User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies.

• Implementation: Assign users only the minimum permissions required to perform their job functions. Regularly audit accounts to ensure no excess permissions are granted.
• Use Case: Reduces the risk of privilege escalation by ensuring accounts cannot perform unauthorized actions. Implementing Strong Password Policies.
• Implementation: Enforce password complexity requirements (e.g., length, character types). Require password expiration every 90 days and disallow password reuse.
• Use Case: Prevents adversaries from gaining unauthorized access through password guessing or brute force attacks. Managing Dormant and Orphaned Accounts.
• Implementation: Implement automated workflows to disable accounts after a set period of inactivity (e.g., 30 days). Remove orphaned accounts (e.g., accounts without an assigned owner) during regular account audits.
• Use Case: Eliminates dormant accounts that could be exploited by attackers. Account Lockout Policies.
• Implementation: Configure account lockout thresholds (e.g., lock accounts after five failed login attempts). Set lockout durations to a minimum of 15 minutes.
• Use Case: Mitigates automated attack techniques that rely on repeated login attempts. Multi-Factor Authentication (MFA) for High-Risk Accounts.
• Implementation: Require MFA for all administrative accounts and high-risk users. Use MFA mechanisms like hardware tokens, authenticator apps, or biometrics.
• Use Case: Prevents unauthorized access, even if credentials are stolen. Restricting Interactive Logins.
• Implementation: Restrict interactive logins for privileged accounts to specific secure systems or management consoles. Use group policies to enforce logon restrictions.
• Use Case: Protects sensitive accounts from misuse or exploitation.

• Microsoft Active Directory (AD): Centralized account management and RBAC enforcement.
• Group Policy Object (GPO): Enforce password policies, logon restrictions, and account lockout policies.

• Okta: Centralized user provisioning, MFA, and SSO integration.
• Microsoft Azure Active Directory: Provides advanced account lifecycle management, role-based access, and conditional access policies.

• CyberArk, BeyondTrust, Thycotic: Manage and monitor privileged account usage, enforce session recording, and JIT access.

Restricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can reduce the attack surface for adversaries seeking to access sensitive data, plant malicious code, or tamper with system files.

• Remove unnecessary write permissions on sensitive files and directories.
• Use file ownership and groups to control access for specific roles. Example (Windows): Right-click the shared folder.
• Properties.
• Security tab.
• Adjust permissions for NTFS ACLs.

• Disable anonymous access to shared folders.
• Enforce NTFS permissions for shared folders on Windows. Example: Set permissions to restrict write access to critical files, such as system executables (e.g., /bin or /sbin on Linux). Use tools like chown and chmod to assign file ownership and limit access. On Linux, apply: chmod 750 /etc/sensitive.conf `chown root:admin /etc/sensitive.

• Use tools like Tripwire, Wazuh, or OSSEC to monitor changes to critical file permissions.

• Enable auditing to track permission changes or unauthorized access attempts.
• Use auditd (Linux) or Event Viewer (Windows) to log activities.

• Configure permissions to prevent unauthorized writes to directories like C:\ProgramData\Microsoft\Windows\Start Menu. Example: Restrict write access to critical directories like /etc/, /usr/local/, and Windows directories such as C:\Windows\System32.
• On Windows, use icacls to modify permissions: icacls "C:\Windows\System32" /inheritance:r /grant:r SYSTEM:(OI)(CI)F.
• On Linux, monitor permissions using tools like lsattr or auditd.

Restricting registry permissions involves configuring access control settings for sensitive registry keys and hives to ensure that only authorized users or processes can make modifications. By limiting access, organizations can prevent unauthorized changes that adversaries might use for persistence, privilege escalation, or defense evasion.

• Regularly review permissions on keys such as Run, RunOnce, and Services to ensure only authorized users have write access.
• Use tools like icacls or PowerShell to automate permission adjustments. Enable Registry Auditing.
• Enable auditing on sensitive keys to log access attempts.
• Use Event Viewer or SIEM solutions to analyze logs and detect suspicious activity.
• Example Audit Policy: auditpol /set /subcategory:"Registry" /success:enable /failure:enable Protect Credential-Related Hives.
• Limit access to hives like SAM,SECURITY, and SYSTEM to prevent credential dumping or other unauthorized access.
• Use LSA Protection to add an additional security layer for credential storage. Restrict Registry Editor Usage.
• Use Group Policy to restrict access to regedit.exe for non-administrative users.
• Block execution of registry editing tools on endpoints where they are unnecessary. Deploy Baseline Configuration Tools.
• Use tools like Microsoft Security Compliance Toolkit or CIS Benchmarks to apply and maintain secure registry configurations.

• Registry Editor (regedit): Built-in tool to manage registry permissions.
• PowerShell: Automate permissions and manage keys. Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "KeyName" -Value "Value".
• icacls: Command-line tool to modify ACLs.

• Sysmon: Monitor and log registry events.
• Event Viewer: View registry access logs.

• Group Policy Management Console (GPMC): Enforce registry permissions via GPOs.
• Microsoft Endpoint Manager: Deploy configuration baselines for registry permissions.

Privileged Process Integrity focuses on defending highly privileged processes (e.g., system services, antivirus, or authentication processes) from tampering, injection, or compromise by adversaries. These processes often interact with critical components, making them prime targets for techniques like code injection, privilege escalation, and process manipulation.

• Enable RunAsPPL on Windows systems to protect LSASS and other critical processes.
• Use registry modifications to enforce protected process settings: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL Anti-Injection and Memory Protection:.
• Enable Control Flow Guard (CFG), DEP, and ASLR to protect against process memory tampering.
• Deploy endpoint protection tools that actively block process injection attempts.

• Implement policies for Windows Defender Application Control (WDAC) or AppLocker to enforce execution of signed binaries.
• Ensure critical processes are signed with valid certificates.

• Use DACLs and MIC to limit which users and processes can interact with privileged processes.
• Disable unnecessary debugging capabilities for high-privileged processes.

• Ensure Kernel Patch Protection (PatchGuard) is enabled on Windows systems.
• Leverage SELinux or AppArmor on Linux to enforce kernel-level security policies.

• RunAsPPL (Windows)

• Windows Defender Application Control (WDAC)
• AppLocker.

• Control Flow Guard (CFG), Data Execution Prevention (DEP), ASLR Process Isolation/Sandboxing:.
• Firejail (Linux Sandbox)
• Windows Sandbox.

• PatchGuard (Windows Kernel Patch Protection)
• SELinux (Mandatory Access Control for Linux)
• AppArmor.

Privileged Account Management focuses on implementing policies, controls, and tools to securely manage privileged accounts (e.g., SYSTEM, root, or administrative accounts). This includes restricting access, limiting the scope of permissions, monitoring privileged account usage, and ensuring accountability through logging and auditing.

• Implement RBAC and least privilege principles to allocate permissions securely.
• Use tools like Active Directory Group Policies to enforce access restrictions.

• Deploy password vaulting tools like CyberArk, HashiCorp Vault, or KeePass for secure storage and rotation of credentials.
• Enforce password policies for complexity, uniqueness, and expiration using tools like Microsoft Group Policy Objects (GPO).

• Enforce MFA for all privileged accounts using Duo Security, Okta, or Microsoft Azure AD MFA.

• Use PAM solutions like CyberArk, BeyondTrust, or Thycotic to manage, monitor, and audit privileged access.

• Integrate activity monitoring into your SIEM (e.g., Splunk or QRadar) to detect and alert on anomalous privileged account usage.

• Deploy JIT solutions like Azure Privileged Identity Management (PIM) or configure ephemeral roles in AWS and GCP to grant time-limited elevated permissions.

• CyberArk, BeyondTrust, Thycotic, HashiCorp Vault.

• Microsoft LAPS (Local Admin Password Solution), Password Safe, HashiCorp Vault, KeePass.

• Duo Security, Okta, Microsoft Azure MFA, Google Authenticator.

• sudo configuration, SELinux, AppArmor.

• Azure Privileged Identity Management (PIM), AWS IAM Roles with session constraints, GCP Identity-Aware Proxy.

Set and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse.

• Minimum password length (e.g., 12+ characters).
• Password complexity requirements.
• Password history (e.g., disallow last 24 passwords).
• Account lockout duration and thresholds.

• Use pam_pwquality to enforce complexity and length requirements.
• Implement pam_tally2 or pam_faillock for account lockouts.
• Use pwunconv to disable password reuse.

• Enforce usage of enterprise password managers (e.g., Bitwarden, 1Password, LastPass) to generate and store strong passwords.

• Use tools like Have I Been Pwned password checks or NIST-based blacklist solutions to prevent users from setting compromised passwords.

• Periodically audit password policies and account configurations to ensure compliance using tools like LAPS (Local Admin Password Solution) and vulnerability scanners.

• Group Policy Management Console (GPMC): Enforce password policies.
• Microsoft Local Administrator Password Solution (LAPS): Enforce random, unique admin passwords.

• PAM Modules (pam_pwquality, pam_tally2, pam_faillock): Enforce password rules.
• Lynis: Audit password policies and system configurations.

• Password Managers (Bitwarden, 1Password, KeePass): Manage and enforce strong passwords.
• Have I Been Pwned API: Prevent the use of breached passwords.
• NIST SP 800-63B compliant tools: Enforce password guidelines and blacklisting.

Operating System Configuration involves adjusting system settings and hardening the default configurations of an operating system (OS) to mitigate adversary exploitation and prevent abuse of system functionality. Proper OS configurations address security vulnerabilities, limit attack surfaces, and ensure robust defense against a wide range of techniques.

• Turn off SMBv1, LLMNR, and NetBIOS where not needed.
• Disable remote registry and unnecessary services.

• Enable Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG) on Windows.
• Use AppArmor or SELinux on Linux for mandatory access controls.

• Enable User Account Control (UAC) for Windows.
• Restrict root/sudo access on Linux/macOS and enforce strong permissions using sudoers files.

• Implement least-privilege access for critical files and system directories.
• Audit permissions regularly using tools like icacls (Windows) or getfacl/chmod (Linux/macOS).

• Restrict RDP, SSH, and VNC to authorized IPs using firewall rules.
• Enable NLA for RDP and enforce strong password/lockout policies.

• Enable Secure Boot and enforce UEFI/BIOS password protection.
• Use BitLocker or LUKS to encrypt boot drives.

• Periodically audit OS configurations using tools like CIS Benchmarks or SCAP tools.

• Microsoft Group Policy Objects (GPO): Centrally enforce OS security settings.
• Windows Defender Exploit Guard: Built-in OS protection against exploits.
• CIS-CAT Pro: Audit Windows security configurations based on CIS Benchmarks.

• AppArmor/SELinux: Enforce mandatory access controls.
• Lynis: Perform comprehensive security audits.
• SCAP Security Guide: Automate configuration hardening using Security Content Automation Protocol.

• Ansible or Chef/Puppet: Automate configuration hardening at scale.
• OpenSCAP: Perform compliance and configuration checks.

Multi-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include: - Something you know: Passwords, PINs. - Something you have: Physical tokens, smartphone authenticator apps. - Something you are: Biometric data such as fingerprints, facial recognition, or retinal scans. Implementing MFA across all critical systems and services ensures robust protection against account takeover and unauthorized access.

• Use IAM solutions like Azure Active Directory, Okta, or AWS IAM to enforce MFA policies for all user logins, especially for privileged roles.
• Enable conditional access policies to enforce MFA for risky sign-ins (e.g., unfamiliar devices, geolocations).
• Enable Conditional Access policies to only allow logins from trusted devices, such as those enrolled in Intune or joined via Hybrid/Entra.

• Use authenticator applications such as Google Authenticator, Microsoft Authenticator, or Authy for time-based one-time passwords (TOTP).
• Deploy hardware-based tokens like YubiKey, RSA SecurID, or smart cards for additional security.
• Enforce biometric authentication for compatible devices and applications.

• Integrate MFA solutions with older systems using third-party tools like Duo Security or Thales SafeNet.
• Enable RADIUS/NPS servers to facilitate MFA for VPNs, RDP, and other network logins.

• Use SIEM tools to monitor failed MFA attempts, login anomalies, or brute-force attempts against MFA systems.
• Implement alerts for suspicious MFA activities, such as repeated failed codes or new device registrations.

• Educate employees on the importance of MFA and secure authenticator usage.
• Enforce policies that require MFA on all critical systems, especially for remote access, privileged accounts, and cloud applications.

Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements.

The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures. Auditing is applicable to all systems used within an organization, from the front door of a building to accessing a file on a fileserver. It is considered more critical for regulated industries such as, healthcare, finance and government where compliance requirements demand stringent tracking of user and system activates.

• Use Case: Regularly assess system configurations to ensure compliance with organizational security policies.
• Implementation: Use tools to scan for deviations from established benchmarks.

• Use Case: Review file and folder permissions to minimize the risk of unauthorized access or privilege escalation.
• Implementation: Run access reviews to identify users or groups with excessive permissions.

• Use Case: Identify outdated, unsupported, or insecure software that could serve as an attack vector.
• Implementation: Use inventory and vulnerability scanning tools to detect outdated versions and recommend secure alternatives.

• Use Case: Evaluate system and network configurations to ensure secure settings (e.g., disabled SMBv1, enabled MFA).
• Implementation: Implement automated configuration scanning tools like SCAP (Security Content Automation Protocol) to identify non-compliant systems.

• Use Case: Examine network traffic, firewall rules, and endpoint communications to identify unauthorized or insecure connections.
• Implementation: Utilize tools such as Wireshark, or Zeek to monitor and log suspicious network behavior.