8.1: How accurate is the usage of OODA loops in terms of explaining a SOC function? What lessons can we learn from the military interpretation of OODA loops?
a. Use some of the following operational perspectives as a basis to think of the questions:
- Ingestion of raw data (e.g. raw intelligence feeds, telemetry)
- Processing of raw data
- Escalation chains
- Decision making in a SOC and whether the command structure supports decision making at strategic, tactical and operational levels.
- Ease of acting in a SOC
đź’ˇ Try to map these operational perspectives to the OODA loop 1. One way to view this topic is the speed of going through OODA loop steps, and being able to impede the adversary's OODA loop. However, in 2017, another paper written by Zager opines how the OODA loop should be viewed from a friction, rather than speed perspective (and debunks other OODA loop claims) 2. In particular, a closer reading of Zager's work suggests how part of the cyber offense paradigm also involves the impeding of an adversary's OODA loop, and looks at the exploitation of the need to think slowly and/or introduce seeds of doubt in the blue team's responses to achieve cyber offense outcomes3. Perhaps this hint expands the discussion topic much further than intended, but it also seeks to highlight the conceptual model that a successful offense is predicated on the ability to impede the response from the defenders, which may be a helpful way to think of this question too.
b. Re-read Chapter 6, particularly the sections on what AI can do in terms of cyber-offense. How do they relate to the attacker’s perspective and OODA loop?
đź’ˇ Many attackers are using AI to automate their own "Observe" and "Orient" phases. But perhaps very recently, we also observe how autonomous AI agents such as OpenAI's reward-hacking incident on Hugging Face in July 2026 could also be worth studying 4. Specifically, pay attention to the timeline of events and observe the actions the agents took to achieve their outcomes. Does this attack stand out because of the difference in attacker's perspective compared to other types of attacker motivations?
1 Richards, C. (2020). Boyd’s OODA loop. Necesse, 5(1), 142-165.
2 Zager, R., & Zager, J. (2017). OODA loops in cyberspace: A new cyber-defense model. j. Article, 21(12), 1-20.
3 Kahneman, Daniel. Thinking, Fast and Slow. New York: Farrar, Straus and Giroux, 2011.
4 Larcher, H., Carreira, A., G, R., & Christophe Rannou. (2026, July 27). Anatomy of a frontier lab agent intrusion: A technical timeline of the july 2026 incident. Hugging Face. Huggingface. https://huggingface.co/blog/agent-intrusion-technical-timeline
8.2: Purple teams combine iterative actions of red and blue teams. However, this is easier said than done. Often, the issues arise due to the conflicting nature of red teams and blue teams.
a. One such conflict is how red team findings are typically additions to a risk register/security management dashboard that requires the blue team to perform remediations. This working relationship in a security team is often asymmetrical and hence leads to tensions between red team and blue team. Describe how this could be resolved.
đź’ˇ Red teams are not system owners, unlike blue teams, that often have accountability over the cybersecurity posture of systems under their charge. Such an asymmetry in KPIs/OKRs is often a starter for tension.
b. Compare between the benefits of internal red teams and external red teams in the concepts of (i) building a purple team, (ii) providing breadth of coverage and (iii) providing value to an organization. You may find your answers differ depending on the sector your organization belongs to. Why would they differ?
đź’ˇ Internal red teams intimately know the business logic but might suffer from institutional bias, whereas external consultants bring fresh perspectives but cannot be integrated into a purple team construct as permanently. This relates to Part (a) due to a similar tension over the asymmetry in KPIs/OKRs too.
8.3: The cost of offense and cost of defense paradigm applies to the civilian world, just like the OODA loop.
a. How is this paradigm related to the discussion in the Build versus Buy discussion in Chapter 5? Think about how cost is being accounted for in terms of CAPEX versus OPEX, in terms of short-term expenditure versus long-term expenditure, as well as the cost of security as a percentage of relevant financial metrics in your organization (e.g. annual turnover, or annual profit)
đź’ˇ Perhaps the way that CFOs think about expenditure impact security far more than we think of. Suppose we look at a procurement strategy for cybersecurity capability. One factor that could impact whether a capability whose budget stretches across multiple years is whether the executive sponsor (e.g. the CFO) stays long enough to see through the sequential build-up. But requesting for spending to be front-loaded to avoid this problem means this could be at the expense of buying or building other capabilities.
b. Is the paradigm that security should be “optimized” from a financial angle valid? Look into the extent to which the financial angle can provide a quantitative risk picture, and assess risk items that cannot be quantized as such.
To challenge your thinking, research on the “value of human life” is an emerging area. For instance, there exists a Uganda case study on computing the direct and indirect costs of road crashes.5 In this paper, the researchers use methodologies including the “willingness-to-pay” (WTP) method and restitution cost (RC) method. We will not discuss such quantitative treatments in this book.
đź’ˇ What will financial angles miss, when it comes to cybersecurity risk? One example is the reputational risk that an organization may suffer from a breach, which impacts trust.
c. One way to optimize costs is through prioritizing the mitigations that should be applied. We can use an application security example from Snyk to illustrate an attack tree.6 View the example of a simplified attack tree of a physical safe. There are various methods to break into a safe. You could pick the lock (of the failsafe), or crack the code. You can then expand these into other conditions required to be fulfiled to break into such a safe.
Discuss how:
(i) This simple attack tree can be expanded to look into probabilistic outcomes (how likely is a branch going to be actualized?). How will concepts learnt in Chapter 5 potentially affect said probabilities?
(ii) How can the attack tree be expanded to examine costs incurred to secure an application, as well as a system? (Hint: Chapter 6 questions if simply STRIDE-LM as a threat modelling framework is sufficient. If it is not the case, how do we examine threats applications and systems face?)
đź’ˇ By attaching dollar values and probabilities to each branch of the attack tree, you can mathematically estimate how procurement of a security control can results in expected savings from a prevented breach. How does mapping real-world threat intelligence (from Chapter 5) change the risk picture on the attack tree?
5 Nankunda, C., & Evdorides, H. (2025). Data Availability for Road Crash Valuation in Low-and Middle-Income Countries: A Case Study in Uganda. Future Transportation, 5(1), 29.
6 Nemeth, G. (2016, August 31). Threat modelling For Node.js applications. Snyk. Link
8.4: We are likely to face resistance if we move the paradigm for breaches from a if to when paradigm. Let us explore an intuitive counter argument, following from Discussion 8.3.
a. Resistance can arise from a psychological tendency to treat zero risk and low risk differently. How does if to when fall under this tendency?
💡 How would you respond if a procedure is mentioned to you to have “guaranteed delivery”? Will you respond the same way if the same procedure (e.g. a tuition program) has a 1 percent chance of not delivering the intended outcome for a potentially life-changing examination?
b. Given such awareness, how would you steer this conversation?
đź’ˇ Instead of framing when as a failure of defense, frame it as a shift toward resilience. How do you convince a board that surviving a breach with zero downtime is a greater victory than pretending a breach will never happen? (An important piece of legislation is the Cyber Resilience Act 7.)
c. How does defense in depth (in Discussion 5.1) apply to this paradigm?
đź’ˇ Defense in depth perfectly aligns with the "when" paradigm because it assumes the outer perimeter will eventually fall. How do internal tripwires and segmentation ensure that a single compromise doesn't become a total disaster?
7 European Parliament. (2024). Regulation - 2024/2847 - HU - EUR-Lex. In Europa.eu. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847
8.5: We have mentioned about the 80/20 rule for cybersecurity. How would you classify security tasks with the 80/20 rule for:
a. Application security management: Think about the usage of libraries, and deployment of apps with CI/CD pipelines. Review Chapter 4 on MLSecOps, and Chapter 6 on Shai-Hulud.
đź’ˇ Consider looking at capabilities already inherent within an enterprise-level repository manager such as GitLab. What application security tools comes out of the box with GitLab?
b. Cloud security: Search for Cloud Security Alliance’s Egregious 11. Use that as the basis to carve out security stories/tasks in an 80/20 way.
💡 What are the top items in the Cloud Security Alliance’s Egregious 11? How do they relate to the basic security measures an organization can take?
c. Operational technology: In OT, processes are usually more important than data. In addition, many types of OT infrastructure are also classified as critical infrastructure, hence being subject to stricter regulation. What will the focus be on in such environments?
đź’ˇ Many OT environments' cybersecurity posture can be beefed up simply through proper segmentation to limit their blast radius. Why is this important and how is this consequential?
8.6: We have presented an example of a software company being targeted as part of a supply chain attack.
a. Supply chain attacks have had a renewed focus due to the term “reward hacking”. Research what “reward hacking” is and how it is relevant to supply chain cybersecurity.
đź’ˇ Given a task, what are all the possible ways of doing it? Say, start with doing homework.
b. In software companies, they must adequately secure software solutions sold, in addition to their own organization. Does this change the way they view cybersecurity ROI?
đź’ˇ A software company of this type protects not only their own data, but also clients' data and is subject to contractual liability.
c. How would this computation differ if the software company was a gaming company as opposed to a company selling back-end HR management software?
đź’ˇ A compromised game leads to direct revenue loss, but a compromised HR platform exposes highly regulated financial and personal data, resulting in regulatory penalties. How do these differ in liabilities?
8.7: In Chapter 6, we introduced the Zero Day Clock. One of the calls to action in the Zero Day Clock is to steer away from the patching paradigm and move towards the rebuilding paradigm.
a. Based on the Zero Day Clock, why is this an important call to action?
đź’ˇ Look at the mean time-to-exploit (TTE). What is the turning point here?
b. Based on the TTE statistics, what are the challenges vulnerability management teams face?
đź’ˇ How does a vulnerability management team survive when the window between a vulnerability disclosure and active exploitation drops from weeks to mere days?
c. How would this call to action affect the way software is designed?
💡 Read Heather Adkins’s comments on how Google designs resiliency. Think of how computing resources can be spun up quickly and destroyed quickly (i.e. ephemeral cloud architecture). What conditions are required for such software design?
d. Compare the threat model for such an architecture you have thought of in (c) to the likeliest architecture in on-premises environments. Use a TTP-based threat modeling methodology like MITRE ATT&CK, identify a theoretical kill chain and explain how Heather Adkin’s comments operationalize in the event of a compromise.
đź’ˇ In a legacy environment on-premises, an attacker establishes persistence (T1098). Persistence is for as long as the attacker manages to stay undetected as the infrastructure is kept as-is. However, in an ephemeral cloud architecture, persistence is only as long as the uptime of such resources8.
8 Note that the idea of ephemeral cloud architecture goes beyond the issue of breaking of an attacker kill chain. There are other advantages such as a cleaner environment for testing and easier drift management assuming that trusted golden images are kept maintainable.