Where It Sits in the Scheme
7 ASOM-Fed techniques reach this countermeasure, across 5 forms of maneuver.
This is the direction the forward mapping cannot answer. A reader who works in D3FEND arrives holding D3-APA and needs to know where it is employed in a scheme of maneuver — not which of MITRE's tactics it belongs to, which they already know.
Reached By
- M2.08 API Authorization EnforcementM2 Defense in Depth · T4 Applications and Workloads
Enforce per-call authorization at an API gateway rather than trusting network position or a shared key.
- M3.02 Conditional Access Policy EngineM3 Envelopment · T1 Identity
Concentrate access decisions in one policy decision point that sees identity, device, network and behavior together.
- M3.03 Continuous AuthorizationM3 Envelopment · T1 Identity
Re-evaluate authorization during a session on changed signal, rather than only at sign-in.
- M3.12 Authorization Policy as CodeM3 Envelopment · T1 Identity
Express access policy as reviewed, version-controlled, testable code rather than console state.
- M4.07 Cloud Boundary EnforcementM4 Obstacle / Canalization · T3 Networks
Enforce account, VPC and role boundaries in the cloud with the same rigor as network segments on the ground.
- M6.05 Approval Gates on High-Impact ActionsM6 Delay · TX Cross-Cutting
Require a second, human authorization for the small set of actions that would be decisive if abused.
- M8.04 Fail-Secure Default PostureM8 Isolation / Retrograde · TX Cross-Cutting
Ensure that when a control fails, the estate denies rather than permits — including under load and during recovery.
Forms That Arrive Here
A countermeasure reached from more than one form is employed more than one way. D3FEND has no notion of a form, so this join exists only here.
- M2 Defense in DepthThe formEnsure no single failure is decisive.
- M3 EnvelopmentThe formMake identity, not network location, the decisive plane — surround the adversary with policy.
- M4 Obstacle / CanalizationThe formForce the adversary onto ground you own and watch.
- M6 DelayThe formBuy decision time and prevent the adversary culminating on the objective.
- M8 Isolation / RetrogradeThe formGive ground deliberately to preserve the force. Degrade gracefully; never fail open.
What This Does Not Claim
That a technique reaches a D3FEND countermeasure says the two describe the same defensive act. It does not say the countermeasure is deployed, configured, or working — that is an assessment finding about your estate, not a property of the framework.
MITRE's own entry for this technique is at d3fend.mitre.org, and it is the authority on what the countermeasure is. This page is the authority only on where it sits in ASOM-Fed. D3FEND™ and ATT&CK® are trademarks of The MITRE Corporation. This mapping is published by threatDefendr and is neither produced nor endorsed by MITRE.