User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies.

• Implementation: Assign users only the minimum permissions required to perform their job functions. Regularly audit accounts to ensure no excess permissions are granted.
• Use Case: Reduces the risk of privilege escalation by ensuring accounts cannot perform unauthorized actions. Implementing Strong Password Policies.
• Implementation: Enforce password complexity requirements (e.g., length, character types). Require password expiration every 90 days and disallow password reuse.
• Use Case: Prevents adversaries from gaining unauthorized access through password guessing or brute force attacks. Managing Dormant and Orphaned Accounts.
• Implementation: Implement automated workflows to disable accounts after a set period of inactivity (e.g., 30 days). Remove orphaned accounts (e.g., accounts without an assigned owner) during regular account audits.
• Use Case: Eliminates dormant accounts that could be exploited by attackers. Account Lockout Policies.
• Implementation: Configure account lockout thresholds (e.g., lock accounts after five failed login attempts). Set lockout durations to a minimum of 15 minutes.
• Use Case: Mitigates automated attack techniques that rely on repeated login attempts. Multi-Factor Authentication (MFA) for High-Risk Accounts.
• Implementation: Require MFA for all administrative accounts and high-risk users. Use MFA mechanisms like hardware tokens, authenticator apps, or biometrics.
• Use Case: Prevents unauthorized access, even if credentials are stolen. Restricting Interactive Logins.
• Implementation: Restrict interactive logins for privileged accounts to specific secure systems or management consoles. Use group policies to enforce logon restrictions.
• Use Case: Protects sensitive accounts from misuse or exploitation.

• Microsoft Active Directory (AD): Centralized account management and RBAC enforcement.
• Group Policy Object (GPO): Enforce password policies, logon restrictions, and account lockout policies.

• Okta: Centralized user provisioning, MFA, and SSO integration.
• Microsoft Azure Active Directory: Provides advanced account lifecycle management, role-based access, and conditional access policies.

• CyberArk, BeyondTrust, Thycotic: Manage and monitor privileged account usage, enforce session recording, and JIT access.

Software configuration refers to making security-focused adjustments to the settings of applications, middleware, databases, or other software to mitigate potential threats. These changes help reduce the attack surface, enforce best practices, and protect sensitive data.

• Review the software documentation to identify recommended security configurations.
• Compare default settings against organizational policies and compliance requirements.

• Restrict access to sensitive features or data within the software.
• Enforce least privilege principles for all roles and accounts interacting with the software.

• Configure detailed logging for key application events such as authentication failures, configuration changes, or unusual activity.
• Integrate logs with a centralized monitoring solution, such as a SIEM.

• Ensure the software is kept up-to-date with the latest security patches to address known vulnerabilities.
• Use automated patch management tools to streamline the update process.

• Turn off unused functionality or components that could introduce vulnerabilities, such as debugging interfaces or deprecated APIs.

• Perform configuration changes in a staging environment before applying them in production.
• Conduct regular audits to ensure that settings remain aligned with security policies.

• Ansible: Automates configuration changes across multiple applications and environments.
• Chef: Ensures consistent application settings through code-based configuration management.
• Puppet: Automates software configurations and audits changes for compliance.

• CIS-CAT: Provides benchmarks and audits for secure software configurations.
• Aqua Security Trivy: Scans containerized applications for configuration issues.

• Nessus: Identifies misconfigurations and suggests corrective actions.

• Splunk: Aggregates and analyzes application logs to detect suspicious activity.