Zero › Module 2 › Lesson 2
Assume Breach
Verify explicitly means authenticate and authorize every access request with identity, device, and context signals — document verify-explicitly checklist row on YOUR $ZT_LAB policy stub.
Visual · t40_verify_explicitly
Verify explicitly tenet. $ZT_LAB. Original Cyberlium.
Opening
Every request gets scrutiny — Cyberlium maps verify explicitly to IdP authN, authZ, device posture, and session context on fictional LAB-ZT-001 flows.
NIST ZT tenet: always authenticate and authorize based on available data points — user identity, device health, location literacy, application sensitivity, anomaly signals. No silent trust because the laptop joined the corporate LAN yesterday. Document verify-explicitly flow: user → IdP → device compliance check → policy decision → PEP enforcement. Fictional app access example on $ZT_LAB. Next: Least Privilege.
1. Signals for explicit verification (named)
Identity: MFA, step-up auth, session lifetime. Device: MDM compliance, EDR health, patch level. Context: geo, time, app sensitivity, risk score literacy.
Each signal gets a checklist row on YOUR policy matrix — not implicit VPN trust.
Command guide
Try these commands — Signals for explicit verification (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final); CISA ZTMM (https://www.cisa.gov/zero-trust-maturity-model). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Common failure modes
VPN connected = full network access. Shared kiosk without step-up. Service account without rotation. Legacy app bypassing IdP — document as gap on LAB-ZT-001 stub.
Verify explicitly closes these gaps in design — not by attacking legacy apps in student lab.
3. Lab flow diagram
ASCII or markdown diagram: User → IdP → Device Posture → PDP → PEP → App. Label each verification point.
Ship: verify-explicitly flow for one fictional SaaS app. Next: Least Privilege.
4. What you ship: verify-explicitly flow diagram
One app access flow with named verification signals. $ZT_LAB fictional org. chmod 600.
5. What you record before the next lesson
Date. Verify flow diagram. $ZT_LAB named. File t40-m02-l02-verify-explicitly.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Diagram shows VPN tunnel then implicit trust to all subnets. Skip device posture because MFA exists.
Right
Draw verify-explicitly flow with identity + device + context. Next: Least Privilege.
Mission: verify-explicitly flow for one app
1) Pick fictional SaaS app on LAB-ZT-001. 2) List three verification signals. 3) Draw flow through PDP/PEP. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
MFA alone is not full verify explicitly — add device and context rows.
Knowledge Check
APPLY: Verify explicitly requires:
Multiple choice
Knowledge Check
APPLY: True or False: VPN connect implies verify explicitly complete.
True or False
Knowledge Check
APPLY: Verify-explicitly diagram belongs on:
Multiple choice