OODA Looping in a Turbulent World
summary
Applies the OODA loop to real incidents and shows concrete results: a lab query pulled DNS from a home lab and flagged 726 COVID-related domains that were delivering malware, with IOCs ingested from Microsoft, FireEye and Cisco into Splunk for pivoting and detection. Recommends Zeek/DNS telemetry and DomainTools/RiskIQ for infrastructure pivots, emphasizes defenders over-index on Observe/Act while neglecting Orient and Decide, and demonstrates that iterative OODA work (30/60/90 reviews) reduces adversary advantage.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 3:09What is OODA
- 10:17COVID
- 20:45Supply Chain
- 26:22Decision Making
- 29:50Air Breaking Your Opponent
- 32:10Conclusion
related talks
31mAttack Hunting with Threat Intelligence
12mKeynote: Security and the OODA Loop - Liz Rice, Technology Evangelist, Aqua Security
11mKeynote: Security and the OODA Loop
55mThe State of Incident Response
22mTechnical Tracks
50mConnecting the Dots - An Effective Cybersecurity Strategy
20mUsing Data Breadcrumbs to ID Targeted Attacks
10mQuick Look: A Real-World Example of Using Network Behaviour to Detect Cyber-Compromise