Zero › Module 2 › Lesson 4
Lab — Principles
Pack NIST 800-207, verify explicitly, and least privilege cards — principles file from $ZT_LAB only with architecture diagram stub.
Visual · t40_principles_lab
Lab: ZT principles pack. $ZT_LAB only. Original Cyberlium.
Opening
Principles pack merges NIST tenets into one diagram — PE/PA/PEP boxes plus verify flow on fictional LAB-ZT-001.
Lessons 2-1–2-3 named NIST components, verify explicitly, and least privilege. This lab merges three sections into one $ZT_LAB principles artifact with M1 ethics cross-reference and combined architecture diagram stub. No attack tools, real employer IdP exports, or production architecture claims — principles literacy paperwork only. Next: Quiz — ZT Principles.
1. Lab contract: principles literacy pack
Create principles pack merging NIST component card, verify-explicitly flow, least-privilege matrix, and combined diagram with PE/PA/PEP labeled.
Footer cites NIST SP 800-207 curl date and LAB SAMPLE label.
Command guide
Try these commands — Lab contract: principles literacy pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final CISA ZTMM — https://www.cisa.gov/zero-trust-maturity-model
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
cat > "$ZT_LAB/notes/principles-lab-summary.md" <<'EOF'
# ZT Principles Lab Summary — YOUR lab
- nist-800-207-named.txt: PE/PA/PEP + deployment models
- verify-explicitly-flow.md: per-request signal diagram
- least-privilege-matrix.md: JIT + break-glass rows
## Combined diagram stub
```
[Policy Engine / PDP]
↑ signals
User → IdP → Device → PEP → App
```
## Integrity
- Fictional org only — no attack tools
- NIST SP 800-207 cited via curl in notes
EOFCommand — copy this
grep -E 'Integrity|PEP|attack tools' "$ZT_LAB/notes/principles-lab-summary.md" grep NEVER "$ZT_LAB/notes/no-attack-tools.txt" "$ZT_LAB/roe.txt" curl -sS https://csrc.nist.gov/publications/detail/sp/800-207/final | head -3
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t40-zt/notes/verify-explicitly-flow.md | Select-String Device
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for attack tool refs, stranger org targets, employer tenant IDs — remove. Confirm fictional org LAB-ZT-001 throughout.
Link M1 no-attack-tools ethics card in pack header.
3. Lock the proof
chmod 600 on pack. Quiz next — then Identity Named.
Principles pack feeds identity pillar lessons in M3.
4. What you ship: ZT principles literacy pack
Merged NIST + verify + least privilege + diagram. $ZT_LAB named. NO attack tools. chmod 600.
5. What you record before the next lesson
Date. Principles pack path. $ZT_LAB named. File t40-m02-l04-principles-lab.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include Metasploit lateral movement section in principles pack. Skip NIST citation.
Right
Write YOUR principles pack for $ZT_LAB. chmod 600. Next: Quiz — ZT Principles.
Mission: freeze YOUR principles pack on disk
1) Merge M2 literacy sections. 2) Combined PE/PA/PEP diagram. 3) Link M1 ethics cross-ref. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One governed principles pack beats scattered vendor acronym notes.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Principles pack should cite NIST SP 800-207.
True or False
Knowledge Check
APPLY: Principles pack supports:
Multiple choice