+User Training

User Training

User Training involves educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques. Comprehensive training programs create a human firewall by empowering users to be an active component of the organization's cybersecurity defenses. This mitigation can be implemented through the following measures: Create Comprehensive Training Programs: - Design training modules tailored to the organization's risk profile, covering topics such as phishing, password management, and incident reporting. - Provide role-specific training for high-risk employees, such as helpdesk staff or executives. Use Simulated Exercises: - Conduct phishing simulations to measure user susceptibility and provide targeted follow-up training. - Run social engineering drills to evaluate employee responses and reinforce protocols. Leverage Gamification and Engagement: - Introduce interactive learning methods such as quizzes, gamified challenges, and rewards for successful detection and reporting of threats. Incorporate Security Policies into Onboarding: - Include cybersecurity training as part of the onboarding process for new employees. - Provide easy-to-understand materials outlining acceptable use policies and reporting procedures. Regular Refresher Courses: - Update training materials to include emerging threats and techniques used by adversaries. - Ensure all employees complete periodic refresher courses to stay informed. Emphasize Real-World Scenarios: - Use case studies of recent attacks to demonstrate the consequences of successful phishing or social engineering. - Discuss how specific employee actions can prevent or mitigate such attacks.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Related Regulations

2. Identifizierte Anforderungen

Anforderungen

3. Related Regulations

Regulations

Linked Issues

Issuelinks
is related to Mitigations
blocks Spearphishing via Service
blocks Spearphishing Voice
blocks User Execution
blocks Code Repositories
blocks Unsecured Credentials
blocks Databases
blocks Masquerading
blocks Data from Information Repositories
blocks Phishing for Information
blocks Confluence
blocks Domain Accounts
blocks ARP Cache Poisoning
blocks Spearphishing Link
blocks Messaging Applications
blocks Spearphishing Voice
blocks Customer Relationship Management Software
blocks Impersonation
blocks Spearphishing Service
blocks Adversary-in-the-Middle
blocks Cached Domain Credentials
blocks OS Credential Dumping
blocks NTDS
blocks Browser Session Hijacking
blocks Software Deployment Tools
blocks Malicious Image
blocks Financial Theft
blocks Password Managers
blocks Credentials In Files
blocks Double File Extension
blocks Multi-Factor Authentication Interception
blocks Malicious Library
blocks Steal Application Access Token
blocks Credentials from Web Browsers
blocks Spearphishing Attachment
blocks IDE Extensions
blocks Software Extensions
blocks Template Injection
blocks LSASS Memory
blocks GUI Input Capture
blocks Domain Controller Authentication
blocks Evil Twin
blocks Browser Extensions
blocks Spearphishing Attachment
blocks Drive-by Compromise
blocks Cloud Accounts
blocks Sharepoint
blocks Spearphishing Link
blocks Social Engineering
blocks Chat Messages
blocks Malicious Link
blocks Malicious File
blocks Security Account Manager
blocks LSA Secrets
blocks Valid Accounts
blocks Phishing
blocks Email Bombing
blocks Obfuscated Files or Information
blocks Re-opened Applications
blocks Steal Web Session Cookie
blocks Multi-Factor Authentication Request Generation
  • MITREATTACK -

    © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. https://attack.mitre.org/

    Terms of Use

    LICENSE

    The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

    "© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

    DISCLAIMERS

    MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or variations on existing techniques not documented by ATT&CK.

    ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

    See our FAQ for more information on how to use and represent the ATT&CK name.
Impressum Deutsch Englisch