<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-identity-posture-assessment
description: >-
  Assess and score the security posture of identity infrastructure including
  IdP configuration, MFA coverage, privilege hygiene, and federation security
  across Entra ID, Okta, and Active Directory environments.
domain: cybersecurity
subdomain: identity-security
tags:
  - identity-posture
  - security-assessment
  - cis-benchmarks
  - idp-hardening
  - mfa
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - T1078
  - T1098
  - T1136
  - T1087
  - T1069
---

# Performing Identity Posture Assessment

## Overview

Identity posture assessment evaluates the security configuration and hygiene
of identity infrastructure. It covers IdP hardening, MFA enrollment gaps,
privileged account hygiene, stale credentials, federation trust configuration,
and compliance with CIS and NIST benchmarks.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Python 3.10+ | Agent tooling |
| SIEM access | Log correlation |
| IdP API access | Identity provider queries |
| `pip install msal` | Microsoft auth library |
| `pip install okta` | Okta SDK |

## Key Concepts

### Posture Assessment Domains

| Domain | Checks | Benchmark |
|---|---|---|
| MFA Coverage | Enrollment %, method strength | NIST 800-63B AAL2+ |
| Privilege Hygiene | Admin count, standing access | CIS Control 5 |
| Credential Hygiene | Password age, reuse, leaked | CIS Control 5.2 |
| Federation Security | Trust config, token lifetime | NIST 800-63C |
| Conditional Access | Policy coverage, gaps | Microsoft best practices |
| Service Principals | Secret expiry, permissions | Least privilege |

### Scoring Model

```python
POSTURE_WEIGHTS = {
    "mfa_coverage": 0.25,
    "privilege_hygiene": 0.20,
    "credential_hygiene": 0.15,
    "federation_security": 0.15,
    "conditional_access": 0.15,
    "service_principal_hygiene": 0.10,
}
# Score: 0-100, where 100 = fully hardened
```

## Workflow

```
1. SCOPE       — Identify all identity providers and directories in scope
2. DISCOVER    — Enumerate accounts, groups, roles, and service principals
3. ASSESS      — Run posture checks against each domain
4. SCORE       — Calculate weighted posture score
5. PRIORITIZE  — Rank findings by risk and remediation effort
6. REMEDIATE   — Apply hardening recommendations
7. VALIDATE    — Re-assess to confirm posture improvement
```

## Verification

```bash
# Validate agent script
python3 -m py_compile scripts/agent.js && echo "OK" || echo "FAIL"
ruff check scripts/agent.js

# Run agent help
node scripts/agent.js --help
```

## References

- [MITRE ATT&CK — Identity Techniques](https://attack.mitre.org/tactics/TA0006/)
- [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-3/)
- [NIST SP 800-207 Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
- [CIS Controls v8](https://www.cisecurity.org/controls/v8)
