Zero › Module 5 › Lesson 3
Policy Design
Policy groups literacy — map users, devices, apps to segmentation labels — policy group table on YOUR $ZT_LAB network folder.
Visual · t40_policy_groups
Policy groups. $ZT_LAB. Original Cyberlium.
Opening
Segments need identities — policy groups bind IdP groups and device tags to microseg rules on LAB-ZT-001.
Policy groups (App-Finance, Role-Engineering, Device-Compliant, Env-Prod literacy) drive segmentation rules dynamically. Change group membership → access path updates without IP churn. Table: Group name | Members source | Segments allowed | Linked CA policy — fictional. Next: Microseg Lab.
1. Policy group types (named)
User/group from IdP. Device compliance tag from MDM. App classification label. Environment (prod/dev) label.
Combine labels for compound rules — engineering + compliant device → dev segment.
Command guide
Try these commands — Policy group types (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final CISA ZTMM Networks — https://www.cisa.gov/zero-trust-maturity-model
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_NETWORK=${ZT_NETWORK:-$ZT_LAB/LAB-ZT-001/network}
cat > "$ZT_NETWORK/policy-groups-table.md" <<'EOF'
# Policy Groups — LAB-ZT-001
| Group | Source | Segments allowed |
|-------|--------|------------------|
| PG-Engineering | IdP Eng group | dev, ci, app-read |
| PG-Finance | IdP Finance group | app, reporting |
| PG-Admin | IdP Admin + PAM | admin-jump, app-admin |
| PG-Compliant-Device | MDM compliant tag | all assigned user segments |
| PG-NonCompliant | MDM non-compliant | quarantine-web-only |
| PG-Guest | B2B guest | collab-apps-only |
Dynamic groups beat static VLAN ACLs for hybrid workforce
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'PG-|Compliant|quarantine|LAB SAMPLE' "$ZT_NETWORK/policy-groups-table.md"
python3 -c "print('Policy groups link IdP/MDM labels to segments')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM Networks (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Link to identity and device pillars
CA-002 admin group maps to Admin-Segment policy group. Non-compliant device tag → quarantine segment literacy.
Cross-reference M3 and M4 packs in table footnotes.
3. Lab table
Eight fictional policy groups with segment mapping for LAB-ZT-001.
Ship: policy group table. Next: Microseg Lab.
4. What you ship: policy group table
Eight groups mapped to segments and IdP/MDM sources. $ZT_LAB. chmod 600.
5. What you record before the next lesson
Date. Policy groups. $ZT_LAB named. File t40-m05-l03-policy-groups.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use real employee names in group table. Static IP ACLs only — ignore identity labels.
Right
Write policy group table linking IdP and device tags to segments. Next: Microseg Lab.
Mission: policy group table
1) Define eight fictional policy groups. 2) Map each to allowed segments. 3) Link two groups to M3 CA policies. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Dynamic groups beat static VLAN ACLs when workforce is hybrid.
Knowledge Check
APPLY: Policy groups connect:
Multiple choice
Knowledge Check
APPLY: True or False: IdP group changes can update segment access.
True or False
Knowledge Check
APPLY: Policy group table uses:
Multiple choice