Cloud Access Security Broker (CASB)
Visibility and control over SaaS/cloud application usage; OAuth application and data flow monitoring (Defender for Cloud Apps).
ZT: verify explicitlyCASB / SaaS SecurityCloudWindowsmacOS
TA0009Defense Plan
Collection
Collecting target data
Data Classification and Rights Management
Data classification and enterprise information rights management (IRM); controls access to sensitive data and prevents unauthorized exfiltration. Foundational to DLP.
ZT: verify explicitlyData Classification / IRMWindowsCloud
M1057Data Loss Prevention
DLP controls that detect and block sensitive data from exiting through unauthorized channels.
ZT: assume breachDLP PolicyWindowsmacOSCloudNetworkSaaS
M1041Encrypt Sensitive Information
Encrypting sensitive data at rest and in transit so it cannot be used even if stolen.
ZT: assume breachEncryption PolicyWindowsLinuxmacOSCloudNetwork