https://cybersecuritytracker.ai/defensive-actions?cat=email-m365Curated cybersecurity news and vulnerability intelligence.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1017-T1657cst-defensive-M1017-T1657User Training involves educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques. Comprehensive training programs create a human firewall by empowering users to be an active component of the organization's cybersecurity defenses. This mitigation can be implemented through the following measures: Create Comprehensive Training Programs: - Design training modulSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1018-T1657cst-defensive-M1018-T1657User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures: Enforcing the Principle of Least Privilege - Implementation: Assign users only the minimumSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1018-T1048cst-defensive-M1018-T1048User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures: Enforcing the Principle of Least Privilege - Implementation: Assign users only the minimumSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1022-T1048cst-defensive-M1022-T1048Restricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can reduce the attack surface for adversaries seeking to access sensitive data, plant malicious code, or tamper with system files. Enforce Least Privilege Permissions: - Remove unnecessary write permissions on sensitive files and directories. - Use file ownershipSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1030-T1048cst-defensive-M1030-T1048Network segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restrict lateral movement by adversaries, and protect critical assets from compromise. Effective network segmentation leverages a combination of physical boundaries, logical separation through VLANs, and access control policies enforced by network appliances like Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1031-T1048cst-defensive-M1031-T1048Use intrusion detection signatures to block traffic at network boundaries.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1037-T1048cst-defensive-M1037-T1048Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1057-T1048cst-defensive-M1057-T1048Data Loss Prevention (DLP) involves implementing strategies and technologies to identify, categorize, monitor, and control the movement of sensitive data within an organization. This includes protecting data formats indicative of Personally Identifiable Information (PII), intellectual property, or financial data from unauthorized access, transmission, or exfiltration. DLP solutions integrate with network, endpoint, and cloud platforms to enforce security policies and prevent accidental or maliciSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1017-T1213-002cst-defensive-M1017-T1213-002User Training involves educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques. Comprehensive training programs create a human firewall by empowering users to be an active component of the organization's cybersecurity defenses. This mitigation can be implemented through the following measures: Create Comprehensive Training Programs: - Design training modulSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1018-T1213-002cst-defensive-M1018-T1213-002User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures: Enforcing the Principle of Least Privilege - Implementation: Assign users only the minimumSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1047-T1213-002cst-defensive-M1047-T1213-002Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures. Auditing is applicable to all systems usedSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1018-T1537cst-defensive-M1018-T1537User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures: Enforcing the Principle of Least Privilege - Implementation: Assign users only the minimumSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1037-T1537cst-defensive-M1037-T1537Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1054-T1537cst-defensive-M1054-T1537Software configuration refers to making security-focused adjustments to the settings of applications, middleware, databases, or other software to mitigate potential threats. These changes help reduce the attack surface, enforce best practices, and protect sensitive data. This mitigation can be implemented through the following measures: Conduct a Security Review of Application Settings: - Review the software documentation to identify recommended security configurations. - Compare default settiSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1057-T1537cst-defensive-M1057-T1537Data Loss Prevention (DLP) involves implementing strategies and technologies to identify, categorize, monitor, and control the movement of sensitive data within an organization. This includes protecting data formats indicative of Personally Identifiable Information (PII), intellectual property, or financial data from unauthorized access, transmission, or exfiltration. DLP solutions integrate with network, endpoint, and cloud platforms to enforce security policies and prevent accidental or maliciSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1022-T1070cst-defensive-M1022-T1070Restricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can reduce the attack surface for adversaries seeking to access sensitive data, plant malicious code, or tamper with system files. Enforce Least Privilege Permissions: - Remove unnecessary write permissions on sensitive files and directories. - Use file ownershipSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1029-T1070cst-defensive-M1029-T1070Remote Data Storage focuses on moving critical data, such as security logs and sensitive files, to secure, off-host locations to minimize unauthorized access, tampering, or destruction by adversaries. By leveraging remote storage solutions, organizations enhance the protection of forensic evidence, sensitive information, and monitoring data. This mitigation can be implemented through the following measures: Centralized Log Management: - Configure endpoints to forward security logs to a centralSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1041-T1070cst-defensive-M1041-T1070Protect sensitive information at rest, in transit, and during processing by using strong encryption algorithms. Encryption ensures the confidentiality and integrity of data, preventing unauthorized access or tampering. This mitigation can be implemented through the following measures: Encrypt Data at Rest: - Use Case: Use full-disk encryption or file-level encryption to secure sensitive data stored on devices. - Implementation: Implement BitLocker for Windows systems or FileVault for macOS devSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1032-T1114cst-defensive-M1032-T1114Multi-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include: - *Something you know*: Passwords, PINs. - *Something you have*: Physical tokens, smartphone authenticator apps. - *Something you are*: Biometric data such as fingerprints, facial recognition, or retinal scans. Implementing MFA across all critical systems and services ensures robust protection againSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1041-T1114cst-defensive-M1041-T1114Protect sensitive information at rest, in transit, and during processing by using strong encryption algorithms. Encryption ensures the confidentiality and integrity of data, preventing unauthorized access or tampering. This mitigation can be implemented through the following measures: Encrypt Data at Rest: - Use Case: Use full-disk encryption or file-level encryption to secure sensitive data stored on devices. - Implementation: Implement BitLocker for Windows systems or FileVault for macOS devSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1047-T1114cst-defensive-M1047-T1114Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures. Auditing is applicable to all systems usedSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1060-T1114cst-defensive-M1060-T1114Establish secure out-of-band communication channels to ensure the continuity of critical communications during security incidents, data integrity attacks, or in-network communication failures. Out-of-band communication refers to using an alternative, separate communication path that is not dependent on the potentially compromised primary network infrastructure. This method can include secure messaging apps, encrypted phone lines, satellite communications, or dedicated emergency communication sysSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1032-T1114-002cst-defensive-M1032-T1114-002Multi-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include: - *Something you know*: Passwords, PINs. - *Something you have*: Physical tokens, smartphone authenticator apps. - *Something you are*: Biometric data such as fingerprints, facial recognition, or retinal scans. Implementing MFA across all critical systems and services ensures robust protection againSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1041-T1114-002cst-defensive-M1041-T1114-002Protect sensitive information at rest, in transit, and during processing by using strong encryption algorithms. Encryption ensures the confidentiality and integrity of data, preventing unauthorized access or tampering. This mitigation can be implemented through the following measures: Encrypt Data at Rest: - Use Case: Use full-disk encryption or file-level encryption to secure sensitive data stored on devices. - Implementation: Implement BitLocker for Windows systems or FileVault for macOS devSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1060-T1114-002cst-defensive-M1060-T1114-002Establish secure out-of-band communication channels to ensure the continuity of critical communications during security incidents, data integrity attacks, or in-network communication failures. Out-of-band communication refers to using an alternative, separate communication path that is not dependent on the potentially compromised primary network infrastructure. This method can include secure messaging apps, encrypted phone lines, satellite communications, or dedicated emergency communication sysSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1029-T1119cst-defensive-M1029-T1119Remote Data Storage focuses on moving critical data, such as security logs and sensitive files, to secure, off-host locations to minimize unauthorized access, tampering, or destruction by adversaries. By leveraging remote storage solutions, organizations enhance the protection of forensic evidence, sensitive information, and monitoring data. This mitigation can be implemented through the following measures: Centralized Log Management: - Configure endpoints to forward security logs to a centralSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1041-T1119cst-defensive-M1041-T1119Protect sensitive information at rest, in transit, and during processing by using strong encryption algorithms. Encryption ensures the confidentiality and integrity of data, preventing unauthorized access or tampering. This mitigation can be implemented through the following measures: Encrypt Data at Rest: - Use Case: Use full-disk encryption or file-level encryption to secure sensitive data stored on devices. - Implementation: Implement BitLocker for Windows systems or FileVault for macOS devSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1017-T1213cst-defensive-M1017-T1213User Training involves educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques. Comprehensive training programs create a human firewall by empowering users to be an active component of the organization's cybersecurity defenses. This mitigation can be implemented through the following measures: Create Comprehensive Training Programs: - Design training modulSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1018-T1213cst-defensive-M1018-T1213User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures: Enforcing the Principle of Least Privilege - Implementation: Assign users only the minimumSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1032-T1213cst-defensive-M1032-T1213Multi-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include: - *Something you know*: Passwords, PINs. - *Something you have*: Physical tokens, smartphone authenticator apps. - *Something you are*: Biometric data such as fingerprints, facial recognition, or retinal scans. Implementing MFA across all critical systems and services ensures robust protection againSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1041-T1213cst-defensive-M1041-T1213Protect sensitive information at rest, in transit, and during processing by using strong encryption algorithms. Encryption ensures the confidentiality and integrity of data, preventing unauthorized access or tampering. This mitigation can be implemented through the following measures: Encrypt Data at Rest: - Use Case: Use full-disk encryption or file-level encryption to secure sensitive data stored on devices. - Implementation: Implement BitLocker for Windows systems or FileVault for macOS devSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1047-T1213cst-defensive-M1047-T1213Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures. Auditing is applicable to all systems usedSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1054-T1213cst-defensive-M1054-T1213Software configuration refers to making security-focused adjustments to the settings of applications, middleware, databases, or other software to mitigate potential threats. These changes help reduce the attack surface, enforce best practices, and protect sensitive data. This mitigation can be implemented through the following measures: Conduct a Security Review of Application Settings: - Review the software documentation to identify recommended security configurations. - Compare default settiSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1060-T1213cst-defensive-M1060-T1213Establish secure out-of-band communication channels to ensure the continuity of critical communications during security incidents, data integrity attacks, or in-network communication failures. Out-of-band communication refers to using an alternative, separate communication path that is not dependent on the potentially compromised primary network infrastructure. This method can include secure messaging apps, encrypted phone lines, satellite communications, or dedicated emergency communication sysSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1018-T1530cst-defensive-M1018-T1530User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures: Enforcing the Principle of Least Privilege - Implementation: Assign users only the minimumSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1022-T1530cst-defensive-M1022-T1530Restricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can reduce the attack surface for adversaries seeking to access sensitive data, plant malicious code, or tamper with system files. Enforce Least Privilege Permissions: - Remove unnecessary write permissions on sensitive files and directories. - Use file ownershipSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1032-T1530cst-defensive-M1032-T1530Multi-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include: - *Something you know*: Passwords, PINs. - *Something you have*: Physical tokens, smartphone authenticator apps. - *Something you are*: Biometric data such as fingerprints, facial recognition, or retinal scans. Implementing MFA across all critical systems and services ensures robust protection againSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1037-T1530cst-defensive-M1037-T1530Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1041-T1530cst-defensive-M1041-T1530Protect sensitive information at rest, in transit, and during processing by using strong encryption algorithms. Encryption ensures the confidentiality and integrity of data, preventing unauthorized access or tampering. This mitigation can be implemented through the following measures: Encrypt Data at Rest: - Use Case: Use full-disk encryption or file-level encryption to secure sensitive data stored on devices. - Implementation: Implement BitLocker for Windows systems or FileVault for macOS devSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1047-T1530cst-defensive-M1047-T1530Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures. Auditing is applicable to all systems usedSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1021-T1567cst-defensive-M1021-T1567Restricting web-based content involves enforcing policies and technologies that limit access to potentially malicious websites, unsafe downloads, and unauthorized browser behaviors. This can include URL filtering, download restrictions, script blocking, and extension control to protect against exploitation, phishing, and malware delivery. This mitigation can be implemented through the following measures: Deploy Web Proxy Filtering: - Use solutions to filter web traffic based on categories, repSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1057-T1567cst-defensive-M1057-T1567Data Loss Prevention (DLP) involves implementing strategies and technologies to identify, categorize, monitor, and control the movement of sensitive data within an organization. This includes protecting data formats indicative of Personally Identifiable Information (PII), intellectual property, or financial data from unauthorized access, transmission, or exfiltration. DLP solutions integrate with network, endpoint, and cloud platforms to enforce security policies and prevent accidental or maliciSun, 26 Jul 2026 22:05:07 GMT