<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Network Forensics Blog</title>
	<atom:link href="http://www.networkforensics.com/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.networkforensics.com</link>
	<description></description>
	<lastBuildDate>Mon, 19 Jul 2010 13:35:18 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.1</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Visualize and Content Enhancements</title>
		<link>http://www.networkforensics.com/2010/07/19/visualize/</link>
		<comments>http://www.networkforensics.com/2010/07/19/visualize/#comments</comments>
		<pubDate>Mon, 19 Jul 2010 11:26:18 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=369</guid>
		<description><![CDATA[There are some exciting new enhancements to NetWitness coming with the release of 9.5 in early August.  One of the most compelling areas we have been working on is in content extraction.  If there is a single use-case that I see at almost all of our best client sites, it would be the extraction and [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/07/19/visualize/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Using the Ponemon Advanced Threat Study</title>
		<link>http://www.networkforensics.com/2010/07/09/ponemon-study/</link>
		<comments>http://www.networkforensics.com/2010/07/09/ponemon-study/#comments</comments>
		<pubDate>Fri, 09 Jul 2010 21:52:10 +0000</pubDate>
		<dc:creator>Eddie Schwartz</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[apt]]></category>
		<category><![CDATA[eddie schwartz]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=341</guid>
		<description><![CDATA[Knowledge of what’s really happening on your network is critical if you are responsible for the protection of your organization’s information assets.  Depending upon where you work and what you believe about both the capabilities of your security team and those of the adversary, you live somewhere on the spectrum of “really concerned about advanced [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/07/09/ponemon-study/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>They are watching you&#8230;and your security vendors.</title>
		<link>http://www.networkforensics.com/2010/05/30/they-are-watching-you-and-your-security-vendors/</link>
		<comments>http://www.networkforensics.com/2010/05/30/they-are-watching-you-and-your-security-vendors/#comments</comments>
		<pubDate>Sun, 30 May 2010 13:32:43 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Gumblar]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Martuz]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[bluehost]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[godaddy]]></category>
		<category><![CDATA[hacked]]></category>
		<category><![CDATA[hostgator]]></category>
		<category><![CDATA[network solutions]]></category>
		<category><![CDATA[trojan]]></category>
		<category><![CDATA[wordpress]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[e-crime]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=309</guid>
		<description><![CDATA[If you&#8217;ve ever seen me, or any of the NetWitness crew, speak on malware, advanced threats or the current threat environment, you&#8217;ll generally hear more than one recurring theme, one of which is:
Your anti-virus solution isn&#8217;t working like you think it is.
This is occurring for a variety of reasons and is ultimately the result of a business-based [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/05/30/they-are-watching-you-and-your-security-vendors/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Network detection of x86 buffer overflow shellcode</title>
		<link>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/</link>
		<comments>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/#comments</comments>
		<pubDate>Sun, 16 May 2010 17:32:54 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Breach]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[flex parser]]></category>
		<category><![CDATA[malware]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=297</guid>
		<description><![CDATA[Overview
This technique can detect overflow exploits against software running on the x86 platform, meaning it applies to Windows, Unix, and Mac shellcode. It not only works independently of OS, but it also works for finding both stack and heap based overflows. Most interestingly, it catches most forms of polymorphic shellcode as well. (Actually, it exceeds [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>There is an &#8220;O&#8221;  in I/O &#8230;</title>
		<link>http://www.networkforensics.com/2010/04/28/there-is-an-o-in-io/</link>
		<comments>http://www.networkforensics.com/2010/04/28/there-is-an-o-in-io/#comments</comments>
		<pubDate>Wed, 28 Apr 2010 14:05:24 +0000</pubDate>
		<dc:creator>brian</dc:creator>
				<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Performance]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[agility]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=278</guid>
		<description><![CDATA[I spent a good amount of time this week speaking to customers, partners and prospects about deploying, engineering and using our products &#8212; one topic that always seems to be part of the discussion is system throughput and scalability.  Of course our position regarding this is clear, as NetWitness technology was designed from inception to [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/04/28/there-is-an-o-in-io/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Cyberwar Or Not Cyberwar? And Why That is The Question</title>
		<link>http://www.networkforensics.com/2010/03/26/cyberwar-or-not-cyberwar-and-why-that-is-the-question/</link>
		<comments>http://www.networkforensics.com/2010/03/26/cyberwar-or-not-cyberwar-and-why-that-is-the-question/#comments</comments>
		<pubDate>Fri, 26 Mar 2010 13:05:33 +0000</pubDate>
		<dc:creator>steve</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Leadership]]></category>
		<category><![CDATA[Amit Yoran]]></category>
		<category><![CDATA[Cyberwar]]></category>
		<category><![CDATA[Forbes.com]]></category>
		<category><![CDATA[Mike McConnell]]></category>
		<category><![CDATA[Situational Awareness]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=271</guid>
		<description><![CDATA[Over the past two months, there has been a tremendous amount of chatter in the security community about the term ‘cyberwar’ and whether or not the US is engaged in a cyberwar.  Mike McConnell (former Director of National Intelligence) wrote a pointed op-ed for The Washington Post claiming that, “The United States is fighting [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/03/26/cyberwar-or-not-cyberwar-and-why-that-is-the-question/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>UpdateKernel / Kneber Government Attacks</title>
		<link>http://www.networkforensics.com/2010/03/17/updatekernel-kneber-government-attacks/</link>
		<comments>http://www.networkforensics.com/2010/03/17/updatekernel-kneber-government-attacks/#comments</comments>
		<pubDate>Wed, 17 Mar 2010 15:56:09 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[apt]]></category>
		<category><![CDATA[Advanced Threats]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=266</guid>
		<description><![CDATA[This is a significant percentage of the related government activity we mentioned with the release of the report.  Much of this is ongoing, and there are dozens of similar operations.  Credit where credit is due, Nart Villeneuve, from SecDev.cyber has a great write up on the targeted government attacks here:
www.infowar-monitor.net
If you have recently heard of [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/03/17/updatekernel-kneber-government-attacks/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Kneber Update</title>
		<link>http://www.networkforensics.com/2010/02/19/kneber-update/</link>
		<comments>http://www.networkforensics.com/2010/02/19/kneber-update/#comments</comments>
		<pubDate>Fri, 19 Feb 2010 18:05:25 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[trojan]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[e-crime]]></category>
		<category><![CDATA[kneber]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[zeus]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=207</guid>
		<description><![CDATA[There was a significant amount of coverage yesterday on research performed by NetWitness into a large set of stolen information recovered from a ZeuS botnet.  Some of the information, analysis, and commentary was very beneficial to the broader discussion of threats such as these.  There is, however, some information that we feel we should address.

Kneber [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/02/19/kneber-update/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>Move over China, here comes Russia</title>
		<link>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/</link>
		<comments>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/#comments</comments>
		<pubDate>Thu, 18 Feb 2010 03:10:53 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Data Leakage]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[apt]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[Cyberwar]]></category>
		<category><![CDATA[e-crime]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=187</guid>
		<description><![CDATA[While the world took pause to consider the implications of Operation Aurora, and Google lent considerable voice to the concept of Advanced and Persistent Threats (APT), we can ill-afford to believe even for a moment that they are alone in their sophistication or capability.   According to the FBI more than 100 nations have offensive [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Network Forensics ca. 1999</title>
		<link>http://www.networkforensics.com/2010/02/02/network-forensics-ca-1999/</link>
		<comments>http://www.networkforensics.com/2010/02/02/network-forensics-ca-1999/#comments</comments>
		<pubDate>Tue, 02 Feb 2010 17:07:10 +0000</pubDate>
		<dc:creator>brian</dc:creator>
				<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[Leadership]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[Investigator]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=135</guid>
		<description><![CDATA[It’s a little known fact that NetWitness has been innovating in the security field for over 11 years, which was further validated by the announcement of our recently granted US Patent # 7,634,557. Clearly, when it comes to network analysis we do it better than anyone else, and it’s really the only way to get [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/02/02/network-forensics-ca-1999/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
