Lion Cipher Lab
Design a zero-trust identity architecture (IAM capstone)
- Identity & Access Management
- Advanced
- ~2–3 hours
- Free · no account required
Why it matters
Anyone can turn on MFA. The job of an identity architect is harder and rarer: taking a pile of individual controls — passkeys, SSO, RBAC, JIT, break-glass, access reviews — and designing them into ONE system that is coherent, defensible, and survives a real review. That design skill is what separates a technician from an engineer, and it is exactly what interviewers probe for. Zero trust ('never trust, always verify') is now the default expectation for enterprise and US federal systems, and identity is its first pillar — most breaches walk in through a valid login, not a firewall hole.…
What you'll learn
- Zero-trust architecture (identity pillar)
- Identity lifecycle design (joiner/mover/leaver)
- Authenticator assurance levels (NIST 800-63B)
- Policy decision point / conditional access design
- Least privilege and just-in-time authorization
- Break-glass design
- Control-to-requirement mapping
- Security design documentation
Steps in this lab
- What 'zero trust' actually means — and why identity is the first pillar
- Meet the organization you're designing for
- Deliverable 1: lay out the architecture document skeleton
- Section 1 — Identity sources and the joiner/mover/leaver lifecycle
- Section 2 — Authentication policy: assurance levels and phishing-resistant MFA
- Section 3 — The policy decision point and conditional access
- Section 4 — Authorization model: RBAC, least privilege, and JIT for admins
- Section 5 — Break-glass: the exception you design ON PURPOSE
- Section 6 — Monitoring and continuous verification
- Deliverable 2: the control-to-requirement mapping (and the diagram)
- Defend it: the trade-offs a reviewer will push on