Zero › Module 2 › Lesson 2
Assume Breach
Verify explicitly means authenticate and authorize every access request with identity, device, and context signals — document verify-explicitly checklist row on YOUR $ZT_LAB policy stub.
Visual · t40_verify_explicitly
Verify explicitly tenet. $ZT_LAB. Original Cyberlium.
Opening
Every request gets scrutiny — Cyberlium maps verify explicitly to IdP authN, authZ, device posture, and session context on fictional LAB-ZT-001 flows.
NIST ZT tenet: always authenticate and authorize based on available data points — user identity, device health, location literacy, application sensitivity, anomaly signals. No silent trust because the laptop joined the corporate LAN yesterday. Document verify-explicitly flow: user → IdP → device compliance check → policy decision → PEP enforcement. Fictional app access example on $ZT_LAB. Next: Least Privilege.
1. Signals for explicit verification (named)
Identity: MFA, step-up auth, session lifetime. Device: MDM compliance, EDR health, patch level. Context: geo, time, app sensitivity, risk score literacy.
Each signal gets a checklist row on YOUR policy matrix — not implicit VPN trust.
Command guide
Try these commands — Signals for explicit verification (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final CISA ZTMM — https://www.cisa.gov/zero-trust-maturity-model
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
cat > "$ZT_LAB/notes/verify-explicitly-flow.md" <<'EOF'
# Verify Explicitly Flow — LAB-ZT-001
```
User → IdP (authN) → Device Posture Check → PDP (authZ + context)
→ PEP → App (Finance SaaS fictional)
```
## Signals checked (named)
- Identity: MFA + session lifetime
- Device: MDM compliance + EDR health
- Context: app sensitivity + sign-in risk literacy
## Anti-pattern refused
- VPN connected = implicit trust to all subnets
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'Verify|Device Posture|Anti-pattern|LAB SAMPLE' "$ZT_LAB/notes/verify-explicitly-flow.md"
python3 -c "print('Verify explicitly: per-request signals — not LAN trust')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Common failure modes
VPN connected = full network access. Shared kiosk without step-up. Service account without rotation. Legacy app bypassing IdP — document as gap on LAB-ZT-001 stub.
Verify explicitly closes these gaps in design — not by attacking legacy apps in student lab.
3. Lab flow diagram
ASCII or markdown diagram: User → IdP → Device Posture → PDP → PEP → App. Label each verification point.
Ship: verify-explicitly flow for one fictional SaaS app. Next: Least Privilege.
4. What you ship: verify-explicitly flow diagram
One app access flow with named verification signals. $ZT_LAB fictional org. chmod 600.
5. What you record before the next lesson
Date. Verify flow diagram. $ZT_LAB named. File t40-m02-l02-verify-explicitly.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Diagram shows VPN tunnel then implicit trust to all subnets. Skip device posture because MFA exists.
Right
Draw verify-explicitly flow with identity + device + context. Next: Least Privilege.
Mission: verify-explicitly flow for one app
1) Pick fictional SaaS app on LAB-ZT-001. 2) List three verification signals. 3) Draw flow through PDP/PEP. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
MFA alone is not full verify explicitly — add device and context rows.
Knowledge Check
APPLY: Verify explicitly requires:
Multiple choice
Knowledge Check
APPLY: True or False: VPN connect implies verify explicitly complete.
True or False
Knowledge Check
APPLY: Verify-explicitly diagram belongs on:
Multiple choice