The OODA Loop: A Holistic Approach to Cyber Security
A holistic approach to cyber security is one that includes the threat actors, advance telemetry of the network and a defensive strategy that continuously adapts to the adversaries capability and threat landscape. By collecting and analyzing network data via technologies such as NetFlow, organizations can obtain the security intelligence needed to fill in the gaps left by conventional tools and more effectively feed their OODA loop - a cyclical process for Observation, Orientation, Decision and Action. By embracing the OODA loop, and turning the network into a sensor grid for delivering key security information, organizations can dramatically improve their situational awareness, incident response and forensics procedures. When you leave this session you will... • Understand how the motives and techniques of online attackers have changed over the last couple of decades • Realize why conventional security tools like firewalls and antivirus are no longer enough to fend off today’s advanced threats, and why more holistic cyber security strategies are needed • Know about the “OODA loop” and how it can be applied to cyber security to protect IT infrastructure and data from advanced adversaries • Understand how network data such as NetFlow can be cost-effectively collected and analyzed to feed and speed up your OODA loop • Have a strategy for dramatically improving incident response and forensics
Recommandé
Recommandé
Contenu connexe
Plus de Lancope, Inc.
Plus de Lancope, Inc. (20)
Dernier
Dernier (20)
The OODA Loop: A Holistic Approach to Cyber Security
- 1. The OODA Loop: A Holistic Approach to Cyber Security TK Keanini, CTO Lancope Dude, follow me on twitter @tkeanini
- 2. Cyber Security Strategy Retrospective 2 Fragmented Tactics Deterministic Threat Push exploits to Enterprise Single-Step Exploits Overt Tactics (cost to exploit) Threat Intelligence Optional Holistic Strategy Adaptive Threat Pull exploits to Enterprise Multi-Step Exploits Covert Tactics (cost to remain hidden) Threat Intelligence Mandatory Continuously evaluate your strategy Yesterday Today
- 3. A Holistic Approach to Cyber Security • Holistic Strategy (Framing the Conflict) • Holistic Telemetry (Data Complete) • Holistic Understanding (Information and Knowledge Complete) 3
- 4. Holistic Strategy • Inclusive of all the players – Not just operations, must include bad guys • Must be a continuous process – If it does not look like a loop, it’s probably wrong • A framework for the changing dynamics of conflict – Understanding the game dynamics • Sun Tzu • Musashi • Clausewitz How to Best Frame Conflict 4
- 5. Colonel John Boyd (1927 – 1997) • Fighter Pilot – Forty-Second Boyd • Military Theories – Energy Maneuverability Theory • Drove requirements for the F15 and F16 – Discourse on Winning & Losing – Destruction & Creation – Many modern military strategies based on Boyd • The OODA Loop – the concept that all combat, indeed all human competition from chess to soccer to business, involves a continuous cycle of Observation, Orientation, Decision, and Action
- 6. Simplified OODA in the Context of Time • Intelligence — Observation — Orientation • Execution — Decision — Action
- 7. Feedback Loops of the OODA Loop
- 8. Conflict: Red vs. Blue O O D A A D O O Red OpsBlue Ops Spin your loop faster than your adversary OODA for Cyber Security
- 9. OODA Loop Summary • Observation and Orientation (OO) increases your perceptive boundaries. – Superior Situational Awareness • Sampling Rate of the OO is relative to the rate of change – Fast enough to represent change • Decision and Actions raise the cost to your adversaries’ Observation/Orientation • Operate at a faster tempo or rhythm than our adversaries Ultimately you are making it more expensive for the adversary to operate and hide
- 10. Holistic Telemetry • Multi Sensor – No place to hide (space and time) • Metadata as Context • Observation of Data – Completeness • Orientation of Information – User Centric – App Centric Data Complete 10 Flows IP MAC Noun S: (n) telemetry (automatic transmission and measurement of data from remote sources by wire or radio or other means) App Users
- 11. Holistic Understanding Intelligence 11 CraftKnowledge •Synthesis of Information Sets •Know how •Observer Centric Fusion of DataInformation •Synthesis of Data Sets •Information Sets AtomicData •Identifiers, Addresses, Counts, Types, etc. •Sets of Signals & Symbols AnalyticSynthetic
- 12. Holistic Cyber Security The Art of Cyberwar 12 Decision Action Observation Orientation Data Information Knowledge Automated Semi Automated Manual SDN Cloud
- 13. OODA Loop and the Kill Chain Infiltration Exfiltration
- 14. Your Infrastructure Provides the Observation... InternetAtlanta San Jose New York ASR-1000 Cat6k UCS with Nexus 1000v ASA Cat6k 3925 ISR 3560-X 3850 Stack(s) Cat4k Datacenter WAN DMZ Access NetFlow NetFlow NetFlow NetFlow NetFlow NetFlow NetFlow NetFlow NetFlow NetFlow NetFlow NetFlow NetFlow NetFlow NetFlow NetFlow © 2013 Lancope, Inc. All rights reserved. 14
- 15. …for Total Visibility from Edge to Access. StealthWatch delivers the Orientation InternetAtlanta San Jose New York ASR-1000 Cat6k UCS with Nexus 1000v ASA Cat6k 3925 ISR 3560-X 3850 Stack(s) Cat4kDatacenter WAN DM Z Access © 2013 Lancope, Inc. All rights reserved. 15
- 16. Data Observation 16© 2013 Lancope, Inc. All rights reserved.
- 18. Time of Day Orientation
- 22. http://www.lancope.com @Lancope (company) @netflowninjas (company blog) https://www.facebook.com/Lancope http://www.linkedin.com/groups/NetFlow-Ninjas-2261596/about https://plus.google.com/u/0/103996520487697388791/posts http://feeds.feedburner.com/NetflowNinjas Thank You 22© 2013 Lancope, Inc. All rights reserved. TK Keanini, Chief Technology Officer tk@lancope.com @tkeanini