Zero › Module 7 › Lesson 3
Encryption Hygiene
Data Loss Prevention literacy — detect/block exfil at endpoint, network, cloud — DLP policy stub on YOUR $ZT_LAB data folder.
Visual · t40_dlp_literacy
DLP literacy. $ZT_LAB. Original Cyberlium.
Opening
DLP enforces classification — write detect/block rules for Restricted tier placeholders on LAB-ZT-001 — design not exfil demos.
DLP channels: endpoint, email, web upload, cloud SaaS CASB, on-prem network literacy. Actions: audit, warn, block. Match rules to classification labels from M7 L1. DLP policy stub: three rules for Restricted/Confidential fictional patterns — credit card placeholder regex literacy, bulk download, personal cloud upload block. Refused: building exfil tools. Next: Data Apps Lab.
1. DLP channels (named)
Endpoint: USB, print, clipboard. Email: attachment scan. Web: upload to personal cloud. SaaS: CASB API policy. Network: egress inspect literacy.
ZT integrates DLP decision with PDP — block session if violation.
Command guide
Try these commands — DLP channels (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ZTMM Data — https://www.cisa.gov/zero-trust-maturity-model NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_DATA=${ZT_DATA:-$ZT_LAB/LAB-ZT-001/data}
cat > "$ZT_DATA/dlp-policy-stub.md" <<'EOF'
# DLP Policy Stub — LAB-ZT-001
| Rule | Tier | Channel | Action | Maturity |
|------|------|---------|--------|----------|
| DLP-001 | Restricted | Web upload | Block personal cloud | Enforce |
| DLP-002 | Confidential | Email attach | Audit → warn | Tune |
| DLP-003 | Restricted | Endpoint USB | Block | Enforce |
Start audit-only → tune false positives → enforce on Restricted
Refused: exfil demo scripts; real PAN/PII samples
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'DLP-00|Refused|audit-only|LAB SAMPLE' "$ZT_DATA/dlp-policy-stub.md"
python3 -c "print('DLP: label-aligned rules — design stub only')"Primary tools to practice this lesson: grep, python3. Reference sites: CISA ZTMM Data (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Rule design literacy
Start audit-only → tune false positives → enforce block on Restricted. Label-based rules beat ad-hoc keyword soup.
Incident workflow: alert → SOC triage → user coaching — fictional ticket stub.
3. Policy stub
Three DLP rules linked to classification tiers with action and channel columns.
Ship: DLP policy stub. Next: Data Apps Lab.
4. What you ship: DLP policy stub
Three rules linked to classification labels. Fictional patterns only. chmod 600.
5. What you record before the next lesson
Date. DLP stub. $ZT_LAB named. File t40-m07-l03-dlp-literacy.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write exfil script to test DLP. Use real PAN samples in rule testing.
Right
Write DLP policy stub with audit-then-block maturity note. Next: Data Apps Lab.
Mission: DLP policy stub
1) Name five DLP channels. 2) Write three rules with tier linkage. 3) Document tune-then-block maturity. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Audit-first reduces false positive pain — document maturity in roadmap M9.
Knowledge Check
APPLY: DLP primarily:
Multiple choice
Knowledge Check
APPLY: True or False: DLP rules should align to classification labels.
True or False
Knowledge Check
APPLY: Exfil demo scripts in Cyberlium lab:
Multiple choice