Zero › Module 8 › Lesson 1
PEP PDP Named
Policy Engine and Enforcement literacy — PEP, PDP, PA per NIST SP 800-207 — policy architecture diagram on YOUR $ZT_LAB policy folder.
Visual · t40_pep_pdp
PEP/PDP/PA named. $ZT_LAB. Original Cyberlium.
Opening
Decisions separate from enforcement — map PEP and PDP boxes on LAB-ZT-001 policy plane diagram with trust algorithm inputs.
PDP (Policy Decision Point): evaluates request against policy + signals. PEP (Policy Enforcement Point): allows/denies/limits session. PA (Policy Administrator): configures paths per PDP decision — NIST SP 800-207 alignment. Diagram: request → PEP → PDP ← signals (IdP, MDM, TI) → decision → PEP enforce. Fictional product names as labels OK. Next: Continuous Auth.
1. Component roles (named)
PEP: gateway, agent, firewall enforcement. PDP: policy engine brain. PA: orchestration of connection setup/teardown.
Trust algorithm inputs: identity, device, data class, threat intel, behavior literacy.
Command guide
Try these commands — Component roles (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-207 PEP/PDP — https://csrc.nist.gov/publications/detail/sp/800-207/final CISA ZTMM — https://www.cisa.gov/zero-trust-maturity-model
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_POLICY=${ZT_POLICY:-$ZT_LAB/LAB-ZT-001/policy}
curl -sS https://csrc.nist.gov/publications/detail/sp/800-207/final | head -10
cat > "$ZT_POLICY/pep-pdp-diagram.md" <<'EOF'
# PEP / PDP Policy Plane — LAB-ZT-001 (NIST SP 800-207 aligned)
```
Request → [PEP] → [PDP/PE] ← signals
↑
IdP | MDM | EDR | Data label | Threat intel | Behavior
Decision → [PA orchestrates] → PEP enforce/terminate
```
## Roles
- PDP: decides allow/limit/block from policy + trust algorithm
- PEP: gateway/agent/firewall enforcement point
- PA: configures path per decision
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'PEP|PDP|signals|LAB SAMPLE' "$ZT_POLICY/pep-pdp-diagram.md"
Primary tools to practice this lesson: curl, grep. Reference sites: NIST SP 800-207 PEP/PDP (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Policy sources
Enterprise policy database, IdP groups, classification labels, geo rules, risk score — feed PDP.
Single PDP per session ideal — avoid conflicting decision points.
3. Lab diagram
Full policy plane ASCII with labeled PEP/PDP/PA and five signal inputs from prior modules.
Ship: PEP/PDP architecture diagram. Next: Continuous Auth.
4. What you ship: PEP/PDP policy plane diagram
NIST-aligned diagram with signal inputs from identity/device/data pillars. $ZT_LAB. chmod 600.
5. What you record before the next lesson
Date. PEP/PDP diagram. $ZT_LAB named. File t40-m08-l01-pep-pdp-named.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Merge PEP and PDP into one box with no signal inputs. Skip NIST SP 800-207 reference.
Right
Draw PEP/PDP/PA diagram with five signal inputs. Next: Continuous Auth.
Mission: PEP/PDP diagram
1) Label PEP, PDP, PA roles. 2) List five trust algorithm inputs. 3) Draw request flow. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Cross-link M2 NIST component card — same vocabulary, fuller diagram here.
Knowledge Check
APPLY: PDP primarily:
Multiple choice
Knowledge Check
APPLY: True or False: PEP enforces the PDP decision.
True or False
Knowledge Check
APPLY: Policy plane diagram uses:
Multiple choice