<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-adaptive-authentication
description: >-
  Implement risk-based adaptive authentication that dynamically adjusts
  authentication requirements based on user behavior, device trust, location,
  and real-time risk signals using conditional access policies.
domain: cybersecurity
subdomain: identity-security
tags:
  - adaptive-authentication
  - conditional-access
  - risk-based-auth
  - step-up-auth
  - mfa
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - T1078
  - T1556
  - T1621
  - T1550
---

# Implementing Adaptive Authentication

## Overview

Adaptive authentication moves beyond static MFA to dynamically adjust
authentication strength based on real-time risk signals. It evaluates device
trust, location, behavior patterns, and threat intelligence to determine
whether to allow, challenge, or block access.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Python 3.10+ | Agent tooling |
| SIEM access | Log correlation |
| IdP API access | Identity provider queries |
| `pip install msal` | Microsoft auth library |
| `pip install okta` | Okta SDK |

## Key Concepts

### Adaptive Authentication Decision Engine

```python
RISK_SIGNALS = {
    "device_trust": {"weight": 0.25, "signals": ["managed", "compliant", "known"]},
    "location": {"weight": 0.20, "signals": ["corporate_ip", "known_geo", "vpn"]},
    "behavior": {"weight": 0.25, "signals": ["normal_hours", "typical_app", "usual_pattern"]},
    "threat_intel": {"weight": 0.15, "signals": ["ip_reputation", "tor_exit", "proxy"]},
    "session": {"weight": 0.15, "signals": ["token_age", "mfa_freshness", "device_change"]},
}

RESPONSE_ACTIONS = {
    "low_risk": "allow",        # Score > 80
    "medium_risk": "step_up",   # Score 50-80: require additional factor
    "high_risk": "block",       # Score < 50: deny and alert
}
```

### Conditional Access Policy Matrix

| Condition | Low Risk | Medium Risk | High Risk |
|---|---|---|---|
| Corporate device + office | Allow | Allow | Step-up MFA |
| Known device + known location | Allow | Step-up MFA | Block |
| Unknown device + new location | Step-up MFA | Block | Block + alert |
| Any + impossible travel | Block | Block + alert | Block + lock |

## Workflow

```
1. BASELINE   — Establish normal authentication patterns per user/group
2. DEFINE     — Create risk signal weights and threshold policies
3. CONFIGURE  — Deploy conditional access policies in report-only mode
4. MONITOR    — Analyze policy impact and false positive rates
5. ENFORCE    — Switch policies to enforcement mode
6. TUNE       — Adjust thresholds based on operational feedback
7. ITERATE    — Add new signals and refine risk model
```

## Verification

```bash
# Validate agent script
python3 -m py_compile scripts/agent.js && echo "OK" || echo "FAIL"
ruff check scripts/agent.js

# Run agent help
node scripts/agent.js --help
```

## References

- [MITRE ATT&CK — Identity Techniques](https://attack.mitre.org/tactics/TA0006/)
- [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-3/)
- [NIST SP 800-207 Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
- [CIS Controls v8](https://www.cisecurity.org/controls/v8)
