Zero › Module 5 › Lesson 1
Segment Goals
Microsegmentation literacy — segment by app, user, data sensitivity — not flat VLAN trust — microseg overview card on YOUR $ZT_LAB network folder.
Visual · t40_microseg_named
Microsegmentation named. $ZT_LAB. Original Cyberlium.
Opening
Flat network died with the laptop — Cyberlium teaches microseg vocabulary: workload segments, policy groups, east-west inspection literacy on fictional LAB-ZT-001.
Microsegmentation divides network into granular zones so compromise in one segment does not imply lateral movement freedom. Implements via software-defined segmentation (Illumio, Guardicore literacy), NGFW internal rules, hypervisor NSX, cloud security groups — design concepts on lab diagrams. Refused: lateral movement labs to prove flat network bad. Write microseg overview card. Next: East West.
1. Microseg goals (named)
Limit blast radius. Enforce least privilege east-west. Map segments to apps/data classes. Log denied flows for tuning.
Align segments to ZT policy groups — not only north-south firewall.
Command guide
Try these commands — Microseg goals (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-207 microsegmentation — https://csrc.nist.gov/publications/detail/sp/800-207/final CISA ZTMM Networks — https://www.cisa.gov/zero-trust-maturity-model
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_NETWORK=${ZT_NETWORK:-$ZT_LAB/LAB-ZT-001/network}
curl -sS https://csrc.nist.gov/publications/detail/sp/800-207/final | head -8
cat > "$ZT_NETWORK/microseg-overview.md" <<'EOF'
# Microsegmentation Overview — LAB-ZT-001
## Goals (named)
- Limit east-west blast radius
- Enforce workload least privilege
- Log denied flows for tuning
## Pattern chosen (fictional)
- Software-defined segmentation + cloud security groups literacy
## Tier diagram (ASCII)
```
[Web tier] --443--> [App tier] --5432--> [DB tier]
deny default between all other flows
```
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'blast radius|deny default|LAB SAMPLE' "$ZT_NETWORK/microseg-overview.md"
Primary tools to practice this lesson: curl, grep. Reference sites: NIST SP 800-207 microsegmentation (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM Networks (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Implementation patterns literacy
Agent-based host firewall policies. Network-based internal NGFW. Cloud SG/NACL per tier. Identity-aware microseg (user/device label).
LAB-ZT-001 picks one primary pattern — document in overview card.
3. Diagram stub
ASCII: Web tier | App tier | DB tier — deny by default, allow listed flows only.
Ship: microseg overview + tier diagram. Next: East West.
4. What you ship: microseg overview card
Goals + pattern pick + three-tier diagram stub. $ZT_LAB fictional. chmod 600.
5. What you record before the next lesson
Date. Microseg overview. $ZT_LAB named. File t40-m05-l01-microseg-named.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Draw one flat VLAN for lab simplicity. Run lateral movement to demo microseg need.
Right
Write microseg overview with three-tier deny-default diagram. Next: East West.
Mission: microseg overview
1) Name four microseg goals. 2) Pick implementation pattern for LAB-ZT-001. 3) Draw three-tier diagram. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Deny-default between tiers — allow rules need business justification row.
Knowledge Check
APPLY: Microsegmentation primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Microseg aligns with least privilege for workloads.
True or False
Knowledge Check
APPLY: Lateral movement labs to teach microseg:
Multiple choice