Zero › Module 10 › Lesson 4
Lab — Capstone
Execute capstone on $ZT_LAB — checklist, lab path, evidence pack sealed; zero attack tool refs.
Visual · t40_capstone_lab
Capstone: checklist × $ZT_LAB literacy evidence. Original Cyberlium.
Opening
Close the ZT literacy loop — pillars linked, diagrams sealed, roadmap honest — without attack tools or fake maturity fraud.
Walk Topic 40 checklist on YOUR $ZT_LAB: verify org inventory, all pillar packs, policy master diagram links, NIST SP 800-207 cited, scan for attack tool keywords (must be zero). Update index with capstone UTC completion. Integrity paragraph: fictional org discipline and key insight from YOUR path. Optional mentor review — three clarity questions. chmod 600 after.
1. Execute checklist
Check each row; link artifact or N/A labeled LAB; confirm zero attack refs in any file.
Scan sealed pack for unauthorized employer data — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final CISA ZTMM — https://www.cisa.gov/zero-trust-maturity-model NIST Cybersecurity Framework — https://www.nist.gov/cyberframework
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
grep NEVER "$ZT_LAB/notes/no-attack-tools.txt" "$ZT_LAB/roe.txt"
grep -E 'never|attack|lateral' "$ZT_LAB/roe.txt"
echo '=== Capstone: principles → pillars → policy glue → roadmap → seal ==='
grep -E 'PEP|PDP|ALL pillars' "$ZT_POLICY/policy-engine-pack.md" 2>/dev/null || echo 'policy pack: create in M8 lab'
grep -E 'M-01|M-04' "$ZT_ROADMAP/zt-roadmap-gantt-stub.md" 2>/dev/null || true
grep '\[ \]' "$ZT_LAB/notes/capstone-checklist.txt" | head -5
curl -sS https://csrc.nist.gov/publications/detail/sp/800-207/final | head -5
python3 - <<'PY'
import os
lab = os.environ.get('ZT_LAB', os.path.expanduser('~/cyberlium-lab/t40-zt'))
path = os.path.join(lab, 'notes', 'capstone-summary.txt')
open(path, 'w').write('
'.join([
'Zero Trust Architecture Capstone',
'scope: YOUR $HOME/cyberlium-lab/t40-zt/ fictional LAB-ZT-001 only',
'principles: NIST SP 800-207 + verify explicitly + least privilege',
'pillars: identity, device, network/microseg, ZTNA/SASE, data, policy engine',
'roadmap: Gantt + CISA ZTMM maturity + KPI stubs (FICTional)',
'diagrams: microseg tiers, ZTNA path, PEP/PDP master signal flow',
'never: attack tools / lateral movement / unauthorized scanning / forged maturity certs',
'next topic: Topic 41 — Security Architecture & Design',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'scope|never|Topic 41|LAB-ZT-001' "$ZT_LAB/notes/capstone-summary.txt"
═══ WINDOWS ═══
Capstone on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t40-zt/notes/no-attack-tools.txt | Select-String NEVER Get-Content $HOME/cyberlium-lab/t40-zt/notes/capstone-summary.txt | Select-String never Get-Content $HOME/cyberlium-lab/t40-zt/LAB-ZT-001/policy/pep-pdp-diagram.md | Select-String PDP
Primary tools to practice this lesson: grep, python3, curl. Reference sites: NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM (https://www.cisa.gov/zero-trust-maturity-model); NIST Cybersecurity Framework (https://www.nist.gov/cyberframework). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Integrity paragraph
Fictional org inventory + LAB label discipline + honest maturity gap + policy diagram as integration hub → professional handoff from YOUR lab path.
Name what breaks if you skip LAB labels or use attack tools — ethics tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 41 Security Architecture & Design on separate track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed literacy pack + integrity paragraph + zero attack scan.
5. What you record before the next lesson
Capstone pack path. $ZT_LAB quiet.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone includes nmap internal scan walkthrough as bonus exhibit.
Right
Capstone complete on $ZT_LAB with full teardown. Next: topic quiz.
Mission: Topic 40 capstone
1) Walk checklist with evidence links. 2) Integrity paragraph from your path. 3) Seal pack — zero attack refs. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: 'Minimum N/A documentation?'
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Attack tools earn capstone credit.
True or False
Knowledge Check
APPLY: Capstone teardown includes:
Multiple choice