While teaching a SANS course recently, I had the opportunity to watch a presentation by John Strand of Black Hills Information Security. His organization recently released the Active Defense Harbinger Distribution (ADHD) Linux distribution. This tool, focusing on “active defense” is fantastic but something other than the tool prompted this blog entry.
During his presentation, John talked about OODA loop. OODA stands for observe, orient, decide and act. This concept was originally developed by US Air Force Colonel John Boyd. The concept is that when engaging an enemy pilot, the one that can complete the OODA loop faster will fly home. The one who takes longer to get to “act” winds up taking an unexpected trip to the earth. John applies the OODA loop to information security as part of his ADHD presentation. That got me thinking.
Imagine you walk into your house - someplace you know very well. How long does it take you to observe that there is a problem? How long to orient yourself to the situation? How long to decide to take an action? How long to act? For most of us, the OODA loop can be completed very quickly when we are in familiar surroundings. Now consider a place you have never been. Would you even notice something out of place? How long would it take for you to orient yourself to the surroundings? Unfamiliar situations dramatically extend the OODA loop.
OK, so lets try to put this in the context of information security. Studies show that most organizations find out about a breach only after being notified by a third part and that occurs months after the breach occurred. How is it that the attackers “flip the script” when it comes to the OODA loop. The enter a strange environment but are able to observe, orient, decide and act well before those supposedly familiar with the environment even get to the observe phase? This is, in my opinion, the essence of the problem we face in information security.
I believe the answers are conceptually simple. First, we don’t know our own environments. We have no idea what normal is and thus are entirely unable to identify abnormal. Second, we don’t take advantage of the fact that normal user behavior and attacker behavior are massively different. Normal users connect to a limited number of computers on a limited number of ports during limited times of the day. Normal users know the environment, as least as far as they know what they need to do to get their jobs done. Attackers on the other hand, must spend time learning their environment. They perform ping sweeps, port scans, vulnerability scans, etc. This is all behavior that can, and should be detected.
So what do we do? I think the answer is remarkably simple. First,we establish good baselines so we can better know our own environments. This will allow us to faster identify when things are abnormal. Next, we take advantage of the fact that attacker will need to take steps to learn our environment. Putting in place egress filtering on perimeter firewalls and logging blocked traffic can play that role as can logged ACLs between internal network VLANs.
