Zero › Module 8 › Lesson 2
Policy as Code
Continuous authentication and authorization literacy — session re-eval, step-up, revoke — continuous auth checklist on YOUR $ZT_LAB.
Visual · t40_continuous_auth
Continuous auth. $ZT_LAB. Original Cyberlium.
Opening
Login once trust forever is dead — document session re-check triggers on LAB-ZT-001 policy stub.
Continuous authZ: re-evaluate on risk change, sensitive action, time elapsed, device posture drift, threat intel match literacy. Step-up MFA for admin actions. Session revoke on device non-compliance. Checklist: trigger | action | example — six rows fictional. Next: Trust Scoring.
1. Re-eval triggers (named)
Sign-in risk elevated. Device falls out of compliance. Sensitive app action (download, admin API). Long idle session. Geo velocity anomaly literacy.
Each trigger maps to step-up, restrict, or revoke action.
Command guide
Try these commands — Re-eval triggers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final CISA ZTMM — https://www.cisa.gov/zero-trust-maturity-model
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_POLICY=${ZT_POLICY:-$ZT_LAB/LAB-ZT-001/policy}
cat > "$ZT_POLICY/continuous-auth-checklist.md" <<'EOF'
# Continuous Auth Checklist — LAB-ZT-001
| Trigger | Action | Policy ID |
|---------|--------|-----------|
| Sign-in risk elevated | Step-up MFA | POL-001 |
| Device non-compliant | Revoke sensitive sessions | POL-002 |
| Sensitive download | Step-up + DLP audit | POL-003 |
| Idle > 8h | Re-auth required | POL-004 |
| Geo velocity anomaly | Block + alert SOC | POL-005 |
| Threat IOC match | Block session | POL-006 |
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'Trigger|Step-up|Revoke|POL-00' "$ZT_POLICY/continuous-auth-checklist.md"
python3 -c "print('Continuous auth: re-eval on drift — not login once forever')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Session lifecycle
Short-lived tokens, refresh with re-validation, admin session recording link to M3 PAM.
No perpetual API keys without rotation on checklist gap row.
3. Checklist
Six continuous auth trigger rows linked to PDP policy IDs fictional.
Ship: continuous auth checklist. Next: Trust Scoring.
4. What you ship: continuous auth checklist
Six trigger/action rows linked to PDP. $ZT_LAB fictional. chmod 600.
5. What you record before the next lesson
Date. Continuous auth checklist. $ZT_LAB named. File t40-m08-l02-continuous-auth.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Document infinite session lifetime as ZT best practice. Skip revoke on device non-compliance.
Right
Write continuous auth checklist with step-up row. Next: Trust Scoring.
Mission: continuous auth checklist
1) List six re-eval triggers. 2) Map action per trigger. 3) Link one trigger to device posture from M4. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Sensitive download trigger is easy stakeholder example — use in diagram talk track.
Knowledge Check
APPLY: Continuous authorization means:
Multiple choice
Knowledge Check
APPLY: True or False: Device non-compliance can trigger session revoke.
True or False
Knowledge Check
APPLY: Session hijack tutorials:
Multiple choice