Information Security Handbook

Observe, orient, decide, and act – OODA

A valuable concept that you can use to help conceptualize your incident response planning as well as your operational incident response capability is the OODA loop. The concept was originally developed by military strategist John Boyd and serves as a foundation when considering how to deal with an adversary, which is what the information security professional is doing as they are developing an incident response capability:

• Observe: Ensure that while you are planning your incident response capability that you have as much visibility into your information system as possible. The best defense that you can mount against modern well-funded and highly motivated adversaries is to implement advanced layer ...