From asi
Implements continuous identity verification for zero trust using FIDO2/WebAuthn MFA, risk-based conditional access, and CISA Zero Trust-aligned governance. For secure enterprise auth setups.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- Understanding of zero trust principles (NIST SP 800-207)
Implements zero trust identity verification using FIDO2/WebAuthn MFA, risk-based conditional access, and CISA-aligned governance. For secure auth in enterprise environments.
Implements identity verification for zero-trust architecture using phishing-resistant MFA, continuous authentication, risk-based conditional access, FIDO2/WebAuthn, and IdPs like Azure AD or Okta.
Guides implementing zero trust architecture in AWS, Azure, GCP per NIST SP 800-207 and BeyondCorp: identity-centric controls, micro-segmentation, continuous verification, device assessment, Identity-Aware Proxy. For VPN elimination and regulatory compliance.
Share bugs, ideas, or general feedback.
Identity is the foundational pillar of zero trust architecture. NIST SP 800-207 mandates that all resource authentication and authorization are dynamic and strictly enforced before access is allowed. Identity verification in zero trust goes beyond traditional username/password by implementing continuous, risk-adaptive authentication using multiple signals including device posture, behavioral biometrics, location, and network context.
This skill covers implementing phishing-resistant MFA, continuous identity verification, risk-based conditional access, and identity governance aligned with the CISA Zero Trust Maturity Model Identity Pillar.
User Access Request
│
v
┌───────────────────────┐
│ Primary Authentication │
│ - FIDO2/WebAuthn key │
│ - Certificate-based │
│ - Passwordless │
└──────────┬────────────┘
v
┌───────────────────────┐
│ Contextual Assessment │
│ - Device posture │
│ - Network location │
│ - Geo-velocity check │
│ - Time of access │
│ - Behavioral baseline │
└──────────┬────────────┘
v
┌───────────────────────┐
│ Risk Scoring Engine │
│ - Aggregate signals │
│ - Calculate risk score │
│ - Compare to threshold │
└───┬──────────┬────────┘
│ │
Low Risk High Risk
│ │
v v
┌────────┐ ┌──────────────┐
│ Grant │ │ Step-up Auth │
│ Access │ │ - Hardware key│
│ │ │ - Biometric │
│ │ │ - Manager OK │
└────────┘ └──────────────┘
FIDO2/WebAuthn eliminates phishable credentials by binding authentication to the origin domain. Hardware security keys and platform authenticators provide cryptographic proof of identity without transmitting secrets.
Rather than authenticating once at session start, zero trust requires ongoing verification through session token evaluation, behavioral analytics, and periodic re-authentication challenges based on risk signals.
Conditional access policies evaluate multiple signals (user risk level, sign-in risk, device compliance, location) to dynamically adjust authentication requirements and access grants.
AI-driven analytics detect compromised identities through impossible travel detection, anomalous sign-in patterns, credential stuffing detection, and token replay attacks.
Consolidate Identity Providers
Deploy Phishing-Resistant MFA
Configure Conditional Access Policies
Enable Identity Threat Detection
Implement Step-Up Authentication
Deploy Continuous Access Evaluation (CAE)
Implement Session Controls
Automate Identity Lifecycle
Implement Access Reviews