saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/implementing-identity-verification-for-zero-trust/assets/template.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

3.1 KiB
Raw Blame History

Identity Verification Implementation Plan Template

Project Information

Field Value
Project Name
Organization
Identity Provider [Azure AD / Okta / Ping Identity]
User Population
Target Completion

Current State Assessment

Identity Infrastructure

  • Primary IdP: |
  • Secondary IdPs: |
  • Local Accounts: [Count and locations] |
  • Shared Accounts: [Count - target for elimination] |

Current MFA State

Method Enabled Users Enrolled Phishing-Resistant
SMS OTP No
Voice Call No
TOTP App No
Push Notification No
FIDO2 Security Key Yes
Windows Hello Yes
Certificate/PIV Yes

MFA Enrollment Target

  • Current enrollment rate: ___%
  • Target enrollment rate: 100%
  • Phishing-resistant target: 100%

Phishing-Resistant MFA Rollout Plan

Hardware Key Distribution

User Group Key Type Quantity Distribution Method Timeline
Executive Leadership YubiKey 5 NFC In-person Week 1
IT Administrators YubiKey 5C IT distribution Week 2
All Employees YubiKey Security Key Self-service + mail Weeks 3-8

Enrollment Campaign

  • Communication sent to all users
  • Self-service portal configured
  • Help desk trained on enrollment support
  • Enrollment deadline set: ____
  • Escalation path for non-compliant users

Conditional Access Policies

Policy Name Users Apps Conditions Grant Controls Session Controls
Block Legacy Auth All All Legacy clients Block N/A
Require MFA All All Any Require MFA Sign-in freq: 8hr
Require Compliant Device All Sensitive Apps Any Compliant device App enforced
Block Risky Sign-In All All High sign-in risk Block N/A
Require FIDO2 for Admins Admin roles Admin portals Any FIDO2 only 1hr frequency

Risk-Based Policies

Risk Level User Risk Response Sign-In Risk Response
Low Allow Allow
Medium Require MFA step-up Require MFA step-up
High Block + alert SOC Block + alert SOC

Identity Governance

Lifecycle Automation

  • HR system integrated for joiner/mover/leaver
  • Automatic provisioning on hire
  • Role change triggers access review
  • Automatic deprovisioning on termination
  • Contractor access expiration configured

Access Reviews

  • Frequency: Quarterly
  • Scope: All application assignments
  • Reviewers: Direct managers
  • Auto-action on non-response: Revoke access

Monitoring and Detection

Capability Tool Status
Sign-in log analysis SIEM (Splunk/Sentinel)
Identity threat detection Entra ID Protection / ThreatInsight
Impossible travel detection IdP + UEBA
Continuous Access Evaluation CAE/CAEP
Behavioral analytics UEBA platform

Sign-Off

Stakeholder Role Approval Date
CISO
Identity Team Lead
Help Desk Manager
HR Systems