+User Training

User Training

User Training involves educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques. Comprehensive training programs create a human firewall by empowering users to be an active component of the organization's cybersecurity defenses. This mitigation can be implemented through the following measures:

Create Comprehensive Training Programs:

  • Design training modules tailored to the organization's risk profile, covering topics such as phishing, password management, and incident reporting.
  • Provide role-specific training for high-risk employees, such as helpdesk staff or executives.

Use Simulated Exercises:

  • Conduct phishing simulations to measure user susceptibility and provide targeted follow-up training.
  • Run social engineering drills to evaluate employee responses and reinforce protocols.

Leverage Gamification and Engagement:

  • Introduce interactive learning methods such as quizzes, gamified challenges, and rewards for successful detection and reporting of threats.

Incorporate Security Policies into Onboarding:

  • Include cybersecurity training as part of the onboarding process for new employees.
  • Provide easy-to-understand materials outlining acceptable use policies and reporting procedures.

Regular Refresher Courses:

  • Update training materials to include emerging threats and techniques used by adversaries.
  • Ensure all employees complete periodic refresher courses to stay informed.

Emphasize Real-World Scenarios:

  • Use case studies of recent attacks to demonstrate the consequences of successful phishing or social engineering.
  • Discuss how specific employee actions can prevent or mitigate such attacks.

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

Requisitos

3. Regulaciones relacionadas

Regulaciones

Incidencias vinculadas

Vínculos
is related to Mitigations
blocks Spearphishing via Service
blocks Spearphishing Voice
blocks User Execution
blocks Code Repositories
blocks Unsecured Credentials
blocks Databases
blocks Masquerading
blocks Data from Information Repositories
blocks Phishing for Information
blocks Confluence
blocks Domain Accounts
blocks ARP Cache Poisoning
blocks Spearphishing Link
blocks Messaging Applications
blocks Spearphishing Voice
blocks Customer Relationship Management Software
blocks Impersonation
blocks Spearphishing Service
blocks Adversary-in-the-Middle
blocks Cached Domain Credentials
blocks OS Credential Dumping
blocks NTDS
blocks Browser Session Hijacking
blocks Software Deployment Tools
blocks Malicious Image
blocks Financial Theft
blocks Password Managers
blocks Credentials In Files
blocks Double File Extension
blocks Multi-Factor Authentication Interception
blocks Malicious Library
blocks Steal Application Access Token
blocks Credentials from Web Browsers
blocks Spearphishing Attachment
blocks IDE Extensions
blocks Software Extensions
blocks Template Injection
blocks LSASS Memory
blocks GUI Input Capture
blocks Domain Controller Authentication
blocks Evil Twin
blocks Browser Extensions
blocks Spearphishing Attachment
blocks Drive-by Compromise
blocks Cloud Accounts
blocks Sharepoint
blocks Spearphishing Link
blocks Social Engineering
blocks Chat Messages
blocks Malicious Link
blocks Malicious File
blocks Security Account Manager
blocks LSA Secrets
blocks Valid Accounts
blocks Phishing
blocks Email Bombing
blocks Obfuscated Files or Information
blocks Re-opened Applications
blocks Steal Web Session Cookie
blocks Multi-Factor Authentication Request Generation
blocks Steal Application Specific Passwords
blocks AI-Enabled Exfiltration
blocks Direct Prompt Injection
blocks Indirect Prompt Injection
  • MITREATTACK -

    EN: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. License: The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. See the Terms of Use for the disclaimers. ATT&CK® is a registered trademark of The MITRE Corporation. Converted into the GRCA format.

    DE: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE erlaubt die Nutzung für Forschung, Entwicklung und kommerzielle Zwecke, wenn jede Kopie den Urheberrechtsvermerk und die Lizenz enthält; maßgeblich ist der englische Wortlaut der Lizenz oben und die Terms of Use mit den Haftungsausschlüssen. ATT&CK® ist eine eingetragene Marke der MITRE Corporation. In das GRCA-Format umgewandelt.