Stay Left Of The Bang

Originally written on May 2021, updated Jan 2023.

Establish baselines. Look for anomalies. Have a plan.

The phrase “left of bang” refers to the attack timeline where “bang”, in the middle of that timeline, is the attack. Everything to the left of that is what happens before the attack, and the things on the right are what follows after the attack. Left of bang, or before the attack, is the time where we need to work our preventive measures and our defenses. Right of bang, or after the attack, is when reactive measures take place.

Left of Bang is where we need to strive to stay, proactively assessing, planning, and understanding the risks. In order to do so, we must be aware of our environment, test our assumptions, and place early warning alerts. All leading to the ability to disrupt or avoid things going bad.

Being proactive begins with being able to identify the dangers hiding in a crowd of normalcy.

Activities such as red teaming, table top exercises, and threat modeling can proactively detect these dangers, providing a way to act preemptively, and prepare the defenses and controls needed ahead of time. The more you put yourself in the shoes of an attacker and try to visualize what can go wrong, the better you'll get at it, and the more you’ll be ready when things do happen.

Training, repetition, and reassessment. There are many variables to take into account, but it starts with a simple question: what can go wrong?

Whatever approach you take to visualize, test, and answer that question, you'll quickly realize that there are constants, as well as variables, across the different approaches. Two of those constants are: humans and the environment.

Humans can be very unpredictable, especially when they are placed under incredible stress, or danger. The environment the humans operate in can also factor into that unpredictability, making the situation even more volatile. Knowing this, making the assumption that there will always be a threat then, is not a bad thing. Yes, assumptions are the mother of all fuckups, but in this case, assuming things will go wrong allows us to plan better, and to understand the threats we might face.

The target of that threat can be you, or the person next to you. The target can be a situation, or the manipulation of that specific situation. It can also be a system, a network, or a piece of software. It doesn’t matter if you don’t see it, there is a threat for each target you can identify.

Exercises like this can help prepare better prevention, applying the changes and controls needed to stay left of bang, or, if there is no way to stop this (you are in the bang), then you'll be ready to deal with it mentally and physically, knowing what to do ahead of time.

This is where the power of visualization comes in. Imagine the things that can go wrong, and imagine what you’d do to prevent them. What are the things needed to detect, block, and minimize those things from happening? Rehearse in your head the steps to understand how you’d detect things going wrong, and what you’d do. What are the signs, the tell-tales that indicate things boiling up to a bang. Practice and turn this into “muscle memory”. Bad actors can have a lot of reasons to target you. Bad things happen all the time because nature is chaotic. You cannot allow yourself to think that it will not happen to you.

You need to stay left of bang in order to make things work for you.

For a full study on being left of bang, and to learn how to detect early warning signs on people, read Left of Bang, by Patrick Van Horne, it's an incredibly well written book.