Zero › Module 4 › Lesson 1
Device Posture
Device trust literacy — posture assessment signals (OS patch, encryption, jailbreak, EDR health) — device compliance matrix on YOUR $ZT_LAB.
Visual · t40_device_posture
Device posture. $ZT_LAB. Original Cyberlium.
Opening
Untrusted device, untrusted session — Cyberlium maps posture signals to conditional access grant/block rows on fictional LAB-ZT-001 fleet.
Device posture evaluates health before granting access: OS version minimum, disk encryption on, screen lock, EDR running, jailbreak/root detection, TPM literacy for Windows devices. Non-compliant device → block or limited web-only access. Document device compliance matrix: device type, required signals, CA policy link — fictional fleet D-001.D-010. Next: MDM EDR Named.
1. Posture signals (named)
Managed vs unmanaged. Encryption status. Patch level. EDR heartbeat. Secure boot/TPM. Mobile: no jailbreak, MDM enrolled.
Each signal maps to conditional access condition in M3 matrix.
Command guide
Try these commands — Posture signals (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: CISA ZTMM Devices (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Compliance tiers literacy
Compliant: all signals pass. Non-compliant: block sensitive apps, allow email web only. Unknown: require enrollment before corp data.
Guest/BYOD tier with app protection policies literacy — no full network VPN.
3. Lab matrix
Table: Device ID | Type | Encryption | EDR | Compliant? | CA policy — fictional only.
Ship: device posture matrix. Next: MDM EDR Named.
4. What you ship: device posture matrix
Fictional fleet compliance table linked to CA policies. $ZT_LAB. chmod 600.
5. What you record before the next lesson
Date. Posture matrix. $ZT_LAB named. File t40-m04-l01-device-posture.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Mark all devices compliant without signals. Install spyware as posture demo.
Right
Write device posture matrix with non-compliant example row. Next: MDM EDR Named.
Mission: device posture matrix
1) Define five posture signals. 2) List ten fictional devices with compliance status. 3) Link two devices to CA policies. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Non-compliant row in matrix teaches block flow — do not hide all green.
Knowledge Check
APPLY: Device posture signals include:
Multiple choice
Knowledge Check
APPLY: True or False: Non-compliant devices can be blocked from sensitive apps.
True or False
Knowledge Check
APPLY: Device matrix uses:
Multiple choice