Organizations today are battling three compounding challenges: complex cyberattacks that shift as they unfold, complicated technology environments and a fast-growing skills gap. As a result, technologies and processes that enable a dynamic, fast and orchestrated response are becoming vital.

IBM Resilient has many enterprise deployments around the world spanning just about every industry. One trend we’ve been expecting and are now starting to see is that more advanced companies are working hard to orchestrate their incident response (IR) and improve their general security operations. The obvious goal is to accelerate response processes and get ahead of attackers.

Earlier this week, we announced our latest advanced orchestration capabilities.

OODA Loops in Security

When we designed Resilient, one of our steering principles was adopted from the military, where it has been battle-tested — literally. That concept is called OODA loops. If you Google the term, you’ll see that Bruce Schneier, our chief technology officer (CTO) at IBM Resilient, has long discussed the applicability of OODA loops to incident response. As IR technology matures, orchestration brings the concept into real-world application.

OODA loops — which stands for observe, orient, decide and act — is a combat method originally developed by a U.S. Air Force colonel to help fighter pilots be more successful in dogfights. It essentially describes all the steps a pilot needs to execute to defeat his or her adversary in the form of continuous loops: observing their environment, orienting that data for context with other information at their disposal, deciding what to do and, finally, acting accordingly. If the pilot could do this faster than the enemy, or slow down the enemy’s ability to execute their loops, he or she would gain an enormous advantage. Pilots were trained to execute this successfully and planes, including the F16, were redesigned to support them. The results were dramatic.

The OODA technique has become a standard combat method in most of the military and is now finding its way into commerce. It was an appropriate way for us to look at system design when we created Resilient. Incident response is becoming more like real-time combat with cybercriminals, and security professionals should view incident response orchestration as a series of OODA loops that need to be executed as fast as possible.

Orchestration in Action

When implemented effectively, orchestration can deliver dramatic time savings. Here’s an example: One global company we work with faced challenges with the speed of its incident response at scale, which was too manual, slow and disjointed. Many parts of its processes, particularly in the orient stage, took analysts up to 10 minutes each to complete. By the company’s calculations, one particular and common type of incident took more than 80 minutes on average to close out.

To accelerate its response, the company began the process of orchestration. Based on Resilient as the security orchestration, automation, and response (SOAR) platform and some straightforward integrations, the organization now has a central hub to assign responsibilities, manage runbooks, coordinate tasks and automate appropriate steps. Analysts can complete certain tasks with the click of a button and fully automate triage and enrichment with a high level of fidelity. Responders get critical information faster and exactly when they need it. As a result, the average time to resolve that 80-minute incident plummeted to an impressive one minute.

Learn how IBM Resilient’s latest features can help orchestrate your incident response and request more information or a live demo today.

More from Incident Response

Poor Communication During a Data Breach Can Cost You — Here’s How to Avoid It

5 min read - No one needs to tell you that data breaches are costly. That data has been quantified and the numbers are staggering. In fact, the IBM Security Cost of a Data Breach estimates that the average cost of a data breach in 2022 was $4.35 million, with 83% of organizations experiencing one or more security incidents. But what’s talked about less often (and we think should be talked about more) is how communication — both good and bad — factors into…

5 min read

Ransomware Renaissance 2023: The Definitive Guide to Stay Safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

2 min read

Expert Insights on the X-Force Threat Intelligence Index

5 min read - Top insights are in from this year’s IBM Security X-Force Threat Intelligence Index, but what do they mean? Three IBM Security X-Force experts share their thoughts on the implications of the most pressing cybersecurity threats, and offer guidance for what organizations can do to better protect themselves. Moving Left of Boom: Early Backdoor Detection Andy Piazza, Global Head of Threat Intelligence at IBM Security X-Force, sat down with Security Intelligence to chat with us about the rise in the deployment…

5 min read

How Morris Worm Command and Control Changed Cybersecurity

4 min read - A successful cyberattack requires more than just gaining entry into a victim’s network. To truly reap the rewards, attackers must maintain a persistent presence within the system. After establishing communication with other compromised network devices, actors can stealthily extract valuable data. The key to all this is a well-developed Command and Control (C2 or C&C) infrastructure. The number of C2 servers used for launching cyberattacks increased by 30% in 2022. More than 17,000 of these servers were detected last year,…

4 min read