Can CSD be enabled on a per-group-policy, post authentication?
A. Not currently as of v8.0.3. CSD is globably enabled on the ASA for all group-policies before Authentication/Authorization takes place. The main reason why Cisco Secure Desktop was loaded pre-login is to offer protection over the login process itself, especially when static credentials are in use.