Zero › Module 5 › Lesson 2
East West Control
East-west traffic literacy — internal lateral paths, default deny, flow logging — east-west matrix on YOUR $ZT_LAB network folder.
Visual · t40_east_west
East-west traffic. $ZT_LAB. Original Cyberlium.
Opening
North-south got the budget — east-west kills breaches — map allowed internal flows on LAB-ZT-001 segment matrix.
East-west = workload-to-workload inside datacenter/cloud. ZT requires explicit allow rules: web→app on 443, app→db on 5432, deny app→app peer. Log denies to tune policy. Document east-west matrix: source segment, dest segment, port, justification, owner — fictional flows only. Next: Policy Groups.
1. East-west principles
Default deny between segments. Allow minimum ports/protocols. Inspect where feasible (IDS/internal NGFW literacy).
No implicit trust because both servers are in datacenter.
Command guide
Try these commands — East-west principles
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final CISA ZTMM Networks — https://www.cisa.gov/zero-trust-maturity-model
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_NETWORK=${ZT_NETWORK:-$ZT_LAB/LAB-ZT-001/network}
cat > "$ZT_NETWORK/east-west-flow-matrix.csv" <<'EOF'
flow_id,source_segment,dest_segment,port,protocol,justification,owner
F-001,web,app,443,tcp,User HTTP to app API,Platform
F-002,app,db,5432,tcp,App queries only,DBA
F-003,app,logging,514,udp,Structured logs,SOC
F-004,admin-jump,app,22,tcp,Break-glass admin SSH,IT Sec
F-005,ci,artifact,443,tcp,Deploy packages,DevOps
F-006,default,default,any,any,DENY ALL OTHER,east-west default
EOFCommand — copy this
grep -E 'F-00|DENY ALL|5432' "$ZT_NETWORK/east-west-flow-matrix.csv"
python3 -c "print('East-west: deny-default + explicit allow rows — design only')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM Networks (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Common gaps on stubs
App tier talks to all DBs. Dev VLAN reaches prod. Over-broad SMB/RDP between segments — mark as fictional findings.
Design remediation rows — not exploit walkthroughs.
3. Flow matrix
Minimum six allow rows + explicit deny default note for LAB-ZT-001.
Ship: east-west flow matrix. Next: Policy Groups.
4. What you ship: east-west flow matrix
Segment-to-segment allow table with justification column. Deny-default note. chmod 600.
5. What you record before the next lesson
Date. East-west matrix. $ZT_LAB named. File t40-m05-l02-east-west.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Matrix allows any-to-any internal for lab ease. Scan internal nets to discover flows.
Right
Write east-west matrix with deny-default and six allow rows. Next: Policy Groups.
Mission: east-west flow matrix
1) Define three segments. 2) Write six allow flows with ports. 3) Document deny-default rule. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Justification column trains auditor questions — not just port lists.
Knowledge Check
APPLY: East-west traffic is:
Multiple choice
Knowledge Check
APPLY: True or False: Datacenter location implies trust between servers.
True or False
Knowledge Check
APPLY: East-west matrix on Cyberlium uses:
Multiple choice