Zero › Module 8 › Lesson 1
PEP PDP Named
Policy Engine and Enforcement literacy — PEP, PDP, PA per NIST SP 800-207 — policy architecture diagram on YOUR $ZT_LAB policy folder.
Visual · t40_pep_pdp
PEP/PDP/PA named. $ZT_LAB. Original Cyberlium.
Opening
Decisions separate from enforcement — map PEP and PDP boxes on LAB-ZT-001 policy plane diagram with trust algorithm inputs.
PDP (Policy Decision Point): evaluates request against policy + signals. PEP (Policy Enforcement Point): allows/denies/limits session. PA (Policy Administrator): configures paths per PDP decision — NIST SP 800-207 alignment. Diagram: request → PEP → PDP ← signals (IdP, MDM, TI) → decision → PEP enforce. Fictional product names as labels OK. Next: Continuous Auth.
1. Component roles (named)
PEP: gateway, agent, firewall enforcement. PDP: policy engine brain. PA: orchestration of connection setup/teardown.
Trust algorithm inputs: identity, device, data class, threat intel, behavior literacy.
Command guide
Try these commands — Component roles (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, grep. Reference sites: NIST SP 800-207 PEP/PDP (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Policy sources
Enterprise policy database, IdP groups, classification labels, geo rules, risk score — feed PDP.
Single PDP per session ideal — avoid conflicting decision points.
3. Lab diagram
Full policy plane ASCII with labeled PEP/PDP/PA and five signal inputs from prior modules.
Ship: PEP/PDP architecture diagram. Next: Continuous Auth.
4. What you ship: PEP/PDP policy plane diagram
NIST-aligned diagram with signal inputs from identity/device/data pillars. $ZT_LAB. chmod 600.
5. What you record before the next lesson
Date. PEP/PDP diagram. $ZT_LAB named. File t40-m08-l01-pep-pdp-named.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Merge PEP and PDP into one box with no signal inputs. Skip NIST SP 800-207 reference.
Right
Draw PEP/PDP/PA diagram with five signal inputs. Next: Continuous Auth.
Mission: PEP/PDP diagram
1) Label PEP, PDP, PA roles. 2) List five trust algorithm inputs. 3) Draw request flow. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Cross-link M2 NIST component card — same vocabulary, fuller diagram here.
Knowledge Check
APPLY: PDP primarily:
Multiple choice
Knowledge Check
APPLY: True or False: PEP enforces the PDP decision.
True or False
Knowledge Check
APPLY: Policy plane diagram uses:
Multiple choice