Anthropic-Cybersecurity-Skills/skills/implementing-identity-verification-for-zero-trust/references/standards.md

Standards and Frameworks Reference

NIST SP 800-207: Zero Trust Architecture - Identity

Core Identity Tenets

• All resource authentication and authorization are dynamic and strictly enforced before access is allowed
• The enterprise collects as much information as possible about the current state of assets, network infrastructure, and communications and uses it to improve its security posture
• Access decisions should consider behavioral attributes, environmental attributes, and the identity of the requester

Policy Engine Identity Inputs

The Policy Engine (PE) uses the following identity-related inputs:

• User identity and attributes from the IdP
• Device identity and posture from the endpoint management system
• Behavioral attributes from user and entity behavior analytics (UEBA)
• Environmental attributes (location, time, network)

NIST SP 800-63B: Digital Identity Guidelines

Authentication Assurance Levels (AAL)

AAL	Description	Methods	Zero Trust Mapping
AAL1	Some assurance	Single-factor (password)	Insufficient for ZT
AAL2	High confidence	Multi-factor (push notification, OTP)	Minimum for ZT
AAL3	Very high confidence	Hardware-based (FIDO2, PIV card)	Target for ZT

Phishing-Resistant Authenticators

• FIDO2/WebAuthn: Cryptographic authentication bound to origin domain
• PIV/CAC smart cards: Certificate-based authentication
• Not phishing-resistant: SMS OTP, voice calls, push notifications, TOTP

CISA Zero Trust Maturity Model v2.0 - Identity Pillar

Maturity Level	Authentication	Identity Store	Risk Assessment	Visibility
Traditional	Password + basic MFA	Multiple disconnected stores	None	Basic audit logs
Initial	MFA for all users	Federated IdP	Static risk rules	Centralized auth logs
Advanced	Phishing-resistant MFA	Single authoritative IdP with SCIM	Risk-based conditional access	Identity analytics
Optimal	Continuous verification	Automated lifecycle governance	AI-driven threat detection	Real-time UEBA

FIDO Alliance Standards

FIDO2 / WebAuthn

• W3C Web Authentication specification for passwordless authentication
• Public-key cryptography: private key never leaves the authenticator
• Origin-bound: authentication is cryptographically tied to the service domain
• Resistant to phishing, replay, and man-in-the-middle attacks

Passkeys

• Evolution of FIDO2 for consumer and enterprise use
• Synced across devices via platform credential managers (iCloud Keychain, Google Password Manager)
• Discoverable credentials eliminate need to remember usernames

Microsoft Entra (Azure AD) Identity Protection

Risk Detection Categories

Risk Type	Detection	Response
Anonymous IP	Sign-in from anonymous proxy/VPN	Require MFA
Atypical travel	Impossible travel between sign-in locations	Block + investigate
Malware-linked IP	Sign-in from known malicious IP	Block
Unfamiliar sign-in	Unusual sign-in properties	Step-up auth
Leaked credentials	Credentials found in dark web dumps	Force password reset
Token anomaly	Unusual token characteristics	Revoke session

Continuous Access Evaluation Protocol (CAEP)

• Real-time token revocation on security events
• Critical events: user disabled, password changed, high risk detected
• Reduces token lifetime gap from hours to near real-time
• Supported by Microsoft 365, Exchange Online, SharePoint Online

Okta Identity Security

Okta ThreatInsight

• Pre-authentication threat detection using IP reputation
• Credential stuffing protection
• Bot detection and rate limiting
• Anomalous location and device detection

Okta FastPass

• Passwordless, phishing-resistant authentication
• Device-bound biometric verification
• Continuous device trust assessment
• No shared secrets transmitted over network