Errata: EC-Council Certified Incident Handler (ECIH) Course Contains Plagiarism

EC-Council Certified Incident Handler (ECIH) Course Contains Plagiarism

Fri Dec 2 18:49:34 CST 2011

EC-Council provides a wide range of certification training, including a course to become a "Certified Incident Handler". The 11 module course is taught over 2 days by one of several instructors. The material used to teach the class, and presumably handed out to the class, is branded "EC-Council". Every slide contains a footer saying "Copyright (C) by EC-Council" and "All Rights Reserved. Reproduction is Strictly Prohibited".

The Plagiarism

While some material in the slide is taken from external sources and properly credited, a significant amount of material is not cited at all. In some cases, an image may be used from a source with credit, but the ten subsequent slides from the same source are not credited. Given that text is often used in full, and in other cases slightly altered, both without citation, that consitutes plagiarism. The following tables detail portions of the presentation material that were taken from other sources, making up 32.2% of the material. Information is included to distinguish not only plagiarized material, but if the text was altered in some fashion. Due to time constraints, only four of the 11 modules were spot checked. Significant plagiarism was detected in two of the modules, and a few instances in the other two. As a result, only two modules are included below.

Module 2: Risk Assessment

Slide #	Original Source
Slide 10	Text paraphrased from NIST SP 800-30, page 10
Slide 11	"System Characterization Template" taken from State of California Office of HIPAA Implementation, CalOHI Policy Memorandum 2005-56, Exhibit 4
Slide 12	Text paraphrased from NIST SP 800-30, page 12. Flow chart segment from page 9.
Slide 15	Text paraphrased from NIST SP 800-30, page 15. Flow chart segment from page 9.
Slide 16	"Vulnerability Report Template" widely available on Internet, as early as 2007.
Slide 17	Text paraphrased from NIST SP 800-30, page 19. Flow chart segment from page 9.
Slide 18	Text and table from NIST SP 800-30, page 21. Flow chart segment from page 9.
Slide 19	Text paraphrased from NIST SP 800-30, page 21. Flow chart segment from page 9.
Slide 20	Text paraphrased from NIST SP 800-30, page 24. Flow chart segment from page 9.
Slide 21	Text paraphrased from NIST SP 800-30, page 26. Flow chart segment from page 9.
Slide 23	Report taken from Information Technology Risk Management Guideline, Virginia Information Technologies Agency (VITA), Appendix E - Risk Assessment Template
Slide 36/37	Text paraphrased from NIST SP 800-30, page 27.
Slide 38	Flow chart from NIST SP 800-30, page 28, with credit to source
Slide 40	Text paraphrased from NIST SP 800-30, page 29/30, NIST mentioned in slide title only
Slide 41	Text paraphrased from NIST SP 800-30, page 40.
Slide 42	Chart from NIST SP 800-30, with credit to source
Slide 44	Text from cramm.com. Site mentioned in slide title only
Slide 45	Text from cramm.com/overview/howitworks.htm
Slide 46	Image from dsec.ru/about/articles/ar_compare/
Slide 47	Text from rm-inv.enisa.europa.eu/methods_tools/t_stream.html
Slide 49	Image from acuityrm.com according to tineye.com
Slide 50	Text from callio.com/secura.php, callio.com mentioned in title slide
Slide 51/52	Images from callio.com/PPT/secura_EN.ppt

Module 3: Incident Response and Handling Steps

Slide #	Original Source
Slide 5	Logo from csirt.org
Slide 6	Text from csirt.org/index.html and csirt.org/services/index.html
Slide 8	Some text from csirt.org/services/index.html
Slide 13	Text paraphrased from cert.org
Slide 14	Table from cert.org, with credit
Slide 15	Text from headers 2.1.2.2 -> 2.1.2.5 of Handbook for Computer Security Incident Response Teams (CSIRTs)
Slide 16	Some text paraphrased, some text directly from Handbook for Computer Security Incident Response Teams (CSIRTs)
Slide 17/18	Graphics from cert.org, with credit
Slide 21	Text from cert.org/csirts/Creating-A-CSIRT.html#practices
Slide 22	Text from cert.org/csirts/Creating-A-CSIRT.html#1
Slide 23	Text from cert.org/csirts/Creating-A-CSIRT.html#2
Slide 24	Text from cert.org/csirts/Creating-A-CSIRT.html#3
Slide 25	Text from cert.org/csirts/Creating-A-CSIRT.html#4
Slide 26	Text from cert.org/csirts/Creating-A-CSIRT.html#5
Slide 27	Text from cert.org/csirts/Creating-A-CSIRT.html#6
Slide 28	Text from cert.org/csirts/Creating-A-CSIRT.html#7
Slide 29	Text from cert.org/csirts/Creating-A-CSIRT.html#8
Slide 30	Some text from ecsirt.net/cec/background/index.html
Slide 31	Text from Practical Intrusion Analysis: Prevention and Detection for the Twenty-First Century by Ryan Trost
Slide 32	Some text from Practical Intrusion Analysis: Prevention and Detection for the Twenty-First Century by Ryan Trost, rest of text from Incident Response Team Roles
Slide 33	Text from Incident Response Team Roles
Slide 35	Text from cert.org/csirts/csirt_faq.html#13

Module 3 was only reviewed up to slide 35.

Modules 10 and 11 both contain a couple slides each with plagiarized content. A more thorough review was not performed, so details are being ommitted from this page.