Establish and follow a process, preferably automated, for revoking access to enterprise assets, through disabling accounts immediately upon termination, rights revocation, or role change of a user. Disabling accounts, instead of deleting accounts, may be necessary to preserve audit trails.
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-6.2 | Establish an Access Revoking Process | mitigates | T1078 | Valid Accounts |
Comments
Disabling accounts that are no longer needed immediately upon termination, rights revocation, or role change prevents adversaries from gaining and using those accounts.
References
|
| CIS-6.2 | Establish an Access Revoking Process | mitigates | T1555.005 | Password Managers |
Comments
Inactive accounts may be targeted by attackers to gain unauthorized access. Disabling inactive accounts can prevent attackers from obtaining the user credentials from third-party password managers.
References
|
| CIS-6.2 | Establish an Access Revoking Process | mitigates | T1555.003 | Credentials from Web Browsers |
Comments
Inactive accounts may be targeted by attackers to gain unauthorized access. Disabling inactive accounts can prevent attackers from acquiring credentials from web browsers.
References
|
| CIS-6.2 | Establish an Access Revoking Process | mitigates | T1556.006 | Multi-Factor Authentication |
Comments
Removing accounts that are no longer needed helps to accounts that adversaries could abuse to disable or modify MFA and maintain persistent access.
References
|
| CIS-6.2 | Establish an Access Revoking Process | mitigates | T1078.004 | Cloud Accounts |
Comments
Disabling accounts that are no longer needed immediately upon termination, rights revocation, or role change prevents adversaries from gaining and using those accounts.
References
|
| CIS-6.2 | Establish an Access Revoking Process | mitigates | T1078.003 | Local Accounts |
Comments
Disabling accounts that are no longer needed immediately upon termination, rights revocation, or role change prevents adversaries from gaining and using those accounts.
References
|
| CIS-6.2 | Establish an Access Revoking Process | mitigates | T1078.002 | Domain Accounts |
Comments
Disabling accounts that are no longer needed immediately upon termination, rights revocation, or role change prevents adversaries from gaining and using those accounts.
References
|