
If we look at the remote code execution, we obviously try to investigate on the appliance itself because we want to verify was it a tag, was it exploited, is the attacker still on appliance itself or has already dumped the memory and has gone further. So we have to focus on appliance and as we already saw analyzing appliance is not that easy. It's not that common. We need to pick up some tricks from our sleeves.