Network › Module 10 › Lesson 3
Zero Trust Never Trust the Network
The LAN is not an identity. Authenticate users and devices you own — even on “home Wi-Fi.”
Visual · zero_trust_identity
Zero Trust: never trust the network. Original Cyberlium.
Opening
“I'm on the Wi-Fi” is not a login. It is a radio coincidence until identity says otherwise.
Zero Trust, said without vendor slides, is: the network location is not proof. Being associated to an SSID, having a 10.x address, or sitting on the “private” VLAN is not the same as a user and a device passing MFA, posture, and authorization. Home labs still benefit: do not expose admin panels to “anyone who guessed the PSK.” Work labs still benefit: VPN plus flat trust is how ransomware walks. Original Cyberlium — not a SASE vendor cert, not a license to bypass someone else's Zero Trust.
1. Trust is a decision about a principal, not a subnet
A principal is a user, a device, a workload. A subnet is a set of addresses. Zero Trust says authorization follows the principal (and context), not the fact that ARP succeeded on a friendly SSID. Topic 11 already showed ARP and DNS can lie; Zero Trust is the adult conclusion.
You still isolate guests and IoT. Isolation reduces accidents. It does not replace identity on the apps that matter.
2. Home translation: admin planes stay off the guest radio
Router UIs, NAS admin, camera clouds, and Topic 11 teaching servers do not belong on “whoever has Wi-Fi.” Teaching servers already bind 127.0.0.1. Home admin should not be WAN-exposed. PSK knowledge is a weak principal.
If GATE stopped you at Router Admin for the demo URL, you still do not brute-force it. You write: next time I own that UI, I will not publish it to the WAN, and I will not treat PSK as MFA.
Command guide
Home translation: admin planes stay off the guest radio
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
curl -sS -m 2 -I "$SAFE/" | head -n 6
3. Work translation: assume breach on the LAN
If malware lands on one printer-adjacent laptop, a flat “trusted LAN” is a hallway. Identity-aware proxies, least privilege, and not using the same local admin password everywhere are the boring controls. This course will not implement a vendor SSE fabric in a Python toy.
Cyberlium XP for finishing Topic 11 is practice credit. It is not a Zero Trust architecture certification.
4. What you ship: “network ≠ identity” in your own words
Principal vs subnet note. Home: no WAN admin, no PSK-as-MFA, loopback teaching binds. Work: assume LAN breach. XP is not a cert. DEMO GATE holds.
5. What you record before the next lesson
t11-m10-zt.txt. DEMO identified/STOP. SAFE NEVER hydra/aircrack/nmap /24. Next: Home Wi-Fi and Identity Checklist lab.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Treat home PSK as proof for tax-folder shares. Expose router admin to WAN. hydra to “verify Zero Trust.” Bypass a company ZTNA for a meme.
Right
Write network ≠ identity. Keep labs on loopback. Next: Lab — Home Wi-Fi and Identity Checklist.
Mission: stop treating the SSID as a login
1) / STOP if router. 2) Write principal vs subnet in cyberlium-lab. 3) Note PSK is not MFA and Do not hydra. Do not aircrack. Do not nmap the LAN.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor how loopback bind is a tiny Zero Trust cousin — not how to bypass corporate device posture.
Knowledge Check
APPLY: A NAS share is “allowed for anyone on 192.168.1.0/24.” Zero Trust critique?
Multiple choice
Knowledge Check
APPLY: True or False: Knowing the home Wi-Fi passphrase is equivalent to MFA.
True or False
Knowledge Check
APPLY: Topic 11 teaching servers bind 127.0.0.1 because:
Multiple choice