-: The Ooda loop. 2 2
In this lesson, we are going to talk all about the Ooda loop. 3 3
Now, before we do that, let me give you a quick exam tip. 4 4
This lesson on the Ooda loop is not required 5 5
for the exam for the CYSA plus exam objectives. 6 6
Now, that means you're not going to get any questions 7 7
on the exam about the Ooda loop, but we are going to cover it 8 8
because it is a common framework that is used 9 9
in the cybersecurity world when you're 10 10
conducting an incident response. 11 11
Now, the Ooda loop is a decision-making model 12 12
that was created 13 13
by Colonel John Boyd to help responders 14 14
think clearly during the fog of war. 15 15
When we talk about the Ooda loop, 16 16
we're talking about the fact 17 17
that you have to go through four stages. 18 18
This is observe, orient, decide, and act. 19 19
Let's talk about each of these real quick. 20 20
First, we're going to observe. 21 21
When we observe, we want to identify the problem 22 22
or threat and get an overall understanding 23 23
of the internal and external environment. 24 24
In the corporate world, this can be equated 25 25
to data gathering where all of the information 26 26
regarding the current organizational state, 27 27
any competitors in market is collected, 28 28
or whatever you're dealing with in an incident, 29 29
you're gathering all of those details. 30 30
Our key focus here during the observe step 31 31
is to gather as much information as we can 32 32
because we have to understand the world as complex. 33 33
All this data becomes a snapshot in time 34 34
and it has to be treated 35 35
as such when we go forward for later analysis. 36 36
Therefore, we always want to gather whatever 37 37
information we can as quickly 38 38
as possible and not succumb to paralysis by analysis. 39 39
Then we move into our second step, which is orient. 40 40
During this orientation phase, we want to reflect 41 41
on what we found during our observation phase 42 42
and then consider what should we do next. 43 43
This requires a significant level of situational awareness 44 44
and understanding in order for us 45 45
to make a good conscious decision. 46 46
Now, when you're dealing with an incident response, 47 47
sometimes you are going to have some unconscious 48 48
or instinctual decisions as well. 49 49
This still happens inside the orient phase, but really, 50 50
we are focused on thinking about what our course 51 51
of action is going to be. 52 52
We're taking the information we gather from observe 53 53
and we're coming up with different solutions and plans 54 54
that we can move forward with based on our orientation. 55 55
Our third step is then to decide. 56 56
Now when we decide, 57 57
we are making suggestions towards an action or response plan 58 58
while taking into consideration all 59 59
of the potential outcomes. 60 60
This decision phase makes these suggestions, 61 61
and then we could figure 62 62
out what we want to do from here. 63 63
This can be accomplished through meetings or discussions 64 64
and all of these things are going to be focused 65 65
around creating a roadmap or a plan for the entire 66 66
organization and for the entire instant response. 67 67
Finally, we're going to act. 68 68
When we act, we are going to carry out the decision 69 69
and the related changes that need to be made 70 70
in response to that decision. 71 71
This allows us to then see what's being done and based 72 72
on what we see as being done, we then can start over again 73 73
with the observe phase. 74 74
This way, this cycle happens over and over again. 75 75
We observe some information. 76 76
We take in data. 77 77
We orient ourself by understanding it 78 78
and creating situational awareness. 79 79
Then we decide to take some kind of action, 80 80
and then we act on it. 81 81
After we act, we then need to observe again to see 82 82
if what we did worked or if we have to adjust fire again. 83 83
That's the idea of this Ooda loop. 84 84
We want to stop ourself from reacting 85 85
to what the adversary is doing 86 86
and we instead want to take the initiative. 87 87
This way, we can do that 88 88
with a measured response and get ahead of the adversary. 89 89
If our Ooda loop is shorter and faster than the adversaries, 90 90
we can move quicker 91 91
and we can take the advantage and move forward from there. 92 92
Now, one of the biggest elements 93 93
of the Ooda loop is that it stresses agility. 94 94
Now, during the observation part of the cycle, 95 95
we shouldn't be dominating ourself with that. 96 96
We need to just get information in 97 97
and then move into the other three parts of the cycle. 98 98
The reason for this is we don't want to become overcome 99 99
by paralysis, by analysis, in that observation phase. 100 100
It is really easy to say, 101 101
I can't make a decision yet. 102 102
I need to gather more details. 103 103
But when you do that, you are wasting valuable time. 104 104
Instead, take a small action and then observe again. 105 105
That way as you're going through this loop 106 106
and going through your observe, orient, decide, and act, 107 107
you're constantly making these small changes 108 108
and actions that allows you to start getting momentum 109 109
and collecting additional data as you go. 110 110
This will help you go through each stage quickly 111 111
and make sure that you're getting 112 112
to where you need to be and helping deal with this response. 113 113
So what might this look like, 114 114
in the real world during an instant response? 115 115
Well, let's walk through the four steps 116 116
and see what it might look like. 117 117
First, observe, for example, as you're observing, 118 118
you might see an alert in your seam that's been created due 119 119
to an employee clicking on a link in an email. 120 120
Maybe there's a phishing campaign going 121 121
on and somebody clicked that link. 122 122
That is your first indication, and that's an observation. 123 123
Then you need to orient yourself. 124 124
You need to identify what user permissions that person had, 125 125
any changes that may have happened 126 126
on that system after clicking the link, 127 127
and what are the potential goals for the attacker? 128 128
Again, we're trying to gain situational awareness 129 129
about the data that we observed. 130 130
Then we need to decide on something. 131 131
What plan are we going to attack with? 132 132
Well, if we have to decide, we may look at how 133 133
this user system was compromised, what malware was installed 134 134
by the attacker, and how we're going to isolate that system. 135 135
Based on those courses of actions we've come 136 136
up with during Orient, we can then make a decision 137 137
and go after those things, and then we're going to act. 138 138
We're going to go and take those actions on the user system. 139 139
We might isolate the user system by the instant responder 140 140
and then begin to observe again 141 141
for additional indicators to make sure 142 142
we got everything out of that system. 143 143
And that's the idea of this Ooda loop. 144 144
As we go through those four steps, 145 145
we then need to restart the loop and do it again 146 146
and we're going to keep doing that over 147 147
and over until the incident is fully resolved. 148 148
This way, we can continue to observe, 149 149
orient, decide, and act.