Zero › Module 2 › Lesson 3
Explicit Verify
Least privilege means minimum access needed for the task — just-in-time, just-enough access checklist on YOUR $ZT_LAB identity policy matrix.
Visual · t40_least_privilege
Least privilege tenet. $ZT_LAB. Original Cyberlium.
Opening
Standing admin is anti-ZT — Cyberlium teaches JIT/JEA literacy rows on fictional LAB-ZT-001 role matrix without attack-tool privilege escalation demos.
Least privilege limits user/application access to minimum required. ZT extends with Just-In-Time (JIT) and Just-Enough-Access (JEA) — time-bound elevation, approval workflow literacy, automatic revocation. Document role matrix: default user, app-specific roles, break-glass admin with logging — on $ZT_LAB identity folder. Refused: privilege escalation exploits as lab exercise. Next: Principles Lab.
1. Least privilege patterns (named)
RBAC with narrow roles. ABAC with attribute conditions. JIT elevation with ticket + approval. JEA for admin PowerShell/session boundaries literacy.
Service accounts: scoped permissions, no interactive login, rotation schedule on checklist.
Command guide
Try these commands — Least privilege patterns (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final CISA ZTMM Identity pillar — https://www.cisa.gov/zero-trust-maturity-model
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
cat > "$ZT_LAB/notes/least-privilege-matrix.md" <<'EOF'
# Least Privilege Role Matrix — LAB-ZT-001
| Role | Apps | Permissions | JIT? | Review |
|------|------|-------------|------|--------|
| U-001 Standard | Email, HR portal | Read | No | Quarterly |
| U-002 Engineer | Git, CI, Dev SaaS | Write scoped repos | No | Quarterly |
| U-003 Finance | ERP, Reports | Read/write finance | No | Monthly |
| U-004 Admin | Admin consoles | Privileged subset | Yes — 4hr ticket | Monthly |
| U-005 Break-glass | Emergency admin | Full — logged | Yes — 1hr | Post-incident |
Service accounts: no interactive login; scoped API only
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'JIT|Break-glass|LAB SAMPLE|U-00' "$ZT_LAB/notes/least-privilege-matrix.md"
python3 -c "print('Least privilege: JIT admin row — fictional LAB-ZT-001 only')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM Identity pillar (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Anti-patterns on LAB-ZT-001
Domain admin for helpdesk. Shared root credentials. Permanent vendor VPN to production. Document as fictional gaps for roadmap module.
Design fixes these — not student lab exploitation walkthroughs.
3. Role matrix habit
Table: Role | Apps | Permissions | JIT? | Review cadence — fictional users U-001.U-005.
Ship: least-privilege matrix with one JIT row. Next: Principles Lab.
4. What you ship: least-privilege role matrix
Role matrix with JIT row and review cadence. $ZT_LAB fictional users only. chmod 600.
5. What you record before the next lesson
Date. Role matrix. $ZT_LAB named. File t40-m02-l03-least-privilege.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Matrix grants all apps to all users for lab simplicity. Teach privesc to prove least privilege gaps.
Right
Write least-privilege matrix with JIT elevation row. Next: Principles Lab.
Mission: least-privilege matrix
1) Define three fictional roles. 2) Map minimum app permissions. 3) Add one JIT admin elevation row. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Break-glass admin needs logging + review — not permanent standing access.
Knowledge Check
APPLY: Just-In-Time (JIT) access means:
Multiple choice
Knowledge Check
APPLY: True or False: Least privilege allows default full network access after VPN.
True or False
Knowledge Check
APPLY: Least privilege matrix on Cyberlium uses:
Multiple choice