Do this first: Close the listener nobody owns. Inventory before patching.
1.1 Establish and maintain a detailed enterprise asset inventory 4.8 Uninstall or disable unnecessary services on enterprise assets 7.1 Establish and maintain a vulnerability management process CM-7 Least functionality RA-5 Vulnerability monitoring and scanning M1051 Update software T1595.001 T1595.002 T1595.003 T1190
1 Reconcile the external address ranges against the asset inventory monthly and own every listener you find.
Where: Edge firewall and external attack-surface inventory
2 Retire the stale daemon outright rather than patching it, and close the port at the edge.
Where: Edge host and perimeter firewall rules
Watch out: Anything still consuming the legacy service — find the consumers before the cut.
3 Put authenticated vulnerability scanning on the perimeter hosts, not just unauthenticated sweeps.
Where: Vulnerability management platform
Do this first: Cut the one edge that shortens the path to Domain Admins the most.
5.4 Restrict administrator privileges to dedicated administrator accounts 6.8 Define and maintain role-based access control AC-6 Least privilege IA-5 Authenticator management M1026 Privileged account management M1027 Password policies T1078.002 T1069.002 T1558.003 T1003.006
1 Move service accounts to group-managed service accounts so their passwords rotate and cannot be roasted offline.
Where: Active Directory service accounts
Watch out: Applications hard-coding the old service password — stage the migration per app.
2 Remove unconstrained delegation and tier administrative accounts so tier-0 never logs on to tier-2.
Where: Domain controllers and admin workstation policy
3 Review the graph itself on a schedule, not just after an engagement.
Where: Quarterly identity attack-path review
Do this first: Re-check ownership server-side on the endpoint the lab abused.
16.10 Apply secure design principles in application architectures 16.12 Implement code-level security checks AC-3 Access enforcement SI-10 Information input validation M1050 Exploit protection T1595.003 T1078 T1213 T1189
1 Enforce object-level authorization server-side on every handler that takes an identifier, with a deny default.
Where: Application authorization middleware
2 Add an automated test per endpoint that asserts a cross-tenant request is refused.
Where: CI test suite
3 Log authorization denials with the caller and the object, so abuse is visible before it succeeds.
Where: Application logging to the SIEM
Do this first: Remove the escalating permission from the workload role.
5.6 Centralize account management 6.7 Centralize access control AC-2 Account management AC-6(9) Log use of privileged functions M1018 User account management T1078.004 T1526 T1548 T1651
1 Strip iam:PassRole, policy-attachment and key-creation rights from workload roles; keep them in a break-glass role behind approval.
Where: Cloud IAM policies
Watch out: Deployment pipelines that quietly relied on those rights — move them to a scoped deploy role.
2 Turn on short-lived credentials everywhere and expire long-lived access keys.
Where: Cloud identity provider and key policy
3 Alert on first use of a privileged API by a role that has never called it before.
Where: Cloud audit log pipeline
Do this first: Onboard the missing log source — until it exists, there is nothing to tune.
8.2 Collect audit logs 8.11 Conduct audit log reviews 17.4 Establish and maintain an incident response process AU-6 Audit record review, analysis, and reporting CA-8 Penetration testing M1047 Audit T1595 T1059.001 T1003.001 T1053.005 T1021.006 T1567.002
1 Onboard the sources the emulation showed missing before writing any new rule against them.
Where: Log pipeline
2 Re-tune the rules that fired late, using the measured latency as the target.
Where: Detection content
3 Schedule the emulation as a recurring exercise, not a one-off, and track coverage over time.
Where: Purple-team calendar and coverage tracker
Do this first: Stop accepting a pre-shared key on the corporate SSID.
12.6 Use of secure network management and communication protocols 15.4 Ensure service provider contracts include security requirements AC-18 Wireless access SC-8 Transmission confidentiality and integrity M1032 Multi-factor authentication T1595 T1595.002 T1040 T1110.002
1 Move the corporate SSID to WPA3-Enterprise with certificate-based authentication and server-certificate validation enforced on clients.
Where: Wireless controller and device profiles
Watch out: Legacy devices that cannot do 802.1X — move them to a segmented SSID, not an exception on the main one.
2 Turn on rogue-AP containment and alert on deauthentication floods.
Where: Wireless IDS
3 Separate guest wireless from corporate at layer 3, with no route between them.
Where: Network segmentation
Do this first: Phishing-resistant MFA on the accounts the lure targets.
9.6 Block unnecessary file types 14.2 Train workforce members to recognize social engineering attacks AT-2 Literacy training and awareness IA-2(1) Multi-factor authentication to privileged accounts M1017 User training M1032 Multi-factor authentication T1589.002 T1583.001 T1566.002 T1056.003
1 Require phishing-resistant multi-factor authentication (FIDO2 or certificate-based) for everyone, not just admins.
Where: Identity provider conditional access
Watch out: Shared accounts and kiosk logins — give them their own hardware keys or retire them.
2 Revoke refresh tokens on password change and bind sessions to device compliance.
Where: Identity provider session policy
3 Make reporting a suspect mail one click, and measure report rate, not just click rate.
Where: Mail client reporting button and awareness program
Do this first: Alert on the endpoint agent going quiet — silence is the signal.
2.5 Allowlist authorized software 8.5 Collect detailed audit logs 10.7 Use behavior-based anti-malware software SI-4 System monitoring SI-7 Software, firmware, and information integrity M1038 Execution prevention M1040 Behavior prevention on endpoint T1595 T1562.001 T1562.006 T1055 T1071.001
1 Enable tamper protection on the endpoint agent and alert when the agent stops reporting.
Where: EDR platform
2 Turn on script-block logging and forward it, so a hidden script body is still recorded.
Where: Windows PowerShell and Sysmon policy
3 Move from signature blocking to application allowlisting in the highest-value zones first.
Where: Application control policy
Watch out: Unsigned internal tooling — inventory and sign it before enforcement mode.
Do this first: Default-deny egress from the server segment.
4.9 Configure trusted DNS servers on enterprise assets 9.3 Maintain and enforce network-based URL filters 13.4 Perform traffic filtering between network segments SC-7 Boundary protection SI-4(4) Inbound and outbound communications traffic monitoring M1031 Network intrusion prevention M1037 Filter network traffic T1595 T1071.001 T1071.004 T1560.001 T1041
1 Force all DNS through inspected resolvers and block direct outbound 53 and DNS-over-HTTPS to unknown resolvers.
Where: Egress firewall and DNS policy
Watch out: Devices with hard-coded public resolvers — redirect them rather than allowing an exception.
2 Default-deny egress from servers; allow named destinations only.
Where: Egress firewall rules per segment
3 Score destinations on beacon regularity rather than per-request signatures.
Where: Detection content over proxy logs
Do this first: Prove one recovery point cannot be deleted with production credentials.
3.11 Encrypt sensitive data at rest 11.2 Perform automated backups 11.4 Establish and maintain an isolated instance of recovery data CP-9 System backup CP-10 System recovery and reconstitution M1053 Data backup T1595 T1053.005 T1134.001 T1021.006 T1486
1 Hold one immutable, credential-isolated copy of every recovery point — the backup system must not trust production identities.
Where: Backup platform and its own identity store
2 Rehearse a restore to a stated recovery-time objective, and time it.
Where: Recovery runbook
3 Alert on mass file modification per share, weighted by sensitivity.
Where: File-share auditing into the SIEM
Watch out: Legitimate bulk jobs — baseline them first so the rule is not switched off in week one.
CYBRARY