🚀 go-pugleaf

Sorry for the late announcement!

This month's meeting:

  Steve Romig will talk about how to correlate evidence from different
  sources together when you are conducting a investigation into
  various sorts of computer related misdeeds (crimes, performance
  problems, etc. - the techniques and challenges are much the same).
  Here's a teaser from an article I've written on the subject for
  the USENIX ;Login: magazine:

    One common goal in these sorts of investigations is to reconstruct
    a chronological record of events and a list of other facts.  ...
    Obviously, how well we can construct the record of events and fit
    the pieces together has great bearing on the outcome of the
    investigation.

    There are several issues that we need to consider.  First, we need
    to be proficient at finding the evidence.  If you can't find the
    evidence in the first place, you'll have a hard time fitting it
    into your reconstructed chain of events :-) We also need to
    understand what the evidence actually means.  If we misunderstand
    the evidence, then either our reconstruction will be wrong or
    we'll create faulty theories that explain the evidence.  Finally,
    we need to understand how to piece evidence from different sources
    together to create a cohesive reconstruction.  If we know where
    the evidence can be found, what it means, and how it fits together
    then we'll be well on our way to reconstructing the chain of
    events.  Note that I am totally ignoring issues concerning
    preservation of evidence for use in a civil or criminal trial.
    Sorry!

  My talk will mostly focus on the third issue, that of correlating
  the pieces together into a coherent whole.

  The meeting will be on Wednesday, August 23, from 4-6 PM in Baker
  Systems 120 on the OSU main campus.

About these meetings:

  The Network Security Group meetings are usually held on the fourth
  Wednesday of each month from 4-6 PM on the Ohio State University
  main campus in Columbus (usually in Baker Systems 120).  The goal of
  our meetings is to share information about computer security tools,
  practices and problems.  Anyone and everyone are invited to attend.

  We also have mailing lists for people who are interested in
  discussing network security issues, or who just want announcements
  about meetings and security bulletins.  Send mail to
  romig@net.ohio-state.edu for more information.

  Note that this is *not* the same as the bi-weekly security lunch at
  Battelle (the AEGIS group), though you are welcome to attend
  either.  For more information about AEGIS, please contact me.

  See http://www.net.ohio-state.edu/security for information about the
  services that we provide, future meetings, resources, contact
  information, directions, mailing lists, free money (just kidding!)
  and so on...

--- Steve