tag:blogger.com,1999:blog-9518042.post875327683814579476..comments2024-03-19T07:46:20.437-05:00Comments on Windows Incident Response: Tagged!Unknownnoreply@blogger.comBlogger7125tag:blogger.com,1999:blog-9518042.post-24189732019416386452007-01-03T13:44:00.000-05:002007-01-03T13:44:00.000-05:00Another thought I had/have been having for several...Another thought I had/have been having for several months...<br /><br />The bad guys communicate with each other. I've heard rumors that some even communicate on gaming networks because they aren't logged. But they communicate. Look at any of the big cases in the news (<a href="http://www.baselinemag.com/article2/0,1397,1774393,00.asp">here</a>, <a href="http://en.wikipedia.org/wiki/ShadowCrew">here</a>, and <a href="http://www.consumeraffairs.com/news04/2005/shadowcrew.html">here</a>) and you'll see organizations that share information.<br /><br />The good guys don't communicate, in part for the reasons/excuses posted in previous comments. Even simple things, like P2P artifacts, are not readily shared. Many lists with closed membership that are dedicated to technical topics are nothing more that social clubs.H. Carveyhttps://www.blogger.com/profile/08966595734678290320noreply@blogger.comtag:blogger.com,1999:blog-9518042.post-40438912160125800502007-01-03T13:21:00.000-05:002007-01-03T13:21:00.000-05:00My only concern about posting is looking like an i...<i>My only concern about posting is looking like an idiot</i><br /><br />This is a concern shared by many, particularly LEOs who do not want opposing counsel to find out that they did not know something. However, there are inherent flaws to that logic:<br /><br />1. You can always post anonymously, or contact me directly.<br /><br />2. If you do not know something, then not asking the question simply keeps you at square 1. If you were to ask the question, and opposing counsel sees that you did, you can then state that you received an answer and verified the information. <br /><br />3. Using that same logic (about not posting so that opposing counsel doesn't catch on that you didn't know something), doesn't it stand to reason that <b>none</b> of your testimony would stand up, b/c at one point, prior to all of your training, you did not know anything?<br /><br />4. Not asking the question does not get you any closer to the answer.<br /><br /><i>What is your opinion of the SANS forensic course?</i><br /><br />I really don't have one. I haven't taken the course, but I do know and respect some of the instructors.H. Carveyhttps://www.blogger.com/profile/08966595734678290320noreply@blogger.comtag:blogger.com,1999:blog-9518042.post-3350321368635158162007-01-03T13:03:00.000-05:002007-01-03T13:03:00.000-05:00Thank you for the kind words. My only concern abou...Thank you for the kind words. My only concern about posting is looking like an idiot, and unfortuantely that can't be stopped!<br /><br />What is your opinion of the SANS forensic course?Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-9518042.post-48895323509105844162007-01-03T12:47:00.000-05:002007-01-03T12:47:00.000-05:00Questions and/or comments are always welcome. If ...Questions and/or comments are always welcome. If you're concerned about posting, feel free to post anonymously, or email me directly at keydet89 at yahoo dot com, and I can make sure that your input makes it into the blog without reference to you.H. Carveyhttps://www.blogger.com/profile/08966595734678290320noreply@blogger.comtag:blogger.com,1999:blog-9518042.post-88510743184152671602007-01-03T12:44:00.000-05:002007-01-03T12:44:00.000-05:00Well... I will try to come up with something of va...Well... I will try to come up with something of value to ask!Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-9518042.post-54607002700877106402007-01-03T08:37:00.000-05:002007-01-03T08:37:00.000-05:00Many times, it's helpful to get comments/questions...Many times, it's helpful to get comments/questions/suggestions or simply input from the readers. <br /><br />After all, I get requests pretty regularly, and if they are fairly easy to accomodate, they will usually end up on the DVD for my next book.<br /><br />So rather than think of it as a hiatus from blogging for a month, think of it as the readers not providing input for a month. ;-)H. Carveyhttps://www.blogger.com/profile/08966595734678290320noreply@blogger.comtag:blogger.com,1999:blog-9518042.post-73609294533761344552007-01-03T06:54:00.000-05:002007-01-03T06:54:00.000-05:00A month off? I had to check my RSS feed because I ...A month off? I had to check my RSS feed because I thought it was broken. :)Anonymousnoreply@blogger.com