You probably want to have a look at some of the info at this link.

http://www.sans.org/rr/catindex.php?cat_id=27