Re: Incident investigation methodologies

[Harlan Carvey <keydet89 () yahoo com>]

Gadi,

> > While it's entirely possible that a rootkit
> *could* do
> > something, why not base what we do in fact, rather
> > than in speculation, rumor, and paranoia?
>
> What you are suggesting, basically, is an
> information sharing network 
> for different attack descriptions and information?
>
> A forensic dictionary? :)

Admittedly, I may not have been as absolutely clear as
I could have, but I really don't see where you were
able to infer such a thing - particularly given the
title of the post.

To try again...what I'm suggesting is a documented,
verifiable, repeatable methodology for incident
response.  I'm aware that the implemented methodology
will have to specific to the platform (ie, Windows,
Linux, *nix, *BSD, etc).  I'm also aware that the
framework will have to be flexible enough to allow new
information to be incorporated.

Hopefully, that's clear enough for a start...