Intent, Mechanism and Indicator
Buy decision time and prevent the adversary culminating on the objective.
Role. The form that buys decision time
Rate limiting, step-up authentication, automated session throttling.
Adversary tempo drops below defender decision tempo.
Terrain It Consumes
Derived from where the form’s techniques are actually emplaced. The highlighted layer is the one the catalog names as its principal ground — the rest is terrain the form still has to touch, and that spread is how much of the estate employing it implicates.
- T1IdentityThe high ground3 techniques
- T3NetworksThe corridors1 technique
- T4Applications and WorkloadsThe urban terrain3 techniques · principal ground
- T5DataThe objective1 technique
- T9Supply ChainThe lines of communication1 technique
- TXCross-CuttingThe enablers of movement1 technique
Campaign Phasing
Dominance is taken from the campaign model; participation is derived from the techniques themselves. A form is usually present in more phases than it leads, and confusing the two is how a scheme ends up with no main effort.
| Phase | Role | Phase objective | Techniques employed |
|---|---|---|---|
| Phase II — Seize InitiativeContest first contact | Dominant — main effort | Detect early, canalize movement, and buy decision time. | 9 of 10 |
| Phase III — DominateDefeat the attempt | Supporting | Hunt, contain, evict. | 8 of 10 |
Phase II — Seize Initiative
Contest first contact
- Role
- Dominant — main effort
- Phase objective
- Detect early, canalize movement, and buy decision time.
- Techniques employed
- 9 of 10
Phase III — Dominate
Defeat the attempt
- Role
- Supporting
- Phase objective
- Hunt, contain, evict.
- Techniques employed
- 8 of 10
Employment
When to Choose It
Choose delay when eviction will be slower than the adversary’s objective — when you can see them, cannot yet remove them, and the objective is reachable before you will finish. Delay is also the right form when confidence is low: throttling and step-up authentication are proportionate responses that cost little if the anomaly turns out to be nothing, which makes them the correct fire to pre-authorize.
Precondition
A declared availability floor. Delay is deliberate degradation, and without a floor agreed in advance the SOC will either apply it too late or be overruled while applying it.
What It Costs
Paid directly in mission. Every second of delay is availability the public does not receive, and in a federal estate some of that availability is statutory. Delay applied to a false positive is an outage to a citizen who did nothing wrong, which is why the discrimination between anomalous and merely heavy traffic has to be built before contact, not during it.
Rules of Engagement
Adaptive rate limiting, step-up on anomaly, session-duration reduction and progressive lockout should sit in the pre-authorized set — their cost is bounded and their value is entirely in tempo. Degrading a public service below its availability floor, or freezing deployment across the estate, needs the AO.
How It Fails
Not whether it fails — how. Each of these is a state in which the form is still reported as implemented and has stopped producing the advantage it was chosen for.
- Delay is applied to the population rather than to the anomaly, because the discriminator was never built. The adversary is slowed by the same proportion as everyone else, which is no relative advantage at all.
- Thresholds are tuned against load rather than against behavior, so a patient adversary operating under the rate limit is never delayed and the limit only ever fires on a busy Monday.
- Nobody owns lifting it. Delay imposed under contact persists for weeks, becomes normal, and is then tuned away as a performance problem.
- The approval gate degrades into a rubber stamp. A high-impact action that always gets approved within ninety seconds has added latency and removed nothing.
- Step-up authentication falls back to a weaker factor when the strong one fails, which converts a delay into an alternative route.
Techniques (10)
Grouped by the terrain layer each is emplaced on. Techniques are the perishable layer of the framework — they churn, the form does not — so each is stated as what it does and the observable that shows it is working, never as a product.
T1 · Identity — 3 techniques
- M6.02
Step-Up Authentication on Anomaly
Demand stronger proof at the moment behavior deviates, rather than uniformly at sign-in.
IndicatorAnomalous sessions must re-prove before continuing.
Phases- II
- III
- M6.04
Session Duration Reduction Under Alert
Shorten session and token lifetimes automatically while the estate is in contact.
IndicatorSession lifetimes contract on phase change without an outage.
Phases- II
- III
- M6.07
Progressive Lockout
Escalate friction against an identity under attack without handing an attacker a denial-of-service lever.
IndicatorGuessing is defeated without locking the population out.
Phases- II
T3 · Networks — 1 technique
- M6.06
Tarpitting and Response Delay
Introduce deliberate latency on suspicious paths, so an adversary spends time you are spending on decision.
IndicatorAdversary tempo drops below defender decision tempo.
Phases- II
T4 · Applications and Workloads — 3 techniques
- M6.01
Adaptive Rate Limiting
Slow request rates as risk rises, so automation loses its advantage while humans keep service.
IndicatorAutomated abuse degrades while legitimate service holds.
Phases- II
- III
- M6.08
Change and Deploy Freeze Under Contact
Suspend routine change into decisive systems while in contact, so the adversary cannot hide in the noise of normal deployment.
IndicatorChange into decisive systems stops on phase declaration.
Phases- III
- M6.09
Query Complexity Limits
Bound the cost and breadth of a single query against mission data stores.
IndicatorNo single query can enumerate the corpus.
Phases- II
- III
T5 · Data — 1 technique
- M6.03
Bulk Export Throttling
Cap the rate and volume of bulk retrieval so a successful intrusion cannot become a successful exfiltration in one pass.
IndicatorBulk collection takes long enough to be detected and stopped.
Phases- II
- III
T9 · Supply Chain — 1 technique
- M6.10
Update Staging and Soak
Hold vendor updates in a staging ring long enough to observe them, trading a little currency for the ability to not deploy a compromised build estate-wide.
IndicatorNo supplier update reaches the whole estate without a stated soak period.
Phases- II
- III
Controls That Assess It
Derived from the controls the form’s own techniques name, so the assessment surface cannot disagree with the catalog. A control reached by many techniques is load-bearing for this form; one reached by a single technique is not, and an assessor sampling it will learn very little.
By Family
- TATempo and Temporal Advantage3 controls · reaches 9 of 10 techniques
- CGCommand and Governance2 controls · reaches 3 of 10 techniques
- SMScheme of Maneuver1 control · reaches 3 of 10 techniques
- IDIdentity Terrain2 controls · reaches 2 of 10 techniques
- KTKey Terrain and Decisive Points1 control · reaches 2 of 10 techniques
- ENEngagement and Pursuit1 control · reaches 1 of 10 techniques
- LCLines of Communication2 controls · reaches 1 of 10 techniques
By Control
- TA-5 Tempo Degradation Trigger6 techniques — To plan for the periods in which tempo predictably falls, so that the measured advantage is not a statement about the organization's best hours only.
- SM-2 Maneuver Assignment3 techniques — To bind defensive intent to specific ground, so that coverage reflects what protects which element rather than what the program has bought.
- TA-4 Pre-authorized Response3 techniques — To remove authority latency from the decision loop, so that the segment most programs cannot shorten with tooling is shortened by governance.
- CG-2 Phase Declaration2 techniques — To make "we are in Phase III" a sentence that changes behavior, rather than a label applied to a state of affairs.
- KT-2 Decisive Point Protection Floor2 techniques — To ensure designation produces protection, so that identifying a decisive point is an act with consequences rather than an annotation.
- CG-3 Rules of Engagement1 technique — To let operators act inside a known mandate rather than guessing at one, and to make the boundaries of that mandate legally and operationally sound.
- EN-4 Escalation and Engagement Authority1 technique — To remove the search for a decision-maker from the decision loop, which is where the decide segment is usually spent.
- ID-3 Authentication Assurance1 technique — To ensure authentication strength varies with what is being reached, and that the level achieved is available to the decision that relies on it.
- ID-4 Identity Assertion Protection1 technique — To prevent a valid authentication from becoming a durable, portable credential in an adversary's hands.
- LC-2 Component Provenance1 technique — To know where deployed components came from and what is inside them, so that a compromise disclosed anywhere can be located here.
- LC-4 Update Integrity and Staging1 technique — To limit the blast radius of a compromised trusted update, so that supply chain compromise reaches a ring rather than the estate.
- TA-1 Decision Loop Measurement1 technique — To make the defender's tempo a measured quantity rather than an impression, so that the numerator of temporal advantage exists at all.
The tempo controls carry this form: whether delay measures are pre-authorized, how fast they engage, and whether adversary tempo actually drops relative to defender decision tempo. The command controls test whether the availability floor was declared in advance. A delay program with no measured effect on relative tempo is friction, not maneuver.
Sequencing
A scheme names a sequence, not a set. These are the ordinary neighbors of this form — not a mandatory order, but the order in which each one’s preconditions are usually met.
Typically Preceded By
- M3 EnvelopmentStep-up and session reduction are enforced by the identity envelope.
- M5 AmbushDeception supplies the high-confidence trigger that makes delay proportionate.
Typically Followed By
- M7 CounterattackTime bought is spent hunting and evicting; delay is not an end state.
- M8 Isolation / RetrogradeIf delay is not buying enough, give ground deliberately rather than continuously.
Named as a successor by M3 Envelopment, M4 Obstacle / Canalization, M5 Ambush. Derived from those forms’ own declarations, so the two directions of the sequence cannot disagree.
Named as a predecessor by M7 Counterattack, M8 Isolation / Retrograde. Derived the same way, from the other direction.