Account Policy Enforcement
- Mitigation M1036: Configure and enforce rules governing account usage
- Mitigation M1036: Implement lockout mechanisms for failed login attempts
- Mitigation M1036: Set session timeouts for inactive user accounts
- Mitigation M1036: Enforce password aging and reuse history rules
Directory Service Hardening
- Mitigation M1015: Secure user accounts using robust group policies
- Mitigation M1015: Restrict interactive logons for sensitive service accounts
- Mitigation M1015: Configure authentication silos for high risk accounts
Identity Verification Reinforcement
- Mitigation M1032: Require multiple verification forms to prove identity
- Mitigation M1032: Enforce MFA policies for all user logins
- Mitigation M1032: Use hardware tokens for additional authentication security
Administrative Account Management
- Mitigation M1026: Securely manage privileged accounts and administrative roles
- Mitigation M1026: Implement least privilege principles for allocated permissions
- Mitigation M1026: Grant time limited elevated permissions using JIT
Administrative Privilege Control
- Mitigation M1052: Prevent unauthorized changes to Windows operating systems
- Mitigation M1052: Prompt for credentials when actions require elevation
Malicious Software Detection
- Mitigation M1049: Detect block and remediate various malicious software
- Mitigation M1049: Use signatures to identify known malicious patterns
- Mitigation M1049: Employ behavioral analysis for detecting abnormal activities
Unauthorized Code Execution Prevention
- Mitigation M1038: Prevent execution of unauthorized or malicious code
- Mitigation M1038: Implement whitelists of authorized and trusted applications
- Mitigation M1038: Block script execution from untrusted network sources
Critical Process Defense
- Mitigation M1025: Defend privileged processes from tampering or compromise
- Mitigation M1025: Deploy tools that block process injection attempts
- Mitigation M1025: Enforce execution of signed binaries via policies
Operating System Hardening
- Mitigation M1028: Adjust settings to mitigate adversary system exploitation
- Mitigation M1028: Enable built-in memory protections and flow guards
- Mitigation M1028: Enforce strong permissions and least privilege access
Application Security Hardening
- Mitigation M1054: Adjust settings of applications to mitigate threats
- Mitigation M1054: Configure detailed logging for key application events
Secure Application Development
- Mitigation M1013: Integrate security throughout software development life cycles
- Mitigation M1013: Use parameterized queries to prevent injection attacks
- Mitigation M1013: Perform threat modeling during application design phases
Unnecessary Software Removal
- Mitigation M1042: Remove legacy software that lacks security updates
- Mitigation M1042: Disable unused operating system features and services
- Mitigation M1042: Restrict unneeded browser plugins and application add-ons
Software Installation Control
- Mitigation M1033: Prevent users from installing unauthorized unapproved software
- Mitigation M1033: Remove local administrator rights for general users
- Mitigation M1033: Maintain inventories of approved software across enterprises
- Hardware Usage Control
Hardware Usage Control
- Mitigation M1034: Prevent unauthorized users from installing external hardware
- Mitigation M1034: Use policies to disable USB mass storage
- Mitigation M1034: Monitor and block unapproved peripheral device drivers
Sensitive Information Encryption
- Mitigation M1041: Protect sensitive information at rest using encryption
- Mitigation M1041: Secure sensitive data in transit via HTTPS
- Mitigation M1041: Store application secrets in encrypted vault solutions
Sensitive Information Leak Prevention
- Mitigation M1057: Identify categorize and monitor sensitive data movement
- Mitigation M1057: Restrict unauthorized transmission of sensitive data formats
- Mitigation M1057: Monitor data in transit over unapproved channels
Critical Credential Protectionv
- Mitigation M1043: Restrict access to internal credential storage mechanisms
- Mitigation M1043: Isolate memory to prevent unauthorized credential dumping
- Mitigation M1043: Configure secure boot and memory protection features
Data Continuity and Restoration
- Mitigation M1053: Perform and securely store regular data backups
- Mitigation M1053: Protect backups using immutable and encrypted storage
- Mitigation M1053: Regularly validate backup integrity and restoration processes
Secure Remote Storage
- Mitigation M1029: Move critical data to secure off-host locations
- Mitigation M1029: Configure endpoints to forward logs to SIEMs
Network Access Restriction
- Mitigation M1035: Restrict access to resources to legitimate requirements
- Mitigation M1035: Deploy secure remote access and gateway solutions
- Mitigation M1035: Use firewalls to block traffic on subnets
Network Traffic Isolation
- Mitigation M1030: Divide networks into smaller and isolated segments
- Mitigation M1030: Host public facing services in isolated zones
- Mitigation M1030: Use microsegmentation to prevent lateral adversary movement
Encrypted Traffic Analysis
- Mitigation M1020: Decrypt encrypted network traffic for malicious content
- Mitigation M1020: Define rules to decrypt traffic for applications
Web Content Filtering
- Mitigation M1021: Filter web traffic categories and domain reputations
- Mitigation M1021: Implement DNS based filtering for malicious domains
