Strengthening defenses against identity-based attacks with NIST controls