M1036Account Use Policies
Reduce brute-force and abuse with account lockout, logon time/location restrictions, and concurrent session limits.
Account Lockout / Logon PolicyWindowsLinuxIdentity
TA0001Defense Plan
Initial Access
Gaining initial access to the network/system
M1013Application Developer Guidance
Reducing application-layer vulnerabilities at the source through secure development practices.
ZT: verify explicitlySecure SDLCCloudWebMobile
Credential Exposure Monitoring (Dark Web)
Monitoring credential exposure in breach databases, paste sites, and dark web forums; over 30% of initial accesses use previously stolen credentials.
ZT: assume breachThreat Intel / Credential MonitoringCloudIdentity
Email Security Gateway with Anti-Phishing
Layered phishing defense combining email authentication (SPF/DKIM/DMARC) and content protection (Defender for Office 365).
ZT: verify explicitlyEmail Gateway / DMARCWindowsLinuxmacOSCloud
M1050Exploit Protection
Platform protections (DEP, ASLR, CFG, CET) that block memory corruption and exploitation techniques.
ZT: assume breachExploit MitigationWindowsLinuxmacOS
M1037Filter Network Traffic
Restricting inbound/outbound traffic with default-deny filtering, egress control, and anti-spoofing (uRPF/BCP38).
ZT: verify explicitlyFirewall / Egress FilteringNetworkCloud
Incident Response Plan and Tabletop Exercises
A formal incident response plan aligned with SANS PICERL and NIST SP 800-61; organizations with a tested IR plan contain incidents 3x faster.
ZT: assume breachIR Program / CSIRTWindowsLinuxmacOSCloud
M1032Multi-factor Authentication
Multi-factor authentication that stops the vast majority of password-based attacks; enforced in Entra via Conditional Access.
ZT: verify explicitlyConditional Access / IAMWindowsIdentity
M1031Network Intrusion Prevention
IDS/IPS that detects and blocks known malicious patterns and anomalies in network traffic, with proper sensor placement.
ZT: assume breachIDS/IPSNetwork
M1026Privileged Account Management
Keep the number and use of privileged accounts to a minimum: Domain Admins hygiene, LAPS, JIT/PIM.
ZT: least privilegePAM / Tiered AdminWindowsLinuxIdentityCloud
M1021Restrict Web-Based Content
Narrows egress channels with DNS hardening (protective DNS/RPZ + sinkhole) and web proxy/filtering.
ZT: verify explicitlyWeb/DNS FilteringWindowsLinuxmacOSNetwork
Secure by Design Procurement Controls
Requiring Secure by Design / Secure by Default products from vendors; the CISA initiative shifts security responsibility to the manufacturer.
ZT: verify explicitlyProcurement / GovernanceWindowsLinuxCloud
M1051Update Software
Closing the exploitation surface by timely patching of known vulnerabilities; eliminates one of the most common origins of breaches.
Vulnerability & Patch ManagementWindowsLinuxmacOSNetworkCloud
M1017User Training
Reducing human-originated risk by training users on phishing, social engineering, and secure behavior.
Security Awareness ProgramWindowsLinuxmacOSIdentityCloud
M1016Vulnerability Scanning
Regular internal/external scanning and external attack surface management to find vulnerabilities before attackers do.
Vulnerability ManagementNetworkWindowsLinuxCloud
Zero Trust Architecture
A least-privilege architecture that rejects the assumption of a trusted internal network and verifies every access request by identity, device, and context.
ZT: verify explicitlyZero Trust / ZTNAWindowsLinuxmacOSCloudIdentity