Zero › Module 7 › Lesson 2
App Access
Application wrapping and isolation literacy — containerized apps, browser isolation, virtual desktop — app access table on YOUR $ZT_LAB.
Visual · t40_app_wrapping
App wrapping literacy. $ZT_LAB. Original Cyberlium.
Opening
Sensitive apps need isolation — name app wrapping, browser isolation, and VDI patterns on LAB-ZT-001 app catalog.
App wrapping: MAM containers on mobile, enterprise browser profiles, isolated VDI/DAAS for high-risk apps literacy. Reduces data exfil when device is unmanaged. Table: App | Sensitivity | Delivery mode (native/ZTNA/isolated browser/VDI) | DLP policy link — fictional apps. Next: DLP Literacy.
1. Isolation patterns (named)
Enterprise browser with download/print restrictions. Remote browser isolation (RBI) for untrusted web. App proxy with tokenization literacy.
VDI for apps that cannot move to SaaS ZTNA path yet.
Command guide
Try these commands — Isolation patterns (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ZTMM Applications — https://www.cisa.gov/zero-trust-maturity-model NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_DATA=${ZT_DATA:-$ZT_LAB/LAB-ZT-001/data}
cat > "$ZT_DATA/app-wrapping-table.md" <<'EOF'
# App Wrapping / Isolation Table — LAB-ZT-001
| App | Sensitivity | Delivery | Notes |
|-----|-------------|----------|-------|
| HR SaaS | Confidential | ZTNA + SSO | Standard corp device |
| Finance ERP | Restricted | ZTNA + step-up MFA | Compliant device required |
| Dev Git | Confidential | ZTNA | Engineer role only |
| Partner collab | Internal | Isolated browser | Guest tier |
| Legacy ERP | Restricted | VDI stub | Cannot ZTNA yet — VPN coexist |
BYOD: app protection / isolated browser — no full corp data sync
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'Restricted|Isolated|BYOD|LAB SAMPLE' "$ZT_DATA/app-wrapping-table.md"
python3 -c "print('App wrapping: tier-driven delivery mode')"Primary tools to practice this lesson: grep, python3. Reference sites: CISA ZTMM Applications (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. BYOD linkage
Unmanaged device → browser isolation or MAM-wrapped app only — no full corp data sync.
Cross-link M4 BYOD hygiene row.
3. App access table
Eight fictional apps with delivery mode and sensitivity from M7 L1 matrix.
Ship: app wrapping table. Next: DLP Literacy.
4. What you ship: app wrapping table
Eight apps with delivery mode and isolation notes. $ZT_LAB fictional. chmod 600.
5. What you record before the next lesson
Date. App wrapping table. $ZT_LAB named. File t40-m07-l02-app-wrapping.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Deliver Restricted apps to unmanaged devices natively. Teach data exfil as lab exercise.
Right
Write app wrapping table with isolation for Restricted tier. Next: DLP Literacy.
Mission: app wrapping table
1) List eight fictional apps. 2) Assign delivery mode per sensitivity. 3) Link BYOD rule for one app. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Isolation is data pillar — complements ZTNA network path.
Knowledge Check
APPLY: App wrapping/isolation protects:
Multiple choice
Knowledge Check
APPLY: True or False: Restricted apps may require VDI or isolated browser.
True or False
Knowledge Check
APPLY: Data exfil tutorials in ZT lab:
Multiple choice