NIST SP 800-53 rev5 · Identification and Authentication
IA-4 Identifier Management
Mitigates 36 ATT&CK techniques, used by 10 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
Techniques it mitigates
The 30 most used of 36, by how many ATT&CK groups and malware use them.
- T1053.005Scheduled Task/Job: Scheduled Task181 users
- T1021.001Remote Services: Remote Desktop Protocol57 users
- T1110Brute Force23 users
- T1003OS Credential Dumping20 users
- T1110.003Brute Force: Password Spraying16 users
- T1110.001Brute Force: Password Guessing13 users
- T1528Steal Application Access Token13 users
- T1021.005Remote Services: VNC11 users
- T1098.007Account Manipulation: Additional Local or Domain Groups11 users
- T1213.002Data from Information Repositories: Sharepoint10 users
- T1530Data from Cloud Storage10 users
- T1550.001Use Alternate Authentication Material: Application Access Token10 users
- T1543Create or Modify System Process9 users
- T1003.005OS Credential Dumping: Cached Domain Credentials8 users
- T1003.006OS Credential Dumping: DCSync7 users
- T1552.005Unsecured Credentials: Cloud Instance Metadata API7 users
- T1053.002Scheduled Task/Job: At6 users
- T1213.005Data from Information Repositories: Messaging Applications6 users
- T1552Unsecured Credentials6 users
- T1110.002Brute Force: Password Cracking5 users
- T1213Data from Information Repositories4 users
- T1110.004Brute Force: Credential Stuffing3 users
- T1537Transfer Data to Cloud Account3 users
- T1547.006Boot or Logon Autostart Execution: Kernel Modules and Extensions3 users
- T1213.001Data from Information Repositories: Confluence2 users
- T1578.002Modify Cloud Compute Infrastructure: Create Cloud Instance2 users
- T1578.003Modify Cloud Compute Infrastructure: Delete Cloud Instance2 users
- T1602.002Data from Configuration Repository: Network Device Configuration Dump2 users
- T1053Scheduled Task/Job1 users
- T1578.001Modify Cloud Compute Infrastructure: Create Snapshot1 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.