East West Control
East-west traffic literacy — internal lateral paths, default deny, flow logging — east-west matrix on YOUR $ZT_LAB network folder.
Visual · t40_east_west
East-west traffic. $ZT_LAB. Original Cyberlium.
North-south got the budget — east-west kills breaches — map allowed internal flows on LAB-ZT-001 segment matrix.
East-west = workload-to-workload inside datacenter/cloud. ZT requires explicit allow rules: web→app on 443, app→db on 5432, deny app→app peer. Log denies to tune policy. Document east-west matrix: source segment, dest segment, port, justification, owner — fictional flows only. Next: Policy Groups.
1. East-west principles
Default deny between segments. Allow minimum ports/protocols. Inspect where feasible (IDS/internal NGFW literacy).
No implicit trust because both servers are in datacenter.
Command guide
Try these commands — East-west principles
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM Networks (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Common gaps on stubs
App tier talks to all DBs. Dev VLAN reaches prod. Over-broad SMB/RDP between segments — mark as fictional findings.
Design remediation rows — not exploit walkthroughs.
3. Flow matrix
Minimum six allow rows + explicit deny default note for LAB-ZT-001.
Ship: east-west flow matrix. Next: Policy Groups.
4. What you ship: east-west flow matrix
Segment-to-segment allow table with justification column. Deny-default note. chmod 600.
5. What you record before the next lesson
Date. East-west matrix. $ZT_LAB named. File t40-m05-l02-east-west.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Matrix allows any-to-any internal for lab ease. Scan internal nets to discover flows.
- Right: Write east-west matrix with deny-default and six allow rows. Next: Policy Groups.
Mission: east-west flow matrix
1) Define three segments. 2) Write six allow flows with ports. 3) Document deny-default rule. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Justification column trains auditor questions — not just port lists.
APPLY: East-west traffic is:
APPLY: True or False: Datacenter location implies trust between servers.
APPLY: East-west matrix on Cyberlium uses:
Policy Design
Part of Zero Trust Architecture — Microsegmentation.
Lab — Segments
Part of Zero Trust Architecture — Microsegmentation.
Quiz — Microsegmentation
Part of Zero Trust Architecture — Microsegmentation.