https://cybersecuritytracker.ai/defensive-actions?cat=cloudCurated cybersecurity news and vulnerability intelligence.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1040-T1486cst-defensive-M1040-T1486Behavior Prevention on Endpoint refers to the use of technologies and strategies to detect and block potentially malicious activities by analyzing the behavior of processes, files, API calls, and other endpoint events. Rather than relying solely on known signatures, this approach leverages heuristics, machine learning, and real-time monitoring to identify anomalous patterns indicative of an attack. This mitigation can be implemented through the following measures: Suspicious Process Behavior: Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1053-T1486cst-defensive-M1053-T1486Data Backup involves taking and securely storing backups of data from end-user systems and critical servers. It ensures that data remains available in the event of system compromise, ransomware attacks, or other disruptions. Backup processes should include hardening backup systems, implementing secure storage solutions, and keeping backups isolated from the corporate network to prevent compromise during active incidents. This mitigation can be implemented through the following measures: RegularSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1018-T1685cst-defensive-M1018-T1685User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures: Enforcing the Principle of Least Privilege - Implementation: Assign users only the minimumSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1022-T1685cst-defensive-M1022-T1685Restricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can reduce the attack surface for adversaries seeking to access sensitive data, plant malicious code, or tamper with system files. Enforce Least Privilege Permissions: - Remove unnecessary write permissions on sensitive files and directories. - Use file ownershipSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1024-T1685cst-defensive-M1024-T1685Restricting registry permissions involves configuring access control settings for sensitive registry keys and hives to ensure that only authorized users or processes can make modifications. By limiting access, organizations can prevent unauthorized changes that adversaries might use for persistence, privilege escalation, or defense evasion. This mitigation can be implemented through the following measures: Review and Adjust Permissions on Critical Keys - Regularly review permissions on keys suSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1038-T1685cst-defensive-M1038-T1685Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures: Application Control: - Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applicatSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1042-T1685cst-defensive-M1042-T1685Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures: Remove Legacy Software: - Use Case: Disable or remove older versions of software that no longer receive updates or secuSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1047-T1685cst-defensive-M1047-T1685Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures. Auditing is applicable to all systems usedSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1054-T1685cst-defensive-M1054-T1685Software configuration refers to making security-focused adjustments to the settings of applications, middleware, databases, or other software to mitigate potential threats. These changes help reduce the attack surface, enforce best practices, and protect sensitive data. This mitigation can be implemented through the following measures: Conduct a Security Review of Application Settings: - Review the software documentation to identify recommended security configurations. - Compare default settiSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1022-T1036-005cst-defensive-M1022-T1036-005Restricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can reduce the attack surface for adversaries seeking to access sensitive data, plant malicious code, or tamper with system files. Enforce Least Privilege Permissions: - Remove unnecessary write permissions on sensitive files and directories. - Use file ownershipSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1038-T1036-005cst-defensive-M1038-T1036-005Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures: Application Control: - Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applicatSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1045-T1036-005cst-defensive-M1045-T1036-005Code Signing is a security process that ensures the authenticity and integrity of software by digitally signing executables, scripts, and other code artifacts. It prevents untrusted or malicious code from executing by verifying the digital signatures against trusted sources. Code signing protects against tampering, impersonation, and distribution of unauthorized or malicious software, forming a critical defense against supply chain and software exploitation attacks. This mitigation can be implemSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1021-T1133cst-defensive-M1021-T1133Restricting web-based content involves enforcing policies and technologies that limit access to potentially malicious websites, unsafe downloads, and unauthorized browser behaviors. This can include URL filtering, download restrictions, script blocking, and extension control to protect against exploitation, phishing, and malware delivery. This mitigation can be implemented through the following measures: Deploy Web Proxy Filtering: - Use solutions to filter web traffic based on categories, repSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1030-T1133cst-defensive-M1030-T1133Network segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restrict lateral movement by adversaries, and protect critical assets from compromise. Effective network segmentation leverages a combination of physical boundaries, logical separation through VLANs, and access control policies enforced by network appliances like Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1032-T1133cst-defensive-M1032-T1133Multi-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include: - *Something you know*: Passwords, PINs. - *Something you have*: Physical tokens, smartphone authenticator apps. - *Something you are*: Biometric data such as fingerprints, facial recognition, or retinal scans. Implementing MFA across all critical systems and services ensures robust protection againSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1035-T1133cst-defensive-M1035-T1133Restrict access to network resources, such as file shares, remote systems, and services, to only those users, accounts, or systems with a legitimate business requirement. This can include employing technologies like network concentrators, RDP gateways, and zero-trust network access (ZTNA) models, alongside hardening services and protocols. This mitigation can be implemented through the following measures: Audit and Restrict Access: - Regularly audit permissions for file shares, network serviceSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1042-T1133cst-defensive-M1042-T1133Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures: Remove Legacy Software: - Use Case: Disable or remove older versions of software that no longer receive updates or secuSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1016-T1190cst-defensive-M1016-T1190Vulnerability scanning involves the automated or manual assessment of systems, applications, and networks to identify misconfigurations, unpatched software, or other security weaknesses. The process helps prioritize remediation efforts by classifying vulnerabilities based on risk and impact, reducing the likelihood of exploitation by adversaries. This mitigation can be implemented through the following measures: Proactive Identification of Vulnerabilities - Implementation: Use tools like NessSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1026-T1190cst-defensive-M1026-T1190Privileged Account Management focuses on implementing policies, controls, and tools to securely manage privileged accounts (e.g., SYSTEM, root, or administrative accounts). This includes restricting access, limiting the scope of permissions, monitoring privileged account usage, and ensuring accountability through logging and auditing.This mitigation can be implemented through the following measures: Account Permissions and Roles: - Implement RBAC and least privilege principles to allocate permSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1030-T1190cst-defensive-M1030-T1190Network segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restrict lateral movement by adversaries, and protect critical assets from compromise. Effective network segmentation leverages a combination of physical boundaries, logical separation through VLANs, and access control policies enforced by network appliances like Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1035-T1190cst-defensive-M1035-T1190Restrict access to network resources, such as file shares, remote systems, and services, to only those users, accounts, or systems with a legitimate business requirement. This can include employing technologies like network concentrators, RDP gateways, and zero-trust network access (ZTNA) models, alongside hardening services and protocols. This mitigation can be implemented through the following measures: Audit and Restrict Access: - Regularly audit permissions for file shares, network serviceSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1037-T1190cst-defensive-M1037-T1190Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1048-T1190cst-defensive-M1048-T1190Application Isolation and Sandboxing refers to the technique of restricting the execution of code to a controlled and isolated environment (e.g., a virtual environment, container, or sandbox). This method prevents potentially malicious code from affecting the rest of the system or network by limiting access to sensitive resources and critical operations. The goal is to contain threats and minimize their impact. This mitigation can be implemented through the following measures: Browser SandboxinSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1050-T1190cst-defensive-M1050-T1190Deploy capabilities that detect, block, and mitigate conditions indicative of software exploits. These capabilities aim to prevent exploitation by addressing vulnerabilities, monitoring anomalous behaviors, and applying exploit-mitigation techniques to harden systems and software. Operating System Exploit Protections: - Use Case: Enable built-in exploit protection features provided by modern operating systems, such as Microsoft's Exploit Protection, which includes techniques like Data ExecutioSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1051-T1190cst-defensive-M1051-T1190Software updates ensure systems are protected against known vulnerabilities by applying patches and upgrades provided by vendors. Regular updates reduce the attack surface and prevent adversaries from exploiting known security gaps. This includes patching operating systems, applications, drivers, and firmware. This mitigation can be implemented through the following measures: Regular Operating System Updates - Implementation: Apply the latest Windows security updates monthly using WSUS (WindowSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1030-T1046cst-defensive-M1030-T1046Network segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restrict lateral movement by adversaries, and protect critical assets from compromise. Effective network segmentation leverages a combination of physical boundaries, logical separation through VLANs, and access control policies enforced by network appliances like Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1031-T1046cst-defensive-M1031-T1046Use intrusion detection signatures to block traffic at network boundaries.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1042-T1046cst-defensive-M1042-T1046Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures: Remove Legacy Software: - Use Case: Disable or remove older versions of software that no longer receive updates or secuSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1018-T1078-003cst-defensive-M1018-T1078-003User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures: Enforcing the Principle of Least Privilege - Implementation: Assign users only the minimumSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1026-T1078-003cst-defensive-M1026-T1078-003Privileged Account Management focuses on implementing policies, controls, and tools to securely manage privileged accounts (e.g., SYSTEM, root, or administrative accounts). This includes restricting access, limiting the scope of permissions, monitoring privileged account usage, and ensuring accountability through logging and auditing.This mitigation can be implemented through the following measures: Account Permissions and Roles: - Implement RBAC and least privilege principles to allocate permSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1027-T1078-003cst-defensive-M1027-T1078-003Set and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse. This mitigation can be implemented through the following measures: Windows Systems: - Use Group Policy Management Console (GPMC) to configure: - Minimum password length (e.g., 12+ characters). - Password complexity requirements. - Password history (e.gSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1032-T1078-003cst-defensive-M1032-T1078-003Multi-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include: - *Something you know*: Passwords, PINs. - *Something you have*: Physical tokens, smartphone authenticator apps. - *Something you are*: Biometric data such as fingerprints, facial recognition, or retinal scans. Implementing MFA across all critical systems and services ensures robust protection againSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1018-T1021cst-defensive-M1018-T1021User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures: Enforcing the Principle of Least Privilege - Implementation: Assign users only the minimumSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1027-T1021cst-defensive-M1027-T1021Set and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse. This mitigation can be implemented through the following measures: Windows Systems: - Use Group Policy Management Console (GPMC) to configure: - Minimum password length (e.g., 12+ characters). - Password complexity requirements. - Password history (e.gSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1032-T1021cst-defensive-M1032-T1021Multi-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include: - *Something you know*: Passwords, PINs. - *Something you have*: Physical tokens, smartphone authenticator apps. - *Something you are*: Biometric data such as fingerprints, facial recognition, or retinal scans. Implementing MFA across all critical systems and services ensures robust protection againSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1035-T1021cst-defensive-M1035-T1021Restrict access to network resources, such as file shares, remote systems, and services, to only those users, accounts, or systems with a legitimate business requirement. This can include employing technologies like network concentrators, RDP gateways, and zero-trust network access (ZTNA) models, alongside hardening services and protocols. This mitigation can be implemented through the following measures: Audit and Restrict Access: - Regularly audit permissions for file shares, network serviceSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1042-T1021cst-defensive-M1042-T1021Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures: Remove Legacy Software: - Use Case: Disable or remove older versions of software that no longer receive updates or secuSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1047-T1021cst-defensive-M1047-T1021Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures. Auditing is applicable to all systems usedSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1017-T1036cst-defensive-M1017-T1036User Training involves educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques. Comprehensive training programs create a human firewall by empowering users to be an active component of the organization's cybersecurity defenses. This mitigation can be implemented through the following measures: Create Comprehensive Training Programs: - Design training modulSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1018-T1036cst-defensive-M1018-T1036User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures: Enforcing the Principle of Least Privilege - Implementation: Assign users only the minimumSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1022-T1036cst-defensive-M1022-T1036Restricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can reduce the attack surface for adversaries seeking to access sensitive data, plant malicious code, or tamper with system files. Enforce Least Privilege Permissions: - Remove unnecessary write permissions on sensitive files and directories. - Use file ownershipSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1038-T1036cst-defensive-M1038-T1036Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures: Application Control: - Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applicatSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1040-T1036cst-defensive-M1040-T1036Behavior Prevention on Endpoint refers to the use of technologies and strategies to detect and block potentially malicious activities by analyzing the behavior of processes, files, API calls, and other endpoint events. Rather than relying solely on known signatures, this approach leverages heuristics, machine learning, and real-time monitoring to identify anomalous patterns indicative of an attack. This mitigation can be implemented through the following measures: Suspicious Process Behavior: Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1045-T1036cst-defensive-M1045-T1036Code Signing is a security process that ensures the authenticity and integrity of software by digitally signing executables, scripts, and other code artifacts. It prevents untrusted or malicious code from executing by verifying the digital signatures against trusted sources. Code signing protects against tampering, impersonation, and distribution of unauthorized or malicious software, forming a critical defense against supply chain and software exploitation attacks. This mitigation can be implemSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1047-T1036cst-defensive-M1047-T1036Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures. Auditing is applicable to all systems usedSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1049-T1036cst-defensive-M1049-T1036Antivirus/Antimalware solutions utilize signatures, heuristics, and behavioral analysis to detect, block, and remediate malicious software, including viruses, trojans, ransomware, and spyware. These solutions continuously monitor endpoints and systems for known malicious patterns and suspicious behaviors that indicate compromise. Antivirus/Antimalware software should be deployed across all devices, with automated updates to ensure protection against the latest threats. This mitigation can be impSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1018-T1040cst-defensive-M1018-T1040User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures: Enforcing the Principle of Least Privilege - Implementation: Assign users only the minimumSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1030-T1040cst-defensive-M1030-T1040Network segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restrict lateral movement by adversaries, and protect critical assets from compromise. Effective network segmentation leverages a combination of physical boundaries, logical separation through VLANs, and access control policies enforced by network appliances like Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1032-T1040cst-defensive-M1032-T1040Multi-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include: - *Something you know*: Passwords, PINs. - *Something you have*: Physical tokens, smartphone authenticator apps. - *Something you are*: Biometric data such as fingerprints, facial recognition, or retinal scans. Implementing MFA across all critical systems and services ensures robust protection againSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1041-T1040cst-defensive-M1041-T1040Protect sensitive information at rest, in transit, and during processing by using strong encryption algorithms. Encryption ensures the confidentiality and integrity of data, preventing unauthorized access or tampering. This mitigation can be implemented through the following measures: Encrypt Data at Rest: - Use Case: Use full-disk encryption or file-level encryption to secure sensitive data stored on devices. - Implementation: Implement BitLocker for Windows systems or FileVault for macOS devSun, 26 Jul 2026 22:05:07 GMT