GIAC Certified Enterprise Defender (GCED)

Exam Certification Objectives & Outcome Statements

• Attack Surface ManagementCandidates will demonstrate the ability to identify, assess, and prioritize attack surface exposures and vulnerabilities. Candidates will demonstrate familiarity with the MITRE ATT&CK and D3FEND frameworks, the use of open-source intelligence (OSINT) techniques to understand attacker reconnaissance and attack phases and be able to describe the phases of enterprise vulnerability management.
• Configuration Management and Automation WorkflowsCandidates will demonstrate the ability to maintain secure configurations and automate continuous hardening using modern defensive practices including mitigating configuration drift and leveraging automation and AI-assisted tools to manage configuration.
• Engineered Telemetry through Defensive ControlsCandidates will demonstrate the ability to implement and evaluate defensive controls that improve detection and reduce infrastructure exposure.
• Enterprise Security OperationsCandidates will demonstrate an understanding of how security operations center (SOC) processes and personnel support detection and event monitoring workflows. Candidates will demonstrate the ability to develop and optimize detection capabilities using security telemetry and analytics including the review and interpretation of common source and network log formats.
• Evidence Collection and VisibilityCandidates will demonstrate the ability to assess the accuracy and integrity of security records, baselines, and logs. Candidates will demonstrate the ability to evaluate how baselines and standards inform alert prioritization and recognize the importance of time and logging integrity for reliable analysis.
• Identity and Infrastructure HardeningCandidates will demonstrate the ability to implement identity and network controls that reduce attack paths and limit attacker movement. Candidates will identify and differentiate common attack vectors and techniques including reconnaissance, password-based attacks and command-and-control activity.
• Identity and Infrastructure RecordsCandidates will demonstrate the ability to analyze identity and network infrastructure records, including enterprise technologies such as Active Directory, RADIUS, and TACACS+ to determine system and user activity. Candidates will be able to recognize how logs can be enriched as they move from source to presentation as well as identify indicators of spoofing, poisoning and other malicious manipulation of infrastructure records.
• Incident Containment and RecoveryCandidates will demonstrate an understanding of the post-incident response processes and will demonstrate an ability to recognize common obstacles that can complicate containment, eradication, and recovery efforts
• Incident Investigation and AnalysisCandidates will demonstrate the ability to collect and analyze evidence to determine the scope of an incident, apply established incident detection and response methodologies to analyze host-based artifacts, and integrate threat intelligence to guide investigative and response activities
• Malware Analysis and Defensive ControlsCandidates will demonstrate the ability to determine when static and dynamic malware analysis is appropriate, characterize malicious behavior through interactive and network-based analysis, and apply analysis findings to improve threat detection and defensive controls across the enterprise.
• Malware Identification and TriageCandidates will demonstrate the ability to identify malware characteristics and assess indicators of compromise to support malware triage using tools and techniques to recognize common attack methodologies and symptoms of infection during early triage.
• Network Traffic Analysis and InvestigationCandidates will demonstrate the ability to analyze network traffic and forensic evidence to investigate security events using a variety of tools to examine packets, flows, and artifacts and will demonstrate the ability to configure, tune and interpret network intrusion detection/prevention systems, including the development and review of open source rules.