<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Network Forensics Blog &#187; Network Visbility</title>
	<atom:link href="http://www.networkforensics.com/category/network-visbility/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.networkforensics.com</link>
	<description></description>
	<lastBuildDate>Mon, 19 Jul 2010 13:35:18 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.1</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Network detection of x86 buffer overflow shellcode</title>
		<link>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/</link>
		<comments>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/#comments</comments>
		<pubDate>Sun, 16 May 2010 17:32:54 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Breach]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[flex parser]]></category>
		<category><![CDATA[malware]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=297</guid>
		<description><![CDATA[Overview
This technique can detect overflow exploits against software running on the x86 platform, meaning it applies to Windows, Unix, and Mac shellcode. It not only works independently of OS, but it also works for finding both stack and heap based overflows. Most interestingly, it catches most forms of polymorphic shellcode as well. (Actually, it exceeds [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Move over China, here comes Russia</title>
		<link>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/</link>
		<comments>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/#comments</comments>
		<pubDate>Thu, 18 Feb 2010 03:10:53 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Data Leakage]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[apt]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[Cyberwar]]></category>
		<category><![CDATA[e-crime]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=187</guid>
		<description><![CDATA[While the world took pause to consider the implications of Operation Aurora, and Google lent considerable voice to the concept of Advanced and Persistent Threats (APT), we can ill-afford to believe even for a moment that they are alone in their sophistication or capability.   According to the FBI more than 100 nations have offensive [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>IDS Legacy is Institutionalized Failure</title>
		<link>http://www.networkforensics.com/2010/01/26/ids-legacy-is-institutionalized-failure/</link>
		<comments>http://www.networkforensics.com/2010/01/26/ids-legacy-is-institutionalized-failure/#comments</comments>
		<pubDate>Tue, 26 Jan 2010 19:40:00 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[fud]]></category>
		<category><![CDATA[ids]]></category>
		<category><![CDATA[malware]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=77</guid>
		<description><![CDATA[The news is rife with discussions about systemic failures in the intelligence community.  It is a good thing we do not judge information security on the same scale of success.  I know of not a SINGLE enterprise network that is not being repeatedly compromised with a deluge of malicious code.  Can you imagine a world [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/01/26/ids-legacy-is-institutionalized-failure/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Finding Aurora (googlehack)</title>
		<link>http://www.networkforensics.com/2010/01/15/finding-aurora-googlehack/</link>
		<comments>http://www.networkforensics.com/2010/01/15/finding-aurora-googlehack/#comments</comments>
		<pubDate>Fri, 15 Jan 2010 15:56:42 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[apt]]></category>
		<category><![CDATA[adobe]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Situational Awareness]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=95</guid>
		<description><![CDATA[I was helping a fortune customer yesterday determine if they were targeted by Operation Aurora.  From everything we know to date, they were not.  How do we know this?  We looked.  In 15 minutes or so, we looked back over the last 6 months of every bit and byte that has [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/01/15/finding-aurora-googlehack/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>A Bucket of Sand?</title>
		<link>http://www.networkforensics.com/2010/01/11/a-bucket-of-sand/</link>
		<comments>http://www.networkforensics.com/2010/01/11/a-bucket-of-sand/#comments</comments>
		<pubDate>Mon, 11 Jan 2010 18:08:44 +0000</pubDate>
		<dc:creator>admin</dc:creator>
				<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=72</guid>
		<description><![CDATA[Did NetWitness actually release a new product that consists of a bucket filled with sand? The answer is yes, but the real question is why? We released B.O.S. in an attempt to sound the wake-up call…
Organizations can no longer afford to rely so heavily on perimeter based technologies, on signatures for identification of threats – [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/01/11/a-bucket-of-sand/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>The Power of Realtime Network Forensics &#8211; Advanced Malware Detection</title>
		<link>http://www.networkforensics.com/2009/11/27/the-power-of-realtime-deep-packet-inspection/</link>
		<comments>http://www.networkforensics.com/2009/11/27/the-power-of-realtime-deep-packet-inspection/#comments</comments>
		<pubDate>Fri, 27 Nov 2009 13:28:59 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=53</guid>
		<description><![CDATA[Hey gang&#8230;Alex here&#8230;writing from the NetWitness Labs&#8230;
At NetWitness, our focus is on providing analytics, and we are constantly looking at new ways to apply our unique analytics to the realm of content development.  We know that we have really cool technology and want to showcase that as well as push the envelope of what is [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2009/11/27/the-power-of-realtime-deep-packet-inspection/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Competitor Hype and Bull &#8211; It&#039;s the Analytics Stupid!</title>
		<link>http://www.networkforensics.com/2009/10/28/competitor-hype-and-bull/</link>
		<comments>http://www.networkforensics.com/2009/10/28/competitor-hype-and-bull/#comments</comments>
		<pubDate>Wed, 28 Oct 2009 19:28:15 +0000</pubDate>
		<dc:creator>Eddie Schwartz</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[Data Leakage]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[eddie schwartz]]></category>
		<category><![CDATA[Situational Awareness]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=45</guid>
		<description><![CDATA[I was at the CSI show yesterday and was within earshot of one of our “competitors” who claimed that they were winning against NetWitness because they support 10Gbps and we do not.   I have heard this story frequently from this particular firm, and it’s a bunch of bull.
It amazes me that companies in this space, [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2009/10/28/competitor-hype-and-bull/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Hackers Swipe Information on Job Seekers From Monster.Com</title>
		<link>http://www.networkforensics.com/2009/01/26/hackers-swipe-information-on-job-seekers-from-monstercom/</link>
		<comments>http://www.networkforensics.com/2009/01/26/hackers-swipe-information-on-job-seekers-from-monstercom/#comments</comments>
		<pubDate>Mon, 26 Jan 2009 20:57:49 +0000</pubDate>
		<dc:creator>admin</dc:creator>
				<category><![CDATA[Breach]]></category>
		<category><![CDATA[Data Leakage]]></category>
		<category><![CDATA[Network Visbility]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=7</guid>
		<description><![CDATA[For the second time in 18 months, Monster.Com has suffered a massive security breach.  In both cases, user account information was stolen, along with the email addresses and names of job seekers.  When this happened in August of 2007, 1.3 Million accounts were taken when an employee of the company divulged his credentials via a [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2009/01/26/hackers-swipe-information-on-job-seekers-from-monstercom/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Investigator 8.6 Release to the World</title>
		<link>http://www.networkforensics.com/2008/11/19/investigator-86-release-to-the-world/</link>
		<comments>http://www.networkforensics.com/2008/11/19/investigator-86-release-to-the-world/#comments</comments>
		<pubDate>Thu, 20 Nov 2008 02:45:08 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Investigator]]></category>
		<category><![CDATA[Q&A]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=4</guid>
		<description><![CDATA[On monday of this week, we released Investigator 8.6, and we released it free.  I thought I would take to this poor, neglected blog and write some thoughts about it.  So far the reaction has been very positive.  It seems people like what they see, and we are very happy with the many blog posts, [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2008/11/19/investigator-86-release-to-the-world/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>PCI Alone Will Not Stop the Data Losses</title>
		<link>http://www.networkforensics.com/2008/04/23/pci-alone-will-not-stop-the-data-losses/</link>
		<comments>http://www.networkforensics.com/2008/04/23/pci-alone-will-not-stop-the-data-losses/#comments</comments>
		<pubDate>Thu, 24 Apr 2008 04:04:30 +0000</pubDate>
		<dc:creator>Eddie Schwartz</dc:creator>
				<category><![CDATA[Data Leakage]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[PCI]]></category>
		<category><![CDATA[Regulatory]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=3</guid>
		<description><![CDATA[The recent public disclosures at Hannaford Bros of millions of credit card numbers lost to professional carder gangs again raises questions regarding the state of preparedness of retail security and other industries to protect customer data in the current cyber threat environment.  In the case of Hannaford, these gangs may have followed a pattern familiar [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2008/04/23/pci-alone-will-not-stop-the-data-losses/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
