Esc
Credential Hardening
Definition
Credential Hardening techniques modify system or network properties in order to protect system or network/domain credentials.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 9 techniques in this category, Credential Hardening.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Credential Hardening | D3-CH | Credential Hardening techniques modify system or network properties in order to protect system or network/domain credentials. | |
| - Certificate Pinning | D3-CP | Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections. | |
| - Certificate Rotation | D3-CERO | Certificate rotation involves replacing digital certificates and their private keys to maintain cryptographic integrity and trust, mitigating key compromise risks and ensuring continuous secure communications. | |
| - Token Binding | D3-TB | Token binding is a security mechanism used to enhance the protection of tokens, such as cookies or OAuth tokens, by binding them to a specific connection. | |
| - Password Rotation | D3-PR | Password rotation is a security policy that mandates the periodic change of user account passwords to mitigate the risk of unauthorized access due to compromised credentials. | |
| - Change Default Password | D3-CDP | Changing the default password means replacing the factory-set credentials with a strong, unique password before the device is deployed, preventing unauthorized access. | |
| - Strong Password Policy | D3-SPP | Modifying system configuration to increase password strength. | |
| - Credential Rotation | D3-CRO | Credential rotation is a security procedure in which authentication credentials, such as passwords, API keys, or certificates, are regularly changed or replaced to minimize the risk of unauthorized access. | |
| - One-time Password | D3-OTP | A one-time password is valid for only one user authentication. | OTP |
Related Offensive Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Privilege Escalation
Valid Accounts
Access Token Manipulation
Account Manipulation
Abuse Elevation Control Mechanism
Credential Access
Steal or Forge Kerberos Tickets
OS Credential Dumping
Keychain
Steal Web Session Cookie
Forge Web Credentials
Steal Application Access Token
Unsecured Credentials
Brute Force
Steal or Forge Authentication Certificates
Stealth
Access Token Manipulation
Valid Accounts
Persistence
Account Manipulation
Valid Accounts
Create Account
Impact
Account Access Removal