Part 2 — Mapping OODA to NIST SP800–61r2

The OODA Loop, a decision-making framework, can be effectively adapted for security incident response. This modified framework replaces the original “outside information” component with “threat intelligence” and redefines the “unfolding interaction with the environment” component as “unfolding interaction with the (IT) environment.” This adaptation aligns with the NIST SP800–61r2 standard for security incident response.

Key Components of the Adapted OODA Loop:

1. Observe:

• NIST SP800–61r2 Mapping:
• Identify and detect security incidents.
• Analyze security alerts and events.

Specific Actions:

• Monitor network traffic for anomalies.
• Review security logs for suspicious activity.
• Analyze threat intelligence feeds.

1. Orient:

• NIST SP800–61r2 Mapping:
• Analyze and assess the security incident.
• Determine the scope and impact of the incident.

Specific Actions:

• Correlate security alerts and events.
• Determine the root cause of the incident.
• Assess the potential impact of the incident.

1. Decide:

• NIST SP800–61r2 Mapping:
• Develop an incident response plan.
• Select and implement response actions.

Specific Actions:

• Establish an incident response team.
• Initiate containment and eradication measures.
• Implement recovery procedures.

1. Act:

• NIST SP800–61r2 Mapping:
• Execute incident response actions.
• Communicate with relevant stakeholders.

Specific Actions:

• Isolate affected systems.
• Eradicate the threat.
• Restore systems and data.
• Communicate incident details to stakeholders.

By aligning the OODA Loop with NIST SP800–61r2 and incorporating threat intelligence, organizations can enhance their security incident response capabilities, enabling them to react swiftly and effectively to security threats.

Preparation:

While the NIST standard’s preparation phase doesn’t directly align with the OODA Loop (as there’s no active incident), it’s crucial for effective incident response. For the OODA Loop, preparation involves:

Course of Action (CoA) Matrix: A predefined set of responses to different incident scenarios.

Operational Security (OpSec): Proactive measures to prevent attacks that could disrupt the defensive OODA Loop, such as overloading security systems or disabling monitoring tools.

Detection and Analysis:

These NIST phases correspond to the Observe and Orient phases of the OODA Loop:

Detection: The act of identifying malicious activity falls under the Observe phase. Effective detection requires understanding potential attack vectors and recognizing precursors and indicators of compromise.

Analysis: Once an incident is detected, the Orient phase begins. This involves:

Incident Analysis: A detailed examination of the incident to determine its scope, severity, and potential impact.

Incident Prioritization: Assigning priority to incidents based on their severity and potential consequences.

Incident Notification: Informing relevant stakeholders about the incident.

By focusing on preparation, detection, and analysis, organizations can effectively employ the OODA Loop to respond to security incidents efficiently and effectively.

Containment, Eradication & Recovery:

These NIST phases align with the Decide and Act phases of the OODA Loop.

Containment: Primarily a decision-making process, involving the selection of appropriate containment strategies. It also requires ongoing observation and analysis to identify attacking hosts and gather evidence.

Eradication and Recovery: These actions, often categorized as “restoration” in a CoA matrix, are implemented in the Act phase. They may follow other actions, such as containment, and require continuous adaptation based on the evolving situation.

Post-Incident Activities:

Similar to the preparation phase, post-incident activities aren’t directly mapped to the OODA Loop, as there’s no active incident. However, they contribute to the overall improvement of incident response capabilities:

Lessons Learned: Insights gained from the incident can be incorporated into training and exercises, enhancing the team’s mental model and improving decision-making.

Continuous Improvement: The PDCA cycle (Plan-Do-Check-Act) can be applied to the entire incident response process, while the OODA Loop provides a framework for agile decision-making and adaptation.

The Intersection of NIST and OODA:

While NIST focuses on a linear progression of events, the OODA Loop emphasizes iterative cycles of observation, orientation, decision, and action. The two frameworks complement each other:

• NIST: Provides a structured approach to incident response, covering all phases from preparation to post-incident activities.
• OODA: Enables rapid decision-making and adaptation to dynamic threats, ensuring effective response to incidents.

By combining the strengths of both, organizations can develop robust and agile incident response capabilities.