Re: Incident investigation methodologies

[Gadi Evron <ge () linuxbox org>]

> While it's entirely possible that a rootkit *could* do
> something, why not base what we do in fact, rather
> than in speculation, rumor, and paranoia?

What you are suggesting, basically, is an information sharing network 
for different attack descriptions and information?

A forensic dictionary? :)

        Gadi.

--
Email: ge () linuxbox org.  Work: gadie () cbs gov il. Backup: ge () warp mx dk.
Phone: +972-50-428610 (Cell).

PGP key for attachments: http://vapid.reprehensible.net/~ge/Gadi_Evron.asc
ID: 0xD9216A06 FP: 5BB0 D3E2 D3C1 19B7 2104  C0D0 A7B3 1CF7 D921 6A06
GPG key for encrypted email: 
http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc
ID: 0x06C7D450 FP: 3B88 845A DF1F 4062 E5BA  569A A87E 8DB7 06C7 D450