271 indexed

D3FENDD3FEND defensive techniques

271 MITRE D3FEND defences across 7 tactics (Model, Harden, Detect, Isolate, Deceive, Evict, Restore). Filter to a tactic or browse the full set. Authored by Adam Lundqvist.

55 in Harden · 271 total

IDTitleSummary
D3-AAAgent Authentication
D3-ACHApplication Configuration HardeningModifying an application's configuration to reduce its attack surface.
D3-AHApplication Hardening
D3-BABootloader AuthenticationCryptographically authenticating the bootloader software before system boot.
D3-BANBiometric AuthenticationUsing biological measures in order to authenticate a user.
D3-BMABus Message AuthenticationApplies cryptographic primitives to individual bus frames to verify the sender's identity and ensure the integrity of the data payload.
D3-CBANCertificate-based AuthenticationRequiring a digital certificate in order to authenticate a user.
D3-CDPChange Default PasswordChanging the default password means replacing the factory-set credentials with a strong, unique password before the device is deployed, preventing unauthorized…
D3-CEROCertificate RotationCertificate rotation involves replacing digital certificates and their private keys to maintain cryptographic integrity and trust, mitigating key compromise ri…
D3-CFIControl Flow IntegrityEnforcing legal control flow transfers during application process execution.
D3-CHCredential Hardening
D3-CPCertificate PinningPersisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in …
D3-CROCredential RotationCredential rotation is a security procedure in which authentication credentials, such as passwords, API keys, or certificates, are regularly changed or replace…
D3-CSCredential ScrubbingThe systematic removal of hard-coded credentials from source code to prevent accidental exposure and unauthorized access.
D3-DCEDead Code EliminationRemoving unreachable or "dead code" from compiled source code.
D3-DENCRDisk EncryptionEncrypting a hard disk partition to prevent cleartext access to a file system.
D3-DLICDriver Load Integrity CheckingEnsuring the integrity of drivers loaded during initialization of the operating system.
D3-DLVDomain Logic ValidationValidation of variable state in the context of the domain application.
D3-DRADisable Remote AccessLimiting access to a computing device which is not required through or from a non-organization-controlled network.
D3-EHPVException Handler Pointer ValidationValidates that a referenced exception handler pointer is a valid exception handler.
D3-EMHElectromagnetic Radiation HardeningThe application of physical and material-level design measures to electronic systems, components, or facilities to reduce their susceptibility to damage or dis…
D3-FEFile EncryptionEncrypting a file using a cryptographic key.
D3-HBWPHardware-based Write ProtectionPhysical methods of preventing data from being written to computer storage.
D3-IRVInteger Range ValidationEnsuring that an integer is within a valid range.
D3-MANMessage AuthenticationAuthenticating the sender of a message and ensuring message integrity.
D3-MBSVMemory Block Start ValidationEnsuring that a pointer accurately references the beginning of a designated memory block.
D3-MENCRMessage EncryptionEncrypting a message body using a cryptographic key.
D3-MFAMulti-factor AuthenticationRequiring proof of two or more pieces of evidence in order to authenticate a user.
D3-MHMessage Hardening
D3-NPCNull Pointer CheckingChecking if a pointer is NULL.
D3-OLVOperational Logic ValidationValidation of variable state in the context of the control logic of the operational application.
D3-OTPOne-time PasswordA one-time password is valid for only one user authentication.
D3-PANPointer AuthenticationComparing the cryptographic hash or derivative of a pointer's value to an expected value.
D3-PEHPhysical Enclosure HardeningPhysical changes to a computer enclosure which reduce the ability for agents or the environment to affect the contained computer system.
D3-PHPlatform Hardening
D3-PRPassword RotationPassword rotation is a security policy that mandates the periodic change of user account passwords to mitigate the risk of unauthorized access due to compromis…
D3-PSEPProcess Segment Execution PreventionPreventing execution of any address in a memory region other than the code segment.
D3-PVPointer ValidationEnsuring that a pointer variable has the required properties for use.
D3-PWAPassword AuthenticationPassword authentication is a security mechanism used to verify the identity of a user or entity attempting to access a system or resource by requiring the inpu…
D3-RFSRF ShieldingAdding physical barriers to a platform to prevent undesired radio interference.
D3-RHRadiation HardeningRadiation hardening is the process of making electronic components and circuits resistant to damage or malfunction caused by high levels of ionizing radiation.
D3-RNReference NullificationInvalidating all pointers that reference a specific memory block, ensuring that the block cannot be accessed or modified after deallocation.
D3-SAORSegment Address Offset RandomizationRandomizing the base (start) address of one or more segments of memory during the initialization of a process.
D3-SCHSource Code Hardening
D3-SCPSystem Configuration PermissionsRestricting system configuration modifications to a specific user or group of users.
D3-SFCVStack Frame Canary ValidationComparing a value stored in a stack frame with a known good value in order to prevent or detect a memory segment overwrite.
D3-SPPStrong Password PolicyModifying system configuration to increase password strength.
D3-SUSoftware UpdateReplacing old software on a computer system component.
D3-TAANTransfer Agent AuthenticationValidating that server components of a messaging infrastructure are authorized to send a particular message.
D3-TBToken BindingToken binding is a security mechanism used to enhance the protection of tokens, such as cookies or OAuth tokens, by binding them to a specific connection.
D3-TBAToken-based AuthenticationToken-based authentication is an authentication protocol where users verify their identity in exchange for a unique access token. Users can then access the web…
D3-TBITPM Boot IntegrityAssuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the …
D3-TLTrusted LibraryA trusted library is a collection of pre-verified and secure code modules or components that are used within software applications to perform specific function…
D3-VIVariable InitializationSetting variables to a known value before use.
D3-VTVVariable Type ValidationEnsuring that a variable has the correct type.
Sourced from MITRE D3FEND ontology. Curated by Adam Lundqvist, Founder at SQUR.
MITRE D3FEND defensive techniques — by tactic | SQUR Knowledge Base