What your child will learn
Identify the four failure points that made the NimbusHR breach possible — phished intern credentials were trusted at the VPN layer, the corporate network was fully trusted once on-VPN, no identity-aware proxy gated per-service access, and the payroll service was reachable from the marketing subnet with no micro-segmentation
Explain what an identity-aware proxy actually buys over a trusted VPN — per-request authentication and authorization, no network-level "trusted zone," every call to every service is re-evaluated
Explain what service-to-service mTLS prevents — a compromised pod cannot impersonate a peer service because both sides prove their workload identity via certificate at every call, defeating lateral movement
Explain why least-privilege IAM per service closes the blast radius — the payroll service only accepts requests from services that have the payroll-reader role, and the marketing workload does not have that role, so lateral movement to payroll fails regardless of who owns the marketing service
Explain why continuous auth via device posture closes the post-MFA regression — a session cookie stolen from an unmanaged device fails the next posture check mid-session, so the cookie alone is not enough to keep accessing services
Explain why micro-segmentation stops lateral movement regardless of credential validity — even if a workload is compromised, it can only reach the services on its own segment, and every cross-segment call is re-authenticated
Place the six zero-trust controls in the correct order — identity before network, device posture before session, micro-segmentation in front of every service, and verified again on every hop
How this mission works
NimbusHR — a fictional 500-person SaaS company — just got breached. An attacker phished a marketing intern's credentials, used them to VPN into the corporate network, and then moved laterally to the payroll database because the internal network was fully trusted. You are the security architect called in to investigate. There are four failure points to find across 4 evidence panels: VPN logs (default-trust posture on the corporate VPN), IAM roles (overly broad roles — the intern could reach payroll), network diagram (no micro-segmentation between marketing and payroll subnets), and incident timeline (no device-posture check, no continuous auth, no per-service mTLS). Then you redesign the architecture with six numbered zero-trust controls: (1) MFA on every service, (2) identity-aware proxy instead of a trusted VPN, (3) service-to-service mTLS, (4) least-privilege IAM per service, (5) continuous auth via device posture, and (6) micro-segmentation in front of every service. Includes printable "Zero Trust Principles" one-pager you take home. Pass 5 of 6 to earn the 🛡️ Zero Trust Explorer badge and 200 XP. Designed for Grades 9 through 12 — server-graded 6-question quiz, advanced reading level, no client-side scene rendering.
What students actually encounter
Why did NimbusHR's trusted-once-trusted-everywhere VPN posture fail at the root cause level once the marketing intern's credentials were phished?
You replace the trusted VPN with an identity-aware proxy. What does that actually buy you that the trusted VPN does not?
You enforce least-privilege IAM per service — each workload gets only the roles it needs. What does that do to the blast radius of a marketing compromise?
Cipher is with them the whole way
When a student gets stuck on Zero Trust Explorer, Cipher appears with a mission-specific nudge — no spoilers, just a hint toward the right thinking. Make a wrong choice, and Cipher explains the real-world consequence. Finish the mission, and Cipher generates a personalized performance debrief based on exactly how the student played it.
ISTE alignment
Advanced learners (Grades 9–12) investigate the NimbusHR breach through 4 evidence panels (VPN logs, IAM roles, network diagram, incident timeline) and redesign the architecture with six zero-trust controls: (1) MFA on every service, (2) identity-aware proxy instead of VPN, (3) service-to-service mTLS, (4) least-privilege IAM per service, (5) continuous auth via device posture, and (6) micro-segmentation in front of every service. Aligned to ISTE Computational Thinker 5c (data models — understanding how a perimeter-trust model fails and how a per-request model closes the gaps), NICE Framework SP-ARC-001 (Security Architecture work role), and the CISA Zero Trust Maturity Model v2.0 (per-request, per-service trust decisions).