Esc
Credential Hardening
Definition
Credential Hardening techniques modify system or network properties in order to protect system or network/domain credentials.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 9 techniques in this category, Credential Hardening.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Credential Hardening | D3-CH | Credential Hardening techniques modify system or network properties in order to protect system or network/domain credentials. | |
| - Certificate Pinning | D3-CP | Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections. | |
| - Certificate Rotation | D3-CERO | Certificate rotation involves replacing digital certificates and their private keys to maintain cryptographic integrity and trust, mitigating key compromise risks and ensuring continuous secure communications. | |
| - Token Binding | D3-TB | Token binding is a security mechanism used to enhance the protection of tokens, such as cookies or OAuth tokens, by binding them to a specific connection. | |
| - Password Rotation | D3-PR | Password rotation is a security policy that mandates the periodic change of user account passwords to mitigate the risk of unauthorized access due to compromised credentials. | |
| - Change Default Password | D3-CDP | Changing the default password means replacing the factory-set credentials with a strong, unique password before the device is deployed, preventing unauthorized access. | |
| - Strong Password Policy | D3-SPP | Modifying system configuration to increase password strength. | |
| - Credential Rotation | D3-CRO | Credential rotation is a security procedure in which authentication credentials, such as passwords, API keys, or certificates, are regularly changed or replaced to minimize the risk of unauthorized access. | |
| - One-time Password | D3-OTP | A one-time password is valid for only one user authentication. | OTP |
Related ATT&CK Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Privilege Escalation
Account Manipulation
Access Token Manipulation
Valid Accounts
Abuse Elevation Control Mechanism
Impact
Account Access Removal
Persistence
Account Manipulation
Create Account
Valid Accounts
Credential Access
Brute Force
OS Credential Dumping
Steal or Forge Kerberos Tickets
Steal Application Access Token
Steal Web Session Cookie
Keychain
Unsecured Credentials
Forge Web Credentials
Steal or Forge Authentication Certificates
Defense Evasion
Access Token Manipulation
Valid Accounts
Use Alternate Authentication Material
Abuse Elevation Control Mechanism