Zero › Module 8 › Lesson 3
Continuous Eval
Trust scoring literacy — composite risk score from signals — trust score matrix on YOUR $ZT_LAB policy folder.
Visual · t40_trust_scoring
Trust scoring. $ZT_LAB. Original Cyberlium.
Opening
PDP needs a number sometimes — document how identity, device, behavior, and threat feeds combine into allow/limit/block on LAB-ZT-001.
Trust score: weighted inputs from IdP risk, device compliance, data sensitivity, anomaly detection, threat intel match literacy. Outputs: allow, allow with restrictions, step-up, block. Matrix: Signal | Weight | Source | Example value — fictional scoring model stub. Transparent scoring beats black-box vendor trust. Next: Policy Lab.
1. Score inputs (named)
Identity: MFA method, sign-in risk. Device: compliance, EDR health. Behavior: impossible travel, new device. Threat: IOC match literacy.
Data: app sensitivity raises threshold for allow.
Command guide
Try these commands — Score inputs (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-207 trust algorithm — https://csrc.nist.gov/publications/detail/sp/800-207/final CISA ZTMM — https://www.cisa.gov/zero-trust-maturity-model
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_POLICY=${ZT_POLICY:-$ZT_LAB/LAB-ZT-001/policy}
cat > "$ZT_POLICY/trust-scoring-matrix.md" <<'EOF'
# Trust Scoring Matrix — LAB-ZT-001 (fictional model)
| Signal | Weight | Source | Example |
|--------|--------|--------|---------|
| MFA method strength | 20 | IdP | FIDO2=high |
| Sign-in risk | 20 | IdP | low/med/high |
| Device compliance | 20 | MDM | compliant=yes |
| EDR health | 15 | EDR | healthy |
| App sensitivity | 15 | Catalog | Restricted=strict |
| Behavior anomaly | 10 | UEBA | none=pass |
## Thresholds (fictional)
- 80+: allow | 50-79: step-up/limit | <50: block
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'Weight|Thresholds|80\+|LAB SAMPLE' "$ZT_POLICY/trust-scoring-matrix.md"
python3 -c "print('Trust score: weighted signals — fictional literacy stub')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-207 trust algorithm (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Output actions
High trust → allow. Medium → step-up or limited session. Low → block or quarantine VLAN literacy.
Document appeal/support path for false block — UX row on stub.
3. Scoring matrix
Eight signal rows with weight and sample fictional score contribution.
Ship: trust scoring matrix. Next: Policy Lab.
4. What you ship: trust scoring matrix
Eight weighted signals with allow/limit/block thresholds stub. $ZT_LAB. chmod 600.
5. What you record before the next lesson
Date. Trust scoring matrix. $ZT_LAB named. File t40-m08-l03-trust-scoring.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Single boolean MFA pass equals full trust forever. Hide scoring from auditors entirely.
Right
Write trust scoring matrix with medium-trust step-up row. Next: Policy Lab.
Mission: trust scoring matrix
1) Define eight scoring inputs. 2) Assign fictional weights summing to 100. 3) Document three output thresholds. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Weights are org-specific — document assumptions as fictional literacy.
Knowledge Check
APPLY: Trust score combines:
Multiple choice
Knowledge Check
APPLY: True or False: Medium trust may trigger step-up authentication.
True or False
Knowledge Check
APPLY: Trust score lab uses:
Multiple choice