What it does. Implements continuous, risk-adaptive identity verification for zero trust Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-identity-verification-for-zero-trust/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-identity-verification-for-zero-trust, or copy the skill folder into ~/.claude/skills/implementing-identity-verification-for-zero-trust/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-identity-verification-for-zero-trust/SKILL.md

SKILL.md (verbatim)

name: implementing-identity-verification-for-zero-trust
description: Implements continuous, risk-adaptive identity verification for zero trust
  using phishing-resistant MFA (FIDO2/WebAuthn), risk-based conditional access, and
  identity governance aligned with NIST SP 800-207 and the CISA Zero Trust Maturity
  Model Identity Pillar. Use when designing zero trust identity controls, deploying
  phishing-resistant MFA, or building conditional access policies based on device
  posture, behavior, and location.
domain: cybersecurity
subdomain: zero-trust-architecture
tags:
- zero-trust
- identity
- authentication
- mfa
- identity-verification
version: '1.0'
author: mahipal
license: Apache-2.0
atlas_techniques:
- AML.T0052
nist_ai_rmf:
- GOVERN-1.1
- GOVERN-1.7
- MAP-1.1
nist_csf:
- PR.AA-01
- PR.AA-05
- PR.IR-01
- GV.PO-01
mitre_attack:
- T1078
- T1190
- T1059
- T1566
- T1598
mitre_f3:
  version: '1.1'
  tactics:
  - initial-access
  - positioning
  - reconnaissance
  techniques:
  - id: F1006
    name: Account Takeover
    tactic: initial-access
    source: f3
  - id: T1110.004
    name: 'Brute Force:  Credential Stuffing'
    tactic: initial-access
    source: attack
  - id: T1111
    name: Multi-Factor Authentication Interception
    tactic: initial-access
    source: attack
  - id: T1557
    name: Adversary-in-the-Middle
    tactic: initial-access
    source: attack
  - id: T1539
    name: Steal Web Session Cookie
    tactic: positioning
    source: attack
  - id: T1598
    name: Phishing for Information
    tactic: reconnaissance
    source: attack

Implementing Identity Verification for Zero Trust

Prerequisites

• Understanding of zero trust principles (NIST SP 800-207)
• Familiarity with identity providers (Azure AD, Okta, Ping Identity)
• Knowledge of authentication protocols (SAML 2.0, OIDC, FIDO2)
• Understanding of MFA and passwordless authentication

Overview

Identity is the foundational pillar of zero trust architecture. NIST SP 800-207 mandates that all resource authentication and authorization are dynamic and strictly enforced before access is allowed. Identity verification in zero trust goes beyond traditional username/password by implementing continuous, risk-adaptive authentication using multiple signals including device posture, behavioral biometrics, location, and network context.

This skill covers implementing phishing-resistant MFA, continuous identity verification, risk-based conditional access, and identity governance aligned with the CISA Zero Trust Maturity Model Identity Pillar.

When to Use

• When deploying or configuring implementing identity verification for zero trust capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Familiarity with zero trust architecture concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Architecture

Identity Verification Flow

User Access Request
    │
    v
┌───────────────────────┐
│ Primary Authentication │
│ - FIDO2/WebAuthn key  │
│ - Certificate-based    │
│ - Passwordless         │
└──────────┬────────────┘
           v
┌───────────────────────┐
│ Contextual Assessment  │
│ - Device posture       │
│ - Network location     │
│ - Geo-velocity check   │
│ - Time of access       │
│ - Behavioral baseline  │
└──────────┬────────────┘
           v
┌───────────────────────┐
│ Risk Scoring Engine    │
│ - Aggregate signals    │
│ - Calculate risk score │
│ - Compare to threshold │
└───┬──────────┬────────┘
    │          │
 Low Risk   High Risk
    │          │
    v          v
┌────────┐  ┌──────────────┐
│ Grant  │  │ Step-up Auth  │
│ Access │  │ - Hardware key│
│        │  │ - Biometric   │
│        │  │ - Manager OK  │
└────────┘  └──────────────┘

Identity Provider Architecture

1. Primary IdP: Azure AD / Okta / Ping Identity for centralized identity management
2. FIDO2 Authenticators: Hardware security keys (YubiKey) or platform authenticators (Windows Hello, Touch ID)
3. Risk Engine: Adaptive access using identity threat detection (Microsoft Entra ID Protection, Okta ThreatInsight)
4. Identity Governance: Lifecycle management, access reviews, just-in-time provisioning
5. Privileged Identity: Separate verification for elevated access (CyberArk, BeyondTrust)

Key Concepts

Phishing-Resistant MFA

FIDO2/WebAuthn eliminates phishable credentials by binding authentication to the origin domain. Hardware security keys and platform authenticators provide cryptographic proof of identity without transmitting secrets.

Continuous Identity Verification

Rather than authenticating once at session start, zero trust requires ongoing verification through session token evaluation, behavioral analytics, and periodic re-authentication challenges based on risk signals.

Risk-Based Conditional Access

Conditional access policies evaluate multiple signals (user risk level, sign-in risk, device compliance, location) to dynamically adjust authentication requirements and access grants.

Identity Threat Detection

AI-driven analytics detect compromised identities through impossible travel detection, anomalous sign-in patterns, credential stuffing detection, and token replay attacks.

Workflow

Phase 1: Identity Infrastructure

1. Consolidate Identity Providers

   • Audit all identity sources across the organization
   • Federate to a single authoritative IdP using SAML 2.0 or OIDC
   • Configure SCIM for automated provisioning and deprovisioning
   • Eliminate local accounts and shared credentials

2. Deploy Phishing-Resistant MFA

   • Enroll all users in FIDO2/WebAuthn with hardware security keys
   • Configure platform authenticators (Windows Hello for Business, macOS Touch ID)
   • Disable SMS and voice call as MFA methods (phishable)
   • Create conditional access policy requiring phishing-resistant methods for all sign-ins

3. Configure Conditional Access Policies

   • Require compliant device for access to sensitive applications
   • Block legacy authentication protocols (basic auth, IMAP, POP3)
   • Require MFA for all users from untrusted locations
   • Enforce session time limits with re-authentication
   • Block or require additional verification for high-risk sign-ins

Phase 2: Risk-Based Authentication

4. Enable Identity Threat Detection

   • Activate Microsoft Entra ID Protection or Okta ThreatInsight
   • Configure risk levels: low (allow), medium (require MFA), high (block and investigate)
   • Enable impossible travel detection and anomalous token alerts
   • Integrate identity risk signals with SIEM/SOAR

5. Implement Step-Up Authentication

   • For sensitive operations (privilege elevation, financial transactions), require additional verification
   • Configure step-up policies: re-authenticate with hardware key
   • Integrate with PAM for privileged session approval workflows
   • Log all step-up events for audit trail

Phase 3: Continuous Verification

6. Deploy Continuous Access Evaluation (CAE)

   • Enable Continuous Access Evaluation Protocol (CAEP) for real-time token revocation
   • Configure critical event triggers: user disabled, password changed, location change
   • Test that token revocation occurs within minutes (not hours) of security event
   • Monitor CAE event logs for operational health

7. Implement Session Controls

   • Configure session duration limits based on application sensitivity
   • Enable sign-in frequency controls (re-authenticate every N hours)
   • Implement persistent browser session controls
   • Configure app-enforced restrictions for unmanaged devices

Phase 4: Identity Governance

8. Automate Identity Lifecycle

   • Configure joiner-mover-leaver workflows with HR system integration
   • Automate access provisioning based on role and department
   • Enable just-in-time access for temporary elevated permissions
   • Configure automatic access expiration for contractors and guests

9. Implement Access Reviews

   • Schedule quarterly access certification campaigns
   • Configure automated reminders and escalation
   • Require manager approval for continued access
   • Auto-revoke access for unreviewed certifications

Validation Checklist

• Single authoritative IdP with all applications federated
• FIDO2/WebAuthn enrolled for all users
• SMS and voice MFA methods disabled
• Legacy authentication protocols blocked
• Conditional access policies enforced for all applications
• Identity threat detection active with risk-based policies
• Continuous Access Evaluation enabled and tested
• Step-up authentication configured for sensitive operations
• Identity lifecycle automated with HR integration
• Quarterly access reviews scheduled and operational
• Identity events streaming to SIEM

References

• NIST SP 800-207: Zero Trust Architecture
• NIST SP 800-63B: Digital Identity Guidelines - Authentication
• CISA Zero Trust Maturity Model v2.0 - Identity Pillar
• FIDO Alliance WebAuthn Specification
• Microsoft Entra Conditional Access Documentation

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Identity Verification Implementation Plan Template

Project Information

Field	Value
Project Name
Organization
Identity Provider	[Azure AD / Okta / Ping Identity]
User Population
Target Completion

Current State Assessment

Identity Infrastructure

• Primary IdP: |
• Secondary IdPs: |
• Local Accounts: [Count and locations] |
• Shared Accounts: [Count - target for elimination] |

Current MFA State

Method	Enabled	Users Enrolled	Phishing-Resistant
SMS OTP			No
Voice Call			No
TOTP App			No
Push Notification			No
FIDO2 Security Key			Yes
Windows Hello			Yes
Certificate/PIV			Yes

MFA Enrollment Target

• Current enrollment rate: ___%
• Target enrollment rate: 100%
• Phishing-resistant target: 100%

Phishing-Resistant MFA Rollout Plan

Hardware Key Distribution

User Group	Key Type	Quantity	Distribution Method	Timeline
Executive Leadership	YubiKey 5 NFC		In-person	Week 1
IT Administrators	YubiKey 5C		IT distribution	Week 2
All Employees	YubiKey Security Key		Self-service + mail	Weeks 3-8

Enrollment Campaign

• Communication sent to all users
• Self-service portal configured
• Help desk trained on enrollment support
• Enrollment deadline set: ____
• Escalation path for non-compliant users

Conditional Access Policies

Policy Name	Users	Apps	Conditions	Grant Controls	Session Controls
Block Legacy Auth	All	All	Legacy clients	Block	N/A
Require MFA	All	All	Any	Require MFA	Sign-in freq: 8hr
Require Compliant Device	All	Sensitive Apps	Any	Compliant device	App enforced
Block Risky Sign-In	All	All	High sign-in risk	Block	N/A
Require FIDO2 for Admins	Admin roles	Admin portals	Any	FIDO2 only	1hr frequency

Risk-Based Policies

Risk Level	User Risk Response	Sign-In Risk Response
Low	Allow	Allow
Medium	Require MFA step-up	Require MFA step-up
High	Block + alert SOC	Block + alert SOC

Identity Governance

Lifecycle Automation

• HR system integrated for joiner/mover/leaver
• Automatic provisioning on hire
• Role change triggers access review
• Automatic deprovisioning on termination
• Contractor access expiration configured

Access Reviews

• Frequency: Quarterly
• Scope: All application assignments
• Reviewers: Direct managers
• Auto-action on non-response: Revoke access

Monitoring and Detection

Capability	Tool	Status
Sign-in log analysis	SIEM (Splunk/Sentinel)
Identity threat detection	Entra ID Protection / ThreatInsight
Impossible travel detection	IdP + UEBA
Continuous Access Evaluation	CAE/CAEP
Behavioral analytics	UEBA platform

Sign-Off

Stakeholder	Role	Approval	Date
	CISO
	Identity Team Lead
	Help Desk Manager
	HR Systems

references/api-reference.md (verbatim)

API Reference: Implementing Identity Verification for Zero Trust

CISA Zero Trust Maturity Model - Identity Pillar

Level	Description	Requirements
Traditional	Password-based, static policies	Basic auth
Initial	MFA deployed, basic conditional access	MFA for all users
Advanced	Phishing-resistant MFA, risk-based	FIDO2, risk signals
Optimal	Continuous verification, passwordless	Behavioral analytics

Azure AD Conditional Access API

import requests
headers = {"Authorization": "Bearer <token>"}
policies = requests.get(
    "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies",
    headers=headers).json()

FIDO2/WebAuthn Registration

const credential = await navigator.credentials.create({
    publicKey: {
        rp: { name: "Example Corp" },
        user: { id: userId, name: email, displayName: name },
        challenge: serverChallenge,
        pubKeyCredParams: [{ type: "public-key", alg: -7 }],
        authenticatorSelection: { residentKey: "required" },
    }
});

Conditional Access Signals

Signal	Source	Zero Trust Level
Device compliance	MDM/Intune	Initial
Location/IP	Network context	Initial
User risk	Identity Protection	Advanced
Sign-in risk	Real-time analysis	Advanced
Session behavior	UEBA	Optimal

Okta Authentication Policies API

curl -X GET "https://DOMAIN.okta.com/api/v1/policies?type=ACCESS_POLICY" \
  -H "Authorization: SSWS <token>"

References

• CISA Zero Trust Maturity Model: https://www.cisa.gov/zero-trust-maturity-model
• NIST SP 800-207: https://csrc.nist.gov/pubs/sp/800/207/final
• FIDO Alliance: https://fidoalliance.org/fido2/

references/standards.md (verbatim)

Standards and Frameworks Reference

NIST SP 800-207: Zero Trust Architecture - Identity

Core Identity Tenets

• All resource authentication and authorization are dynamic and strictly enforced before access is allowed
• The enterprise collects as much information as possible about the current state of assets, network infrastructure, and communications and uses it to improve its security posture
• Access decisions should consider behavioral attributes, environmental attributes, and the identity of the requester

Policy Engine Identity Inputs

The Policy Engine (PE) uses the following identity-related inputs:

• User identity and attributes from the IdP
• Device identity and posture from the endpoint management system
• Behavioral attributes from user and entity behavior analytics (UEBA)
• Environmental attributes (location, time, network)

NIST SP 800-63B: Digital Identity Guidelines

Authentication Assurance Levels (AAL)

AAL	Description	Methods	Zero Trust Mapping
AAL1	Some assurance	Single-factor (password)	Insufficient for ZT
AAL2	High confidence	Multi-factor (push notification, OTP)	Minimum for ZT
AAL3	Very high confidence	Hardware-based (FIDO2, PIV card)	Target for ZT

Phishing-Resistant Authenticators

• FIDO2/WebAuthn: Cryptographic authentication bound to origin domain
• PIV/CAC smart cards: Certificate-based authentication
• Not phishing-resistant: SMS OTP, voice calls, push notifications, TOTP

CISA Zero Trust Maturity Model v2.0 - Identity Pillar

Maturity Level	Authentication	Identity Store	Risk Assessment	Visibility
Traditional	Password + basic MFA	Multiple disconnected stores	None	Basic audit logs
Initial	MFA for all users	Federated IdP	Static risk rules	Centralized auth logs
Advanced	Phishing-resistant MFA	Single authoritative IdP with SCIM	Risk-based conditional access	Identity analytics
Optimal	Continuous verification	Automated lifecycle governance	AI-driven threat detection	Real-time UEBA

FIDO Alliance Standards

FIDO2 / WebAuthn

• W3C Web Authentication specification for passwordless authentication
• Public-key cryptography: private key never leaves the authenticator
• Origin-bound: authentication is cryptographically tied to the service domain
• Resistant to phishing, replay, and man-in-the-middle attacks

Passkeys

• Evolution of FIDO2 for consumer and enterprise use
• Synced across devices via platform credential managers (iCloud Keychain, Google Password Manager)
• Discoverable credentials eliminate need to remember usernames

Microsoft Entra (Azure AD) Identity Protection

Risk Detection Categories

Risk Type	Detection	Response
Anonymous IP	Sign-in from anonymous proxy/VPN	Require MFA
Atypical travel	Impossible travel between sign-in locations	Block + investigate
Malware-linked IP	Sign-in from known malicious IP	Block
Unfamiliar sign-in	Unusual sign-in properties	Step-up auth
Leaked credentials	Credentials found in dark web dumps	Force password reset
Token anomaly	Unusual token characteristics	Revoke session

Continuous Access Evaluation Protocol (CAEP)

• Real-time token revocation on security events
• Critical events: user disabled, password changed, high risk detected
• Reduces token lifetime gap from hours to near real-time
• Supported by Microsoft 365, Exchange Online, SharePoint Online

Okta Identity Security

Okta ThreatInsight

• Pre-authentication threat detection using IP reputation
• Credential stuffing protection
• Bot detection and rate limiting
• Anomalous location and device detection

Okta FastPass

• Passwordless, phishing-resistant authentication
• Device-bound biometric verification
• Continuous device trust assessment
• No shared secrets transmitted over network

references/workflows.md (verbatim)

Identity Verification Workflows

Workflow 1: Zero Trust Authentication Flow

User Initiates Access
    │
    v
┌─────────────────────────┐
│ 1. Pre-Authentication    │
│ - Check IP reputation    │
│ - Rate limit evaluation  │
│ - Bot detection          │
│ - Geo-blocking check     │
└──────────┬──────────────┘
           v
┌─────────────────────────┐
│ 2. Primary Authentication│
│ - FIDO2 key challenge    │
│ - Biometric verification │
│ - Certificate validation │
│ - Passwordless flow      │
└──────────┬──────────────┘
           v
┌─────────────────────────┐
│ 3. Context Assessment    │
│ - Device compliance      │
│ - Network location       │
│ - Time of access         │
│ - Behavioral baseline    │
│ - Previous session state │
└──────────┬──────────────┘
           v
┌─────────────────────────┐
│ 4. Risk Calculation      │
│ - User risk level        │
│ - Sign-in risk level     │
│ - Aggregate score        │
└───┬──────────┬──────┬───┘
    │          │      │
  LOW        MED    HIGH
    │          │      │
    v          v      v
┌──────┐ ┌────────┐ ┌────────┐
│Grant │ │Step-Up │ │Block + │
│Token │ │ Auth   │ │Alert   │
└──────┘ └────────┘ └────────┘

Workflow 2: Continuous Access Evaluation

Active Session
    │
    v
┌──────────────────────────────┐
│ Continuous Monitoring Loop    │
│                               │
│  ┌─── Check every N minutes ──┐
│  │                             │
│  │  ┌─────────────────────┐   │
│  │  │ Signal Collection    │   │
│  │  │ - Device compliance  │   │
│  │  │ - User risk change   │   │
│  │  │ - Location shift     │   │
│  │  │ - Behavior anomaly   │   │
│  │  └──────────┬──────────┘   │
│  │             v               │
│  │  ┌─────────────────────┐   │
│  │  │ Critical Events      │   │
│  │  │ - Account disabled   │   │
│  │  │ - Password changed   │   │
│  │  │ - MFA registration   │   │
│  │  │ - Admin revocation   │   │
│  │  └──────────┬──────────┘   │
│  │             v               │
│  │  ┌─────────────────────┐   │
│  │  │ Re-Evaluate Access   │   │
│  │  │ - Recalculate risk   │   │
│  │  │ - Apply policy       │   │
│  │  └───┬─────────┬───────┘   │
│  │      │         │           │
│  │   Continue   Revoke        │
│  │   Session    Token         │
│  └──────┘         │           │
│                   v           │
│           ┌──────────────┐    │
│           │ Force Re-Auth│    │
│           │ or Terminate │    │
│           └──────────────┘    │
└──────────────────────────────┘

Workflow 3: FIDO2 Enrollment

Admin Initiates Enrollment Campaign
    │
    v
┌──────────────────────────┐
│ 1. User Notification      │
│ - Email with instructions │
│ - Self-service portal URL │
│ - Deadline for enrollment │
└──────────┬───────────────┘
           v
┌──────────────────────────┐
│ 2. User Self-Service      │
│ - Authenticate with       │
│   existing credentials    │
│ - Register security key   │
│   (YubiKey, Titan key)    │
│ - Register platform auth  │
│   (Windows Hello, TouchID)│
│ - Register backup method  │
└──────────┬───────────────┘
           v
┌──────────────────────────┐
│ 3. Verification           │
│ - Test sign-in with FIDO2 │
│ - Confirm backup works    │
│ - Record key serial/ID    │
└──────────┬───────────────┘
           v
┌──────────────────────────┐
│ 4. Policy Enforcement     │
│ - Enable phishing-resist  │
│   conditional access      │
│ - Disable legacy MFA      │
│ - Monitor compliance rate │
└──────────────────────────┘

Workflow 4: Compromised Identity Response

Identity Threat Detected
    │
    v
┌──────────────────────────┐
│ 1. Detection Signal       │
│ - Impossible travel       │
│ - Leaked credentials      │
│ - Token anomaly           │
│ - Behavioral deviation    │
└──────────┬───────────────┘
           v
┌──────────────────────────┐
│ 2. Automated Response     │
│ - Revoke all sessions     │
│ - Disable account         │
│ - Trigger SOAR playbook   │
│ - Notify SOC analyst      │
└──────────┬───────────────┘
           v
┌──────────────────────────┐
│ 3. Investigation          │
│ - Review sign-in logs     │
│ - Check accessed resources│
│ - Correlate with EDR data │
│ - Interview user          │
└──────────┬───────────────┘
           v
┌──────────────────────────┐
│ 4. Remediation            │
│ - Reset all credentials   │
│ - Re-enroll FIDO2 keys    │
│ - Review and restrict     │
│   access permissions      │
│ - Re-enable account       │
│ - Update detection rules  │
└──────────────────────────┘

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.