Policy as Code
Continuous authentication and authorization literacy — session re-eval, step-up, revoke — continuous auth checklist on YOUR $ZT_LAB.
Visual · t40_continuous_auth
Continuous auth. $ZT_LAB. Original Cyberlium.
Login once trust forever is dead — document session re-check triggers on LAB-ZT-001 policy stub.
Continuous authZ: re-evaluate on risk change, sensitive action, time elapsed, device posture drift, threat intel match literacy. Step-up MFA for admin actions. Session revoke on device non-compliance. Checklist: trigger | action | example — six rows fictional. Next: Trust Scoring.
1. Re-eval triggers (named)
Sign-in risk elevated. Device falls out of compliance. Sensitive app action (download, admin API). Long idle session. Geo velocity anomaly literacy.
Each trigger maps to step-up, restrict, or revoke action.
Command guide
Try these commands — Re-eval triggers (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Session lifecycle
Short-lived tokens, refresh with re-validation, admin session recording link to M3 PAM.
No perpetual API keys without rotation on checklist gap row.
3. Checklist
Six continuous auth trigger rows linked to PDP policy IDs fictional.
Ship: continuous auth checklist. Next: Trust Scoring.
4. What you ship: continuous auth checklist
Six trigger/action rows linked to PDP. $ZT_LAB fictional. chmod 600.
5. What you record before the next lesson
Date. Continuous auth checklist. $ZT_LAB named. File t40-m08-l02-continuous-auth.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Document infinite session lifetime as ZT best practice. Skip revoke on device non-compliance.
- Right: Write continuous auth checklist with step-up row. Next: Trust Scoring.
Mission: continuous auth checklist
1) List six re-eval triggers. 2) Map action per trigger. 3) Link one trigger to device posture from M4. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Sensitive download trigger is easy stakeholder example — use in diagram talk track.
APPLY: Continuous authorization means:
APPLY: True or False: Device non-compliance can trigger session revoke.
APPLY: Session hijack tutorials: