Secure › Module 2 › Lesson 4
SDLC Lab
SDLC pack on $MY_REPO — phase map, threat sketch, shift-left action; literacy file only.
Visual · sdlc_lab
Lab: SDLC evidence pack. $MY_REPO only. Original Cyberlium.
Opening
Three artifacts, one repo, zero stranger deploy scans.
Lessons 2-1 through 2-3 covered SDLC phases, threat in design, and shift left. This lab ships combined evidence from $MY_REPO: phase table, threat sketch, shift-left action note. Optional: one git commit with validation test if brief allows. No live shop DAST. No classmate API fuzzing. Next: Quiz — Secure SDLC.
1. Lab contract: verify repo, then assemble
Confirm path is $MY_REPO. Merge lessons 2-1 through 2-3 into one note file under $HOME/cyberlium-lab.
Optional: commit shift-left test on a lab branch — still no scanner against stranger URLs.
Command guide
Try these commands — Lab contract: verify repo, then assemble
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
DevSecOps pipeline — https://owasp.org/www-project-developer-guide/ Code review guide — https://owasp.org/www-project-code-review-guide/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl
macOS: Built-in
Windows:
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t17-sdlc-notes.txt" <<'EOF' requirements: security acceptance criteria design: trust boundaries named code: review + SAST gate test: authz + injection cases deploy: secrets not in git EOF
Command — copy this
grep -E 'requirements|deploy' "$HOME/cyberlium-lab/t17-sdlc-notes.txt" openssl dgst -sha256 "$HOME/cyberlium-lab/t17-sdlc-notes.txt"
Primary tools to practice this lesson: grep, openssl. Reference sites: DevSecOps pipeline (https://owasp.org/www-project-developer-guide/); Code review guide (https://owasp.org/www-project-code-review-guide/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Optional single commit with rollback
If brief allows: add one validation unit test or checklist to $MY_REPO — with branch and revert steps documented.
Never batch-apply 'security scripts' from forums onto classmate deploys.
3. Lock the proof
chmod 600 on the pack. Quiz is next — then Input Validation.
Secure teams archive SDLC evidence with review tickets; you are practicing that habit on $MY_REPO.
4. What you ship: SDLC evidence pack for $MY_REPO
Phase map, threat sketch, shift-left action. Optional one commit. No stranger testing. chmod 600.
5. What you record before the next lesson
Date. SDLC pack sections complete. $MY_REPO verified. File t17-m02-l04-sdlc-lab.txt chmod 600.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip repo check and threat-model a live shop. Export pack from employer repo without ticket.
Right
Combined SDLC pack on $MY_REPO. chmod 600. Next: Quiz — Secure SDLC.
Mission: SDLC evidence pack
1) Verify $MY_REPO. 2) Merge phase map, threat sketch, shift-left sections. 3) Optional one lab commit. 4) chmod 600. Never target stranger production.
Stuck? Ask Cyberlium AI Mentor
Paperwork plus one test commit beats ZAP on a live shop every time.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Optional shift-left commit should use a lab branch on $MY_REPO.
True or False
Knowledge Check
APPLY: Employer production repo without ticket:
Multiple choice