saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/implementing-zero-standing-privilege-with-cyberark/references/standards.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

1.6 KiB
Raw Blame History

Zero Standing Privilege with CyberArk - Standards Reference

Zero Trust Frameworks

NIST SP 800-207 - Zero Trust Architecture

  • Never trust, always verify
  • Least privilege access to resources
  • Microsegmentation and policy enforcement points
  • Dynamic, risk-based access policies

CISA Zero Trust Maturity Model

  • Identity pillar: JIT/JEA access for all identities
  • Advanced maturity: Automated privilege provisioning/deprovisioning
  • Optimal maturity: Continuous verification with ephemeral access

TEA Framework Components

Time

  • Session duration: minimum required for task completion
  • CyberArk default: 1 hour, configurable 15 min to 8 hours
  • Business hours enforcement optional
  • Auto-termination on session inactivity

Entitlements

  • Principle of least privilege
  • Dynamic role creation scoped to specific resources
  • Permission boundaries to prevent escalation
  • Entitlement analytics for right-sizing

Approvals

  • Risk-based approval routing
  • Multi-level approval for critical access
  • Auto-approval for previously approved, low-risk requests
  • ITSM integration (ServiceNow, Jira) for audit trail

Compliance Requirements

SOC 2 - CC6

  • CC6.1: Logical access security restricted
  • CC6.3: Access authorized, modified, removed timely
  • ZSP provides evidence of no standing privileges

PCI DSS v4.0

  • 7.2.1: Access limited to least privilege
  • 7.2.4: Access reviewed at least every 6 months
  • ZSP eliminates the review burden by removing standing access

SOX Section 404

  • Separation of duties enforcement
  • Access to financial systems must be controlled
  • JIT access provides clear audit trail of who accessed what, when