Zero › Module 2 › Lesson 1
NIST Foundations
NIST SP 800-207 names Zero Trust Architecture — tenets, logical components (PDP, PEP, PA, PE), and deployment models; curl public NIST page for literacy on YOUR $ZT_LAB notes.
Visual · t40_nist_800_207
NIST SP 800-207 literacy. $ZT_LAB. Original Cyberlium.
Opening
NIST SP 800-207 is the anchor document — name PDP, PEP, and policy engine components on YOUR lab diagram before vendor acronym soup.
NIST SP 800-207 defines ZTA as cybersecurity paradigm shifting from implicit trust to explicit verification per request. Core components: Policy Engine (PE), Policy Administrator (PA), Policy Enforcement Point (PEP), plus data plane and control plane literacy. Cyberlium teaches named literacy on $ZT_LAB — curl csrc.nist.gov SP 800-207 page, write component card in notes, map to fictional LAB-ZT-001 stub. Not legal/regulatory mandate interpretation — architecture vocabulary. Next: Verify Explicitly.
1. NIST SP 800-207 components (named)
Policy Engine (PE): makes access decision from trust algorithm + enterprise policy. Policy Administrator (PA): establishes/tears down communication path per PE decision. Policy Enforcement Point (PEP): enables, monitors, terminates connections.
Supporting: Identity Manager, Asset Manager, Threat Intelligence feed literacy — map as labeled boxes on YOUR diagram stub.
Command guide
Try these commands — NIST SP 800-207 components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final NIST ZTA project — https://csrc.nist.gov/projects/zero-trust-architecture CISA ZTMM — https://www.cisa.gov/zero-trust-maturity-model
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
curl -sS https://csrc.nist.gov/publications/detail/sp/800-207/final | head -12
cat > "$ZT_LAB/notes/nist-800-207-named.txt" <<'EOF'
NIST SP 800-207 — NAMED LITERACY:
PE (Policy Engine): access decision from trust algorithm + enterprise policy
PA (Policy Administrator): establishes/tears down path per PE decision
PEP (Policy Enforcement Point): enable, monitor, terminate connections
Deployment models: enhanced identity; microsegmentation; network infrastructure
Tenets: verify explicitly; least privilege; assume breach
Lab: map components on architecture diagram stub — fictional LAB-ZT-001 only
EOFCommand — copy this
grep -E 'PE |PA |PEP|Deployment|Tenets' "$ZT_LAB/notes/nist-800-207-named.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final); NIST ZTA project (https://csrc.nist.gov/projects/zero-trust-architecture); CISA ZTMM (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. ZT deployment models (literacy)
Enhanced identity governance, microsegmentation-centric, network infrastructure-centric — three NIST deployment patterns. Pick primary for LAB-ZT-001 fictional org and document why in one paragraph.
Hybrid real orgs often blend models — lab picks one primary for clarity.
3. curl literacy habit
curl -sS NIST SP 800-207 publication page | head — verify document title in lab notes. Cite SP 800-207 in diagram footer — not vendor PDF alone.
Ship: NIST component card with PE/PA/PEP definitions. Next: Verify Explicitly.
4. What you ship: NIST SP 800-207 component card
PE/PA/PEP definitions + deployment model pick for LAB-ZT-001. curl NIST page cited. chmod 600.
5. What you record before the next lesson
Date. NIST component card. $ZT_LAB named. File t40-m02-l01-nist-800-207-named.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip NIST and copy vendor ZTNA slide as architecture source of truth. Claim SP 800-207 certifies your lab org.
Right
Write NIST component card with curl citation. Next: Verify Explicitly.
Mission: NIST SP 800-207 literacy card
1) Define PE, PA, PEP in your words. 2) Pick one deployment model for LAB-ZT-001. 3) curl NIST SP 800-207 page and note title line. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
PE decides; PA orchestrates; PEP enforces — three-letter anchor for diagrams.
Knowledge Check
APPLY: Policy Enforcement Point (PEP) primarily:
Multiple choice
Knowledge Check
APPLY: True or False: NIST SP 800-207 names PE, PA, and PEP.
True or False
Knowledge Check
APPLY: NIST literacy on Cyberlium uses:
Multiple choice