Common Ground Part 3: Execution and the People Factor

Decision Cycles

  • Plan-Do-Check-Act — Heavily used in quality assurance
  • Observe-Orient-Decide-Act (OODA) — Used by the US Military. A diagram of this process as formulated by Boyd is below
  • Observation-Hypothesis-Experiment-Evaluation (Scientific Method) — Used to evaluate hypothesis and make adjustments in scientific research
  • Observation: During the observe phase, the entity uses the unfolding circumstances combined with current interactions within the environment to formulate their perception of what is happening. They combine this info with outside information (enrichment data) to form the basis of their understanding.
  • Orient: During this phase, the decision maker takes their perception of the situation, and aligns their thoughts with the actions that are occurring. They utilize the culture of their organization, knowledge of past events, and the constant flux of information to begin to shape a potential decision.
  • Decide: This simple phase takes the information from the previous two phases and makes the decision on the best course of action.
  • Act: Having made the decision, the entity now executes that decision and utilizes any outcome as part of a feedback loop going back into the observe phase to mold a changing environment.

Affecting Decisions In Each Phase — Case Study

  • Observation
  • Limit the amount of information the decision maker can gain from the environment or overwhelm the decision maker with too much competing information.
  • Plant false flags pointing to multiple adversaries to produce offensive counter-information and force the decision maker to rely on outside information that is actually not relevant.
  • Disable network security sensors to prevent them from gaining a perception in the environment.
  • Orient
  • Identify known personalities in the decision making process and leverage personality flaws or biases to hamper a proper decision.
  • Prevent the thorough analysis of information by shifting or changing TTPs frequently.
  • Identify cultural traditions and norms and utilize them as part of your attack path (it is normal for people to log in after hours, so log in after hours).
  • Study past breaches in the environment and identify errors that you can piggyback off of.
  • Decide
  • Act
  • Recognize that a decision has been executed and orient yourself prior to allow their feedback loop to occur.
  • Nullify their actions in a rapid fashion so they feel the need to repeat the same actions.

Incident Response Cycle

  • Delegation — Certain decisions must be delegated down to prevent time lag.
  • Leadership Lag — Not all non-technical leaders will understand how to respond. They must have practice to react quicker during a real breach.
  • Out-of-Band C2 — During response efforts, the use of a compromised network will allow the adversary to instantly be inside your decision cycles by witnessing it in real-time. The adversary will also be able to apply deception or disruption operations.



Blog Series Wrap Up




Tech: Threat Intel | Photographer @

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

One degree of separation: A leadership lesson from the Master Coach

Why we’re backing teams over individuals

5 Main points why purpose reflection should be part of every meeting

Joining the Board: A first-timer’s guide

Celebrating International Women’s Day // Good Morning, InsightPact

Empowered Accountability: How to Scale a Team & Its Autonomy

A just leader: the biblical interpretation in modern day leadership

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Justin Warner

Justin Warner

Tech: Threat Intel | Photographer @

More from Medium

picoCTF Write-up

What is Red Teaming?

HackMyVM — Corrosion3

A call to action: it’s time for DAOscord