Zero › Module 4 › Lesson 2
Managed vs BYOD
MDM and EDR named literacy — Intune, Jamf, Defender, CrowdStrike concepts — tool role card on YOUR $ZT_LAB devices folder.
Visual · t40_mdm_edr
MDM + EDR named. $ZT_LAB. Original Cyberlium.
Opening
MDM enforces posture — EDR proves runtime health — name both roles on LAB-ZT-001 device architecture stub.
MDM/UEM (Intune, Jamf, Workspace ONE literacy): enroll devices, deploy configs, compliance policies, app protection. EDR/XDR (Defender, CrowdStrike, SentinelOne literacy): telemetry, threat detection, isolation — feeds trust score. Write tool role card: what MDM owns vs what EDR owns vs overlap — fictional vendor names OK. No agent tampering labs. Next: Compliance Hygiene.
1. MDM responsibilities (named)
Enrollment, configuration profiles, OS update rings, compliance policy, remote wipe literacy, app deployment.
Source of truth for device compliance signal to IdP.
Command guide
Try these commands — MDM responsibilities (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: CISA ZTMM Devices (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. EDR responsibilities (named)
Process telemetry, behavioral detection, containment, forensic timeline literacy. Feeds risk score to conditional access in advanced maturity.
EDR unhealthy → downgrade trust or block — design row on matrix.
3. Integration diagram
Device → MDM compliance + EDR health → IdP CA → App. Label data flow on stub.
Ship: MDM/EDR role card + mini diagram. Next: Compliance Hygiene.
4. What you ship: MDM/EDR role card
MDM vs EDR responsibilities + integration diagram stub. Fictional vendors. chmod 600.
5. What you record before the next lesson
Date. MDM/EDR card. $ZT_LAB named. File t40-m04-l02-mdm-edr-named.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Teach EDR disable steps as ZT lab. Conflate MDM and IdP as same product.
Right
Write MDM/EDR role card with integration diagram. Next: Compliance Hygiene.
Mission: MDM/EDR role card
1) List five MDM responsibilities. 2) List five EDR responsibilities. 3) Draw compliance signal flow to IdP. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
MDM sets baseline; EDR catches runtime drift — both feed posture.
Knowledge Check
APPLY: MDM primarily provides:
Multiple choice
Knowledge Check
APPLY: True or False: EDR unhealthy signal can affect access decisions.
True or False
Knowledge Check
APPLY: EDR disable tutorials in ZT lab:
Multiple choice