MFA Named
MFA and conditional access literacy — phishing-resistant methods, risk-based policies, step-up auth — conditional access matrix on YOUR $ZT_LAB.
Visual · t40_mfa_conditional
MFA + conditional access. $ZT_LAB. Original Cyberlium.
MFA is baseline — conditional access adds context rules so MFA alone is not the entire identity pillar.
Phishing-resistant MFA (FIDO2/WebAuthn literacy), conditional access policies (location, device compliance, app sensitivity), step-up authentication for admin actions. Document conditional access matrix: policy name, users, apps, conditions, grant controls — fictional LAB-ZT-001. Refused: MFA bypass tutorials, real user phone numbers in lab. Next: PAM Literacy.
1. MFA methods ranked (literacy)
Strongest literacy order: FIDO2/security keys, passkeys, authenticator app TOTP, push (with number matching literacy), SMS/voice (legacy weak).
Admin and break-glass: require phishing-resistant method on checklist.
Command guide
Try these commands — MFA methods ranked (literacy)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: CISA ZTMM Identity (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Conditional access dimensions
User/group, app, location, device platform, client app, sign-in risk literacy. Grant: require MFA, require compliant device, block legacy auth.
Each policy gets matrix row — block legacy auth is common first win on stubs.
3. Lab matrix
Three fictional policies: CA-001 block legacy auth, CA-002 admin step-up, CA-003 guest restricted apps.
Ship: conditional access matrix. Next: PAM Literacy.
4. What you ship: conditional access matrix
Three CA policy rows with conditions and grant controls. Fictional users. chmod 600.
5. What you record before the next lesson
Date. CA matrix. $ZT_LAB named. File t40-m03-l02-mfa-conditional.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Matrix allows legacy SMTP auth for convenience. Document MFA bypass as lab exercise.
- Right: Write conditional access matrix with block-legacy row. Next: PAM Literacy.
Mission: conditional access matrix
1) Write three fictional CA policies. 2) Name MFA method requirements per policy. 3) Include block legacy auth row. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Block legacy auth closes more gaps than adding another SMS MFA user.
APPLY: Phishing-resistant MFA includes:
APPLY: True or False: Conditional access can require compliant device.
APPLY: MFA bypass tutorials: