Encryption Hygiene
Data Loss Prevention literacy — detect/block exfil at endpoint, network, cloud — DLP policy stub on YOUR $ZT_LAB data folder.
Visual · t40_dlp_literacy
DLP literacy. $ZT_LAB. Original Cyberlium.
DLP enforces classification — write detect/block rules for Restricted tier placeholders on LAB-ZT-001 — design not exfil demos.
DLP channels: endpoint, email, web upload, cloud SaaS CASB, on-prem network literacy. Actions: audit, warn, block. Match rules to classification labels from M7 L1. DLP policy stub: three rules for Restricted/Confidential fictional patterns — credit card placeholder regex literacy, bulk download, personal cloud upload block. Refused: building exfil tools. Next: Data Apps Lab.
1. DLP channels (named)
Endpoint: USB, print, clipboard. Email: attachment scan. Web: upload to personal cloud. SaaS: CASB API policy. Network: egress inspect literacy.
ZT integrates DLP decision with PDP — block session if violation.
Command guide
Try these commands — DLP channels (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: CISA ZTMM Data (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Rule design literacy
Start audit-only → tune false positives → enforce block on Restricted. Label-based rules beat ad-hoc keyword soup.
Incident workflow: alert → SOC triage → user coaching — fictional ticket stub.
3. Policy stub
Three DLP rules linked to classification tiers with action and channel columns.
Ship: DLP policy stub. Next: Data Apps Lab.
4. What you ship: DLP policy stub
Three rules linked to classification labels. Fictional patterns only. chmod 600.
5. What you record before the next lesson
Date. DLP stub. $ZT_LAB named. File t40-m07-l03-dlp-literacy.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Write exfil script to test DLP. Use real PAN samples in rule testing.
- Right: Write DLP policy stub with audit-then-block maturity note. Next: Data Apps Lab.
Mission: DLP policy stub
1) Name five DLP channels. 2) Write three rules with tier linkage. 3) Document tune-then-block maturity. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Audit-first reduces false positive pain — document maturity in roadmap M9.
APPLY: DLP primarily:
APPLY: True or False: DLP rules should align to classification labels.
APPLY: Exfil demo scripts in Cyberlium lab: