Zero › Module 5 › Lesson 3
Policy Design
Policy groups literacy — map users, devices, apps to segmentation labels — policy group table on YOUR $ZT_LAB network folder.
Visual · t40_policy_groups
Policy groups. $ZT_LAB. Original Cyberlium.
Opening
Segments need identities — policy groups bind IdP groups and device tags to microseg rules on LAB-ZT-001.
Policy groups (App-Finance, Role-Engineering, Device-Compliant, Env-Prod literacy) drive segmentation rules dynamically. Change group membership → access path updates without IP churn. Table: Group name | Members source | Segments allowed | Linked CA policy — fictional. Next: Microseg Lab.
1. Policy group types (named)
User/group from IdP. Device compliance tag from MDM. App classification label. Environment (prod/dev) label.
Combine labels for compound rules — engineering + compliant device → dev segment.
Command guide
Try these commands — Policy group types (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM Networks (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Link to identity and device pillars
CA-002 admin group maps to Admin-Segment policy group. Non-compliant device tag → quarantine segment literacy.
Cross-reference M3 and M4 packs in table footnotes.
3. Lab table
Eight fictional policy groups with segment mapping for LAB-ZT-001.
Ship: policy group table. Next: Microseg Lab.
4. What you ship: policy group table
Eight groups mapped to segments and IdP/MDM sources. $ZT_LAB. chmod 600.
5. What you record before the next lesson
Date. Policy groups. $ZT_LAB named. File t40-m05-l03-policy-groups.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use real employee names in group table. Static IP ACLs only — ignore identity labels.
Right
Write policy group table linking IdP and device tags to segments. Next: Microseg Lab.
Mission: policy group table
1) Define eight fictional policy groups. 2) Map each to allowed segments. 3) Link two groups to M3 CA policies. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Dynamic groups beat static VLAN ACLs when workforce is hybrid.
Knowledge Check
APPLY: Policy groups connect:
Multiple choice
Knowledge Check
APPLY: True or False: IdP group changes can update segment access.
True or False
Knowledge Check
APPLY: Policy group table uses:
Multiple choice