Zero › Module 1 › Lesson 4
Lab — Setup
Lab setup creates YOUR $ZT_LAB folder tree — LAB-ZT-001 fictional org, pillar subfolders, lab.env with ZT_LAB exports, roe.txt with diagram/checklist allowed list.
Visual · t40_lab_setup
Lab setup. $ZT_LAB tree. Original Cyberlium.
Opening
Folder discipline before architecture work — Cyberlium ZT lab mirrors pillar structure so capstone evidence packs assemble cleanly.
Create $HOME/cyberlium-lab/t40-zt/ with notes/, LAB-ZT-001/ and subfolders: identity/, devices/, network/, data/, policy/, roadmap/. Write lab.env exporting ZT_LAB paths and roe.txt stating fictional org, allowed artifacts, and never attack tools. Optional: org-profile.md with hybrid workforce fictional label. chmod 600 on sensitive notes. Next: Quiz — ZT Mindset and Lab.
1. Folder tree (named)
t40-zt/notes — ethics, literacy stubs. LAB-ZT-001/identity — IdP policy matrix stubs. devices/ — posture checklist. network/ — microseg + ZTNA diagrams. data/ — classification matrix. policy/ — PEP/PDP literacy. roadmap/ — maturity + KPI stubs.
lab.env exports ZT_LAB, ZT_ORG, and pillar paths for gold command consistency.
Command guide
Try these commands — Folder tree (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final CISA ZTMM — https://www.cisa.gov/zero-trust-maturity-model
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
cat > "$ZT_LAB/roe.txt" <<'EOF'
ZT_LAB=$HOME/cyberlium-lab/t40-zt
org: fictional LAB-ZT-001 — hybrid SaaS literacy stub (not a real company)
targets: YOUR identity/, devices/, network/, data/, policy/, roadmap/ folders
never: attack tools; lateral movement; unauthorized scanning; VPN/ZTNA bypass how-tos
never: present LAB SAMPLE artifacts as production architecture sign-off
allowed: architecture diagrams; checklists; policy matrices; maturity/KPI stubs
allowed: curl csrc.nist.gov SP 800-207, cisa.gov ZTMM, nist.gov cyberframework
output: markdown/ASCII stubs in lab folder — educational only
EOFCommand — copy this
chmod 600 "$ZT_LAB/roe.txt" grep -E 'ZT_LAB|never|allowed|LAB-ZT-001|LAB SAMPLE' "$ZT_LAB/roe.txt" cat > "$ZT_ORG/org-profile.md" <<'EOF' # LAB-ZT-001 — Fictional Org Profile (literacy only) - **Type:** Hybrid workforce SaaS literacy stub - **Scope:** cloud apps + remote users + on-prem legacy stub (fictional) - **Workforce:** 60% remote, 40% office — example.zt.local apps - **Frameworks:** NIST SP 800-207 + CISA ZTMM literacy - **Disclaimer:** NOT a real organization — templates for YOUR lab only EOF
Command — copy this
grep -E 'Fictional|Disclaimer|LAB-ZT-001' "$ZT_ORG/org-profile.md" ls -la "$ZT_ORG/"
═══ WINDOWS ═══
Run on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t40-zt/roe.txt | Select-String never Get-ChildItem $HOME/cyberlium-lab/t40-zt/LAB-ZT-001
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. RoE file contents
org: fictional LAB-ZT-001 — hybrid SaaS literacy stub. allowed: diagrams, checklists, policy matrices, curl NIST SP 800-207. never: attack tools, stranger network scans, employer diagram imports without scope.
Label all artifacts LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS.
3. Verify setup
ls pillar folders, grep ZT_LAB lab.env, confirm ethics files from M1 L1–L3 exist or will merge in capstone.
Ship: setup confirmation row with UTC date. Next: Quiz — ZT Mindset and Lab.
4. What you ship: $ZT_LAB folder tree + roe.txt
mkdir pillar tree, lab.env, roe.txt, org-profile.md stub. chmod 600 on env and roe.
5. What you record before the next lesson
Date. Setup paths. $ZT_LAB named. File t40-m01-l04-lab-setup.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip roe.txt because folders exist. Store lab.env world-readable with fictional org paths.
Right
Create $ZT_LAB tree with roe and org profile. Next: Quiz — ZT Mindset and Lab.
Mission: stand up YOUR $ZT_LAB
1) mkdir pillar subfolders under LAB-ZT-001. 2) Write lab.env and roe.txt. 3) org-profile.md fictional hybrid org stub. 4) chmod 600 on roe and lab.env.
Stuck? Ask Cyberlium AI Mentor
Pillar folders match Topic 40 module map — capstone packs index by folder.
Knowledge Check
APPLY: $ZT_LAB setup includes:
Multiple choice
Knowledge Check
APPLY: True or False: roe.txt should list never attack tools.
True or False
Knowledge Check
APPLY: LAB-ZT-001 is:
Multiple choice