1 1 00:00:00,570 --> 00:00:01,653 The Ooda loop. 2 2 00:00:02,550 --> 00:00:06,240 In this lesson, we are going to talk all about the Ooda loop. 3 3 00:00:06,240 --> 00:00:09,660 Now, before we do that, let me give you a quick exam tip. 4 4 00:00:09,660 --> 00:00:12,030 This lesson on the Ooda loop is not required 5 5 00:00:12,030 --> 00:00:16,260 for the exam for the CYSA plus exam objectives. 6 6 00:00:16,260 --> 00:00:18,300 Now, that means you're not going to get any questions 7 7 00:00:18,300 --> 00:00:21,930 on the exam about the Ooda loop, but we are going to cover it 8 8 00:00:21,930 --> 00:00:24,270 because it is a common framework that is used 9 9 00:00:24,270 --> 00:00:26,010 in the cybersecurity world when you're 10 10 00:00:26,010 --> 00:00:28,110 conducting an incident response. 11 11 00:00:28,110 --> 00:00:30,810 Now, the Ooda loop is a decision-making model 12 12 00:00:30,810 --> 00:00:31,643 that was created 13 13 00:00:31,643 --> 00:00:33,750 by Colonel John Boyd to help responders 14 14 00:00:33,750 --> 00:00:36,510 think clearly during the fog of war. 15 15 00:00:36,510 --> 00:00:37,980 When we talk about the Ooda loop, 16 16 00:00:37,980 --> 00:00:39,150 we're talking about the fact 17 17 00:00:39,150 --> 00:00:40,980 that you have to go through four stages. 18 18 00:00:40,980 --> 00:00:44,610 This is observe, orient, decide, and act. 19 19 00:00:44,610 --> 00:00:46,620 Let's talk about each of these real quick. 20 20 00:00:46,620 --> 00:00:48,630 First, we're going to observe. 21 21 00:00:48,630 --> 00:00:50,670 When we observe, we want to identify the problem 22 22 00:00:50,670 --> 00:00:52,650 or threat and get an overall understanding 23 23 00:00:52,650 --> 00:00:54,783 of the internal and external environment. 24 24 00:00:55,675 --> 00:00:57,720 In the corporate world, this can be equated 25 25 00:00:57,720 --> 00:01:00,210 to data gathering where all of the information 26 26 00:01:00,210 --> 00:01:02,370 regarding the current organizational state, 27 27 00:01:02,370 --> 00:01:04,800 any competitors in market is collected, 28 28 00:01:04,800 --> 00:01:06,540 or whatever you're dealing with in an incident, 29 29 00:01:06,540 --> 00:01:08,970 you're gathering all of those details. 30 30 00:01:08,970 --> 00:01:12,142 Our key focus here during the observe step 31 31 00:01:12,142 --> 00:01:13,710 is to gather as much information as we can 32 32 00:01:13,710 --> 00:01:16,560 because we have to understand the world as complex. 33 33 00:01:16,560 --> 00:01:18,900 All this data becomes a snapshot in time 34 34 00:01:18,900 --> 00:01:19,860 and it has to be treated 35 35 00:01:19,860 --> 00:01:23,070 as such when we go forward for later analysis. 36 36 00:01:23,070 --> 00:01:25,170 Therefore, we always want to gather whatever 37 37 00:01:25,170 --> 00:01:26,550 information we can as quickly 38 38 00:01:26,550 --> 00:01:30,690 as possible and not succumb to paralysis by analysis. 39 39 00:01:30,690 --> 00:01:33,960 Then we move into our second step, which is orient. 40 40 00:01:33,960 --> 00:01:36,780 During this orientation phase, we want to reflect 41 41 00:01:36,780 --> 00:01:39,450 on what we found during our observation phase 42 42 00:01:39,450 --> 00:01:41,970 and then consider what should we do next. 43 43 00:01:41,970 --> 00:01:44,730 This requires a significant level of situational awareness 44 44 00:01:44,730 --> 00:01:46,410 and understanding in order for us 45 45 00:01:46,410 --> 00:01:49,140 to make a good conscious decision. 46 46 00:01:49,140 --> 00:01:50,970 Now, when you're dealing with an incident response, 47 47 00:01:50,970 --> 00:01:53,340 sometimes you are going to have some unconscious 48 48 00:01:53,340 --> 00:01:55,290 or instinctual decisions as well. 49 49 00:01:55,290 --> 00:01:58,260 This still happens inside the orient phase, but really, 50 50 00:01:58,260 --> 00:02:00,420 we are focused on thinking about what our course 51 51 00:02:00,420 --> 00:02:01,860 of action is going to be. 52 52 00:02:01,860 --> 00:02:04,170 We're taking the information we gather from observe 53 53 00:02:04,170 --> 00:02:06,180 and we're coming up with different solutions and plans 54 54 00:02:06,180 --> 00:02:09,630 that we can move forward with based on our orientation. 55 55 00:02:09,630 --> 00:02:11,970 Our third step is then to decide. 56 56 00:02:11,970 --> 00:02:12,930 Now when we decide, 57 57 00:02:12,930 --> 00:02:16,170 we are making suggestions towards an action or response plan 58 58 00:02:16,170 --> 00:02:17,640 while taking into consideration all 59 59 00:02:17,640 --> 00:02:19,260 of the potential outcomes. 60 60 00:02:19,260 --> 00:02:21,840 This decision phase makes these suggestions, 61 61 00:02:21,840 --> 00:02:22,860 and then we could figure 62 62 00:02:22,860 --> 00:02:24,690 out what we want to do from here. 63 63 00:02:24,690 --> 00:02:27,300 This can be accomplished through meetings or discussions 64 64 00:02:27,300 --> 00:02:28,890 and all of these things are going to be focused 65 65 00:02:28,890 --> 00:02:31,590 around creating a roadmap or a plan for the entire 66 66 00:02:31,590 --> 00:02:35,280 organization and for the entire instant response. 67 67 00:02:35,280 --> 00:02:37,320 Finally, we're going to act. 68 68 00:02:37,320 --> 00:02:39,420 When we act, we are going to carry out the decision 69 69 00:02:39,420 --> 00:02:41,370 and the related changes that need to be made 70 70 00:02:41,370 --> 00:02:43,530 in response to that decision. 71 71 00:02:43,530 --> 00:02:46,479 This allows us to then see what's being done and based 72 72 00:02:46,479 --> 00:02:49,680 on what we see as being done, we then can start over again 73 73 00:02:49,680 --> 00:02:51,300 with the observe phase. 74 74 00:02:51,300 --> 00:02:54,450 This way, this cycle happens over and over again. 75 75 00:02:54,450 --> 00:02:55,710 We observe some information. 76 76 00:02:55,710 --> 00:02:56,850 We take in data. 77 77 00:02:56,850 --> 00:02:58,560 We orient ourself by understanding it 78 78 00:02:58,560 --> 00:03:00,270 and creating situational awareness. 79 79 00:03:00,270 --> 00:03:02,370 Then we decide to take some kind of action, 80 80 00:03:02,370 --> 00:03:03,840 and then we act on it. 81 81 00:03:03,840 --> 00:03:06,420 After we act, we then need to observe again to see 82 82 00:03:06,420 --> 00:03:10,050 if what we did worked or if we have to adjust fire again. 83 83 00:03:10,050 --> 00:03:11,880 That's the idea of this Ooda loop. 84 84 00:03:11,880 --> 00:03:13,410 We want to stop ourself from reacting 85 85 00:03:13,410 --> 00:03:14,850 to what the adversary is doing 86 86 00:03:14,850 --> 00:03:16,890 and we instead want to take the initiative. 87 87 00:03:16,890 --> 00:03:17,940 This way, we can do that 88 88 00:03:17,940 --> 00:03:20,700 with a measured response and get ahead of the adversary. 89 89 00:03:20,700 --> 00:03:23,790 If our Ooda loop is shorter and faster than the adversaries, 90 90 00:03:23,790 --> 00:03:24,990 we can move quicker 91 91 00:03:24,990 --> 00:03:28,170 and we can take the advantage and move forward from there. 92 92 00:03:28,170 --> 00:03:29,370 Now, one of the biggest elements 93 93 00:03:29,370 --> 00:03:32,250 of the Ooda loop is that it stresses agility. 94 94 00:03:32,250 --> 00:03:34,470 Now, during the observation part of the cycle, 95 95 00:03:34,470 --> 00:03:36,630 we shouldn't be dominating ourself with that. 96 96 00:03:36,630 --> 00:03:38,250 We need to just get information in 97 97 00:03:38,250 --> 00:03:40,680 and then move into the other three parts of the cycle. 98 98 00:03:40,680 --> 00:03:42,960 The reason for this is we don't want to become overcome 99 99 00:03:42,960 --> 00:03:46,500 by paralysis, by analysis, in that observation phase. 100 100 00:03:46,500 --> 00:03:47,760 It is really easy to say, 101 101 00:03:47,760 --> 00:03:49,290 I can't make a decision yet. 102 102 00:03:49,290 --> 00:03:51,060 I need to gather more details. 103 103 00:03:51,060 --> 00:03:54,150 But when you do that, you are wasting valuable time. 104 104 00:03:54,150 --> 00:03:57,750 Instead, take a small action and then observe again. 105 105 00:03:57,750 --> 00:03:59,730 That way as you're going through this loop 106 106 00:03:59,730 --> 00:04:03,300 and going through your observe, orient, decide, and act, 107 107 00:04:03,300 --> 00:04:05,160 you're constantly making these small changes 108 108 00:04:05,160 --> 00:04:07,770 and actions that allows you to start getting momentum 109 109 00:04:07,770 --> 00:04:10,320 and collecting additional data as you go. 110 110 00:04:10,320 --> 00:04:12,360 This will help you go through each stage quickly 111 111 00:04:12,360 --> 00:04:13,320 and make sure that you're getting 112 112 00:04:13,320 --> 00:04:16,920 to where you need to be and helping deal with this response. 113 113 00:04:16,920 --> 00:04:18,420 So what might this look like, 114 114 00:04:18,420 --> 00:04:20,820 in the real world during an instant response? 115 115 00:04:20,820 --> 00:04:22,650 Well, let's walk through the four steps 116 116 00:04:22,650 --> 00:04:24,150 and see what it might look like. 117 117 00:04:24,150 --> 00:04:26,940 First, observe, for example, as you're observing, 118 118 00:04:26,940 --> 00:04:29,490 you might see an alert in your seam that's been created due 119 119 00:04:29,490 --> 00:04:31,590 to an employee clicking on a link in an email. 120 120 00:04:31,590 --> 00:04:33,150 Maybe there's a phishing campaign going 121 121 00:04:33,150 --> 00:04:34,830 on and somebody clicked that link. 122 122 00:04:34,830 --> 00:04:38,010 That is your first indication, and that's an observation. 123 123 00:04:38,010 --> 00:04:40,080 Then you need to orient yourself. 124 124 00:04:40,080 --> 00:04:43,350 You need to identify what user permissions that person had, 125 125 00:04:43,350 --> 00:04:44,580 any changes that may have happened 126 126 00:04:44,580 --> 00:04:46,967 on that system after clicking the link, 127 127 00:04:46,967 --> 00:04:48,810 and what are the potential goals for the attacker? 128 128 00:04:48,810 --> 00:04:50,940 Again, we're trying to gain situational awareness 129 129 00:04:50,940 --> 00:04:53,010 about the data that we observed. 130 130 00:04:53,010 --> 00:04:55,140 Then we need to decide on something. 131 131 00:04:55,140 --> 00:04:57,120 What plan are we going to attack with? 132 132 00:04:57,120 --> 00:04:59,280 Well, if we have to decide, we may look at how 133 133 00:04:59,280 --> 00:05:02,250 this user system was compromised, what malware was installed 134 134 00:05:02,250 --> 00:05:05,640 by the attacker, and how we're going to isolate that system. 135 135 00:05:05,640 --> 00:05:07,500 Based on those courses of actions we've come 136 136 00:05:07,500 --> 00:05:10,230 up with during Orient, we can then make a decision 137 137 00:05:10,230 --> 00:05:13,590 and go after those things, and then we're going to act. 138 138 00:05:13,590 --> 00:05:16,740 We're going to go and take those actions on the user system. 139 139 00:05:16,740 --> 00:05:19,590 We might isolate the user system by the instant responder 140 140 00:05:19,590 --> 00:05:21,000 and then begin to observe again 141 141 00:05:21,000 --> 00:05:22,950 for additional indicators to make sure 142 142 00:05:22,950 --> 00:05:25,440 we got everything out of that system. 143 143 00:05:25,440 --> 00:05:27,120 And that's the idea of this Ooda loop. 144 144 00:05:27,120 --> 00:05:28,770 As we go through those four steps, 145 145 00:05:28,770 --> 00:05:31,380 we then need to restart the loop and do it again 146 146 00:05:31,380 --> 00:05:32,790 and we're going to keep doing that over 147 147 00:05:32,790 --> 00:05:35,430 and over until the incident is fully resolved. 148 148 00:05:35,430 --> 00:05:37,800 This way, we can continue to observe, 149 149 00:05:37,800 --> 00:05:39,723 orient, decide, and act.