{"rendered":"Becoming an Incident Handler: Why Getting Certified Matters"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

When something goes wrong with a company’s IT infrastructure, having the right plan in place for how to handle it is crucial. This is where incident management comes in.<\/p>

Incident management is the process of identifying, responding to, and resolving security events that affect a company’s IT systems. To ensure that an organization has the best possible chance of recovering from a security incident quickly and efficiently, it’s important to have certified incident handlers on staff.<\/p>

In this article, we’ll explain the incident management and response process and discuss why certifications like EC-Council’s\u00a0Certified Incident Handler (ECIH)<\/a>\u00a0matter in the field of incident response. We’ll also look at the five stages of incident management and how to gain the skills needed to successfully navigate them.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

What Is Incident Management?<\/h2> \n\n

Incident management is a step-by-step process that enables an organization to detect, react to, and recover from incidents that occur within its IT infrastructure. The goal of incident management is to minimize a security incident\u2019s impact on business operations. An incident response plan is a key component of incident management. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The Five Stages of the Incident Management Process<\/h2> \n\n

There are five stages in the incident management process:<\/p> \n

    \n
  1. Identification<\/li> \n
  2. Containment<\/li> \n
  3. Eradication<\/li> \n
  4. Recovery <\/li>\n
  5. Prevention<\/li> \n<\/ol>\n

    At each stage, specific goals and tasks need to be completed to resolve the incident. To successfully navigate these stages, it’s key to have certified incident handlers on staff (Ellis, n.d.).<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    1. Identification<\/h3> \n\n

    The identification stage is when the incident is first identified. It’s helpful to have a process in place for identifying incidents quickly and efficiently to ensure incidents are resolved as fast as possible. <\/p>\n\n

    2. Containment <\/h3>\n\n

    In the containment stage, the security team takes steps to stop the incident from spreading and causing further damage. It’s vital to contain the incident so that it doesn’t cause more harm than necessary. <\/p>\n\n

    3. Eradication <\/h3>\n\n

    In the eradication stage, incident handlers take steps to eliminate the cause of the breach. This stage is often referred to as the “fix” phase. The main goal is to eradicate the reason that the incident occurred so that similar events don’t happen again. <\/p>\n\n

    4. Recovery <\/h3>\n\n

    The recovery stage involves restoring the organization’s systems to their pre-incident state. This stage can be time consuming and costly, so having a plan in place for recovering quickly is ideal. <\/p>\n\n

    5. Prevention <\/h3>\n\n

    In the prevention stage, organization members take steps to prevent future incidents from happening. This stage is often referred to as the “mitigation” phase. It’s important to take steps to prevent future incidents from happening in order to minimize damage and strengthen the organization’s security posture. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    The Role of Certified Incident Handlers<\/h2>

    To successfully navigate these\u00a0stages of the incident management<\/a>\u00a0process, it’s a good idea to have certified incident handlers on staff.\u00a0Certification programs can provide incident handlers with the knowledge they need to understand the incident management process<\/a>\u00a0and what a well-handled incident response looks like. These programs also provide incident handlers with the skills necessary to handle critical security situations effectively\u00a0and efficiently (Atlassian, n.d.).<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    What Is an Incident Response Plan, and What Does It Look Like?<\/h2>

    An incident response<\/a>\u00a0plan is a document that outlines how a company will respond to incidents that occur within its IT infrastructure. Having a well-defined incident response plan is valuable because it ensures that an organization’s security team can quickly and efficiently resolve security incidents (Tunggal, 2021).<\/p>

    To create an incident response plan, security teams need to answer the following questions:<\/p>