Zero › Module 3 › Lesson 2
MFA Named
MFA and conditional access literacy — phishing-resistant methods, risk-based policies, step-up auth — conditional access matrix on YOUR $ZT_LAB.
Visual · t40_mfa_conditional
MFA + conditional access. $ZT_LAB. Original Cyberlium.
Opening
MFA is baseline — conditional access adds context rules so MFA alone is not the entire identity pillar.
Phishing-resistant MFA (FIDO2/WebAuthn literacy), conditional access policies (location, device compliance, app sensitivity), step-up authentication for admin actions. Document conditional access matrix: policy name, users, apps, conditions, grant controls — fictional LAB-ZT-001. Refused: MFA bypass tutorials, real user phone numbers in lab. Next: PAM Literacy.
1. MFA methods ranked (literacy)
Strongest literacy order: FIDO2/security keys, passkeys, authenticator app TOTP, push (with number matching literacy), SMS/voice (legacy weak).
Admin and break-glass: require phishing-resistant method on checklist.
Command guide
Try these commands — MFA methods ranked (literacy)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ZTMM Identity — https://www.cisa.gov/zero-trust-maturity-model NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_IDENTITY=${ZT_IDENTITY:-$ZT_LAB/LAB-ZT-001/identity}
cat > "$ZT_IDENTITY/conditional-access-matrix.md" <<'EOF'
# Conditional Access Matrix — LAB-ZT-001
| Policy | Users | Apps | Conditions | Grant |
|--------|-------|------|------------|-------|
| CA-001 | All | All | Any client | Block legacy auth |
| CA-002 | Admins | Admin consoles | Any | MFA + compliant device |
| CA-003 | Guests | External collab | External network | MFA + limited apps |
MFA priority: FIDO2 > authenticator app > SMS (legacy weak)
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'CA-00|Block legacy|FIDO2|LAB SAMPLE' "$ZT_IDENTITY/conditional-access-matrix.md"
python3 -c "print('CA matrix: block legacy auth = common Phase 1 win')"Primary tools to practice this lesson: grep, python3. Reference sites: CISA ZTMM Identity (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Conditional access dimensions
User/group, app, location, device platform, client app, sign-in risk literacy. Grant: require MFA, require compliant device, block legacy auth.
Each policy gets matrix row — block legacy auth is common first win on stubs.
3. Lab matrix
Three fictional policies: CA-001 block legacy auth, CA-002 admin step-up, CA-003 guest restricted apps.
Ship: conditional access matrix. Next: PAM Literacy.
4. What you ship: conditional access matrix
Three CA policy rows with conditions and grant controls. Fictional users. chmod 600.
5. What you record before the next lesson
Date. CA matrix. $ZT_LAB named. File t40-m03-l02-mfa-conditional.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Matrix allows legacy SMTP auth for convenience. Document MFA bypass as lab exercise.
Right
Write conditional access matrix with block-legacy row. Next: PAM Literacy.
Mission: conditional access matrix
1) Write three fictional CA policies. 2) Name MFA method requirements per policy. 3) Include block legacy auth row. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Block legacy auth closes more gaps than adding another SMS MFA user.
Knowledge Check
APPLY: Phishing-resistant MFA includes:
Multiple choice
Knowledge Check
APPLY: True or False: Conditional access can require compliant device.
True or False
Knowledge Check
APPLY: MFA bypass tutorials:
Multiple choice