Authentication assurance & device trust
How do user authentication, device trust and the local session relate?
D01 · Identity Fundamentals · D02 · Authentication · D04 · Identity Protocols & Cryptography · D06 · Workforce & Directory Identity · D11 · Identity Security & Zero Trust
The source-backed concept
NIST defines authentication assurance levels and requirements for remote user authentication. This is not a workstation deployment blueprint.
Learning outcomes
- Compare authenticator assurance and recovery risks.
- Explain FIDO2, WebAuthn, Windows Hello and smart cards.
- Draw two flows: normal sign-in and lost-device recovery. Mark every trust decision.
Connect the concept to the question
- Identify the user, device, verifier and session boundary.
- Compare online sign-in, offline access and credential recovery.
- Document how device posture informs access to a remote application.
Proposed trust flow
- Employee
- Authenticator / device
- Verifier
- Workstation session
This flow is an editorial model to investigate, not a verified deployment.
Engineering trade-off
Usability and offline availability must be weighed against recovery abuse and residual sessions.
Verified source statement
Primary reference: NIST SP 800-63B-4 · Authentication. Reviewed 3 November 2026.
Only the bounded statement above is source-backed. The company context, investigation, controls and flow are teaching proposals. Confirm support and behavior in your chosen environment.
Produce evidence
Draw two flows: normal sign-in and lost-device recovery. Mark every trust decision.
Use L1 to explain the mechanism, L2 to analyze trade-offs, L3 to implement and test, and L4 to design and justify. Reading alone does not establish competence.