http://www.sans.org/whatworks/poster_spring_09.pdf

Checkout section 5.1.



Lin