Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Multi-factor Authentication

Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator.

ID: M1032

Version: 1.0

Created: 10 Jun 2019

Last Modified: 21 Oct 2022

Domain	ID		Name	Use
Techniques Addressed by Mitigation
Enterprise	T1098		Account Manipulation	Use multi-factor authentication for user and privileged accounts.
		T1098.001	Additional Cloud Credentials	Use multi-factor authentication for user and privileged accounts. Consider enforcing multi-factor authentication for the `CreateKeyPair` and `ImportKeyPair` API calls through IAM policies.(Citation: Expel IO Evil in AWS)
		T1098.002	Additional Email Delegate Permissions	Use multi-factor authentication for user and privileged accounts.
		T1098.003	Additional Cloud Roles	Use multi-factor authentication for user and privileged accounts.
		T1098.005	Device Registration	Require multi-factor authentication to register devices in Azure AD.(Citation: Microsoft - Device Registration) Configure multi-factor authentication systems to disallow enrolling new devices for inactive accounts.(Citation: CISA MFA PrintNightmare)
Enterprise	T1110		Brute Force	Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.
		T1110.001	Password Guessing	Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.
		T1110.002	Password Cracking	Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.
		T1110.003	Password Spraying	Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.
		T1110.004	Credential Stuffing	Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.
Enterprise	T1136		Create Account	Use multi-factor authentication for user and privileged accounts.
		T1136.001	Local Account	Use multi-factor authentication for user and privileged accounts.
		T1136.002	Domain Account	Use multi-factor authentication for user and privileged accounts.
		T1136.003	Cloud Account	Use multi-factor authentication for user and privileged accounts.
Enterprise	T1530		Data from Cloud Storage	Consider using multi-factor authentication to restrict access to resources and cloud storage APIs.(Citation: Amazon S3 Security, 2019)
Enterprise	T1213	T1213.003	Data from Information Repositories: Code Repositories	Use multi-factor authentication for logons to code repositories.
Enterprise	T1114		Email Collection	Use of multi-factor authentication for public-facing webmail servers is a recommended best practice to minimize the usefulness of usernames and passwords to adversaries.
		T1114.002	Remote Email Collection	Use of multi-factor authentication for public-facing webmail servers is a recommended best practice to minimize the usefulness of usernames and passwords to adversaries.
Enterprise	T1133		External Remote Services	Use strong two-factor or multi-factor authentication for remote service accounts to mitigate an adversary's ability to leverage stolen credentials, but be aware of Multi-Factor Authentication Interception techniques for some two-factor authentication implementations.
Enterprise	T1556		Modify Authentication Process	Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs.
		T1556.001	Domain Controller Authentication	Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs.
		T1556.003	Pluggable Authentication Modules	Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information.
		T1556.004	Network Device Authentication	Use multi-factor authentication for user and privileged accounts. Most embedded network devices support TACACS+ and/or RADIUS. Follow vendor prescribed best practices for hardening access control. (Citation: Cisco IOS Software Integrity Assurance - TACACS)
		T1556.006	Multi-Factor Authentication	Ensure that MFA and MFA policies and requirements are properly implemented for existing and deactivated or dormant accounts and devices. If possible, consider configuring MFA solutions to "fail closed" rather than grant access in case of serious errors.
		T1556.007	Hybrid Identity	Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs.
Enterprise	T1601		Modify System Image	Use multi-factor authentication for user and privileged accounts. Most embedded network devices support TACACS+ and/or RADIUS. Follow vendor prescribed best practices for hardening access control.(Citation: Cisco IOS Software Integrity Assurance - TACACS)
		T1601.001	Patch System Image	Use multi-factor authentication for user and privileged accounts. Most embedded network devices support TACACS+ and/or RADIUS. Follow vendor prescribed best practices for hardening access control.(Citation: Cisco IOS Software Integrity Assurance - TACACS)
		T1601.002	Downgrade System Image	Use multi-factor authentication for user and privileged accounts. Most embedded network devices support TACACS+ and/or RADIUS. Follow vendor prescribed best practices for hardening access control.(Citation: Cisco IOS Software Integrity Assurance - TACACS)
Enterprise	T1621		Multi-Factor Authentication Request Generation	Implement more secure 2FA/MFA mechanisms in replacement of simple push or one-click 2FA/MFA options. For example, having users enter a one-time code provided by the login screen into the 2FA/MFA application or utilizing other out-of-band 2FA/MFA mechanisms (such as rotating code-based hardware tokens providing rotating codes that need an accompanying user pin) may be more secure. Furthermore, change default configurations and implement limits upon the maximum number of 2FA/MFA request prompts that can be sent to users in period of time.(Citation: MFA Fatigue Attacks - PortSwigger)
Enterprise	T1599		Network Boundary Bridging	Use multi-factor authentication for user and privileged accounts. Most embedded network devices support TACACS+ and/or RADIUS. Follow vendor prescribed best practices for hardening access control.(Citation: Cisco IOS Software Integrity Assurance - TACACS)
		T1599.001	Network Address Translation Traversal	Use multi-factor authentication for user and privileged accounts. Most embedded network devices support TACACS+ and/or RADIUS. Follow vendor prescribed best practices for hardening access control. (Citation: Cisco IOS Software Integrity Assurance - TACACS)
Enterprise	T1040		Network Sniffing	Use multi-factor authentication wherever possible.
Enterprise	T1021		Remote Services	Use multi-factor authentication on remote service logons where possible.
		T1021.001	Remote Desktop Protocol	Use multi-factor authentication for remote logins.(Citation: Berkley Secure)
		T1021.004	SSH	Require multi-factor authentication for SSH connections wherever possible, such as password protected SSH keys.
Enterprise	T1072		Software Deployment Tools	Ensure proper system and access isolation for critical network systems through use of multi-factor authentication.
Enterprise	T1539		Steal Web Session Cookie	A physical second factor key that uses the target login domain as part of the negotiation protocol will prevent session cookie theft through proxy methods.(Citation: Evilginx 2 July 2018)
Enterprise	T1199		Trusted Relationship	Require MFA for all delegated administrator accounts.(Citation: Microsoft Nobelium Admin Privileges)
Enterprise	T1078	T1078.002	Valid Accounts: Domain Accounts	Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs.
		T1078.004	Cloud Accounts	Use multi-factor authentication for cloud accounts, especially privileged accounts. This can be implemented in a variety of forms (e.g. hardware, virtual, SMS), and can also be audited using administrative reporting features.(Citation: AWS - IAM Console Best Practices)

References

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Multi-factor Authentication

Techniques Addressed by Mitigation

References