Zero › Module 5 › Lesson 1
Segment Goals
Microsegmentation literacy — segment by app, user, data sensitivity — not flat VLAN trust — microseg overview card on YOUR $ZT_LAB network folder.
Visual · t40_microseg_named
Microsegmentation named. $ZT_LAB. Original Cyberlium.
Opening
Flat network died with the laptop — Cyberlium teaches microseg vocabulary: workload segments, policy groups, east-west inspection literacy on fictional LAB-ZT-001.
Microsegmentation divides network into granular zones so compromise in one segment does not imply lateral movement freedom. Implements via software-defined segmentation (Illumio, Guardicore literacy), NGFW internal rules, hypervisor NSX, cloud security groups — design concepts on lab diagrams. Refused: lateral movement labs to prove flat network bad. Write microseg overview card. Next: East West.
1. Microseg goals (named)
Limit blast radius. Enforce least privilege east-west. Map segments to apps/data classes. Log denied flows for tuning.
Align segments to ZT policy groups — not only north-south firewall.
Command guide
Try these commands — Microseg goals (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, grep. Reference sites: NIST SP 800-207 microsegmentation (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM Networks (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Implementation patterns literacy
Agent-based host firewall policies. Network-based internal NGFW. Cloud SG/NACL per tier. Identity-aware microseg (user/device label).
LAB-ZT-001 picks one primary pattern — document in overview card.
3. Diagram stub
ASCII: Web tier | App tier | DB tier — deny by default, allow listed flows only.
Ship: microseg overview + tier diagram. Next: East West.
4. What you ship: microseg overview card
Goals + pattern pick + three-tier diagram stub. $ZT_LAB fictional. chmod 600.
5. What you record before the next lesson
Date. Microseg overview. $ZT_LAB named. File t40-m05-l01-microseg-named.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Draw one flat VLAN for lab simplicity. Run lateral movement to demo microseg need.
Right
Write microseg overview with three-tier deny-default diagram. Next: East West.
Mission: microseg overview
1) Name four microseg goals. 2) Pick implementation pattern for LAB-ZT-001. 3) Draw three-tier diagram. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Deny-default between tiers — allow rules need business justification row.
Knowledge Check
APPLY: Microsegmentation primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Microseg aligns with least privilege for workloads.
True or False
Knowledge Check
APPLY: Lateral movement labs to teach microseg:
Multiple choice