EC-Council Certified Security Analyst (Practical)

ECSA (Practical) is a 12 hours’ rigorous practical exam. ECSA (Practical) presents you with a simulated organization and its underlying networks, each containing multiple hosts.

The candidates are required to demonstrate the application of penetration testing methodology presented in the ECSA program to perform a comprehensive security audit of the organization. You will start with challenges requiring you to perform advanced network scans beyond perimeter defenses, leading to automated and manual vulnerability analysis, exploit selection, customization, launch and post exploitation maneuvers.

ECSA (Practical) also tests your skills to perform threat and exploit research, skills to understand exploits in the wild, writing your own exploits, customize payloads and your ability to make critical decisions at different phases of a pen testing engagement that can make or break the whole assessment. You will also be required to create a professional pen testing report with essential elements and guidance for the organization in the scenario to act on.

The ECSA (Practical) credential provides an assurance that the candidate possesses the skills required on the field and will stand a testimony of your ability to undergo the rigor of the profession.

About the Exam:

12 hours rigorous, online proctored practical exam

Eligibility Criteria for ECSA (Practical) Exam

  • To be eligible to apply to sit for the ECSA (Practical) Exam, candidate must either:
    Be an ECSA member in good standing (Your USD 100 application fee will be waived);
  • or Have a minimum of 2 years working experience in InfoSec domain (You will need to pay USD 100 as a non-refundable application fee);
  • or Have any other industry equivalent certifications such as OSCP or GPEN cert (You will need to pay USD 100 as a non-refundable application fee).

Course Outline

  1. Introduction to Penetration Testing and Methodologies
  2. Penetration Testing Scoping and Engagement Methodology
  3. Open Source Intelligence (OSINT) Methodology
  4. Social Engineering Penetration Testing Methodology
  5. Network Penetration Testing Methodology – External
  6. Network Penetration Testing Methodology – Internal
  7. Network Penetration Testing Methodology – Perimeter Devices
  8. Web Application Penetration Testing Methodology
  9. Database Penetration Testing Methodology
  10. Wireless Penetration Testing Methodology
  11. Cloud Penetration Testing Methodology
  12. Report Writing and Post Testing Actions
Check Schedule

What’s New in ECSA Practical

1. Maps to NICE 2.0 Framework

ECSAv10 maps to NICE framework’s Analyze (AN) and Collect and Operate (CO) specialty area

2. ALL NEW Module for Social Engineering Pen Testing

The ECSA curriculum presents a comprehensive Social Engineering Pen Testing Methodology where others program only makes a mere reference of this. According to 2017 Verizon Data Breach Investigation Report, on an overall, 43% of the documented breaches involved social engineering attacks!

We see this as a huge gap and that is where, the ECSA program is carefully designed and developed to be comprehensive in its coverage of the pentesting domain.

3. Increased Focus on Methodologies

ECSA V10 brings an enhanced concentration on methodology for network, web application, database, wireless, and cloud pen testing, whereas other certifications cover this superficially.

The new ECSA v10 program takes the tools you have learnt in the CEH and includes a wide-range of comprehensive scoping and engagement penetration testing methodologies that improves upon the best from ISO 27001, OSSTMM, and NIST Standards.

4. Blended with both manual and automated penetration testing approach

There are many numbers of automated pen testing tools out there in the marketplace including highpriced sophisticated tools, but they are not adequate. Most advanced tools are of little value if no one knows how to use them.

Manual penetration testing is the perfect complement to automated penetration Testing. Certain penetration test such as logic testing cannot be performed using automated tools. It requires human intervention to test against such vulnerabilities.

According to the MITRE Corporation, automated pen testing tools cover only 45% of the known
vulnerability types. Hence, the remaining 55% requires manual intervention.

For more details download pdf.

Download PDF