Chapter 3 from my third book, Extrusion Detection: Security Monitoring for Internal Intrusions is also online at SearchSecurityChannel.com. Real Digital Forensics is a book where network security monitoring, network incident response, and network forensics are intergrated with host- and memory-centric security operations. The model applies well to insider and outsider threats, and as such I recommend reading Tao first and then Extrusions first and second volumes of the book. The book has been getting some attention because it starts with the premise that your network is compromised.”]
Source: https://taosecurity.blogspot.com/2006/10/chapter-3-from-extrusion-online.html