Security › Module 5 › Lesson 4
Lab — Patterns
Pack DMZ segmentation, microservices security, and cloud reference patterns — architecture patterns file from $ARCH_LAB only.
Visual · t41_patterns_lab
Lab: architecture patterns pack. $ARCH_LAB only. Original Cyberlium.
Opening
Patterns pack merges DMZ to microservices to cloud reference — paperwork before SABSA literacy module.
Lessons 5-1–5-3 named DMZ segmentation, microservices security, and cloud reference patterns. This lab merges three sections into one $ARCH_LAB patterns artifact with M1 ethics, M2 defense, and M4 STRIDE cross-references. No employer diagram imports, live cloud exports, or attack cookbooks — defensive pattern paperwork only. Next: Quiz — Architecture Patterns.
1. Lab contract: architecture patterns pack
Create $HOME/cyberlium-lab/t41-m05-l04-patterns-lab.txt merging DMZ segmentation, microservices security, and cloud reference sections with $ARCH_LAB fictional org LAB-ARCH-001 and M1/M2/M4 cross-references.
Optional: link DMZ zones to trust boundaries from M4 by zone name.
Command guide
Try these commands — Lab contract: architecture patterns pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP Threat Modeling — https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html Microsoft SDL — https://www.microsoft.com/en-us/securityengineering/sdl/ NIST 800-160 — https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export ARCH_LAB=${ARCH_LAB:-$HOME/cyberlium-lab/t41-arch}
export ARCH_DESIGN=${ARCH_DESIGN:-$ARCH_LAB/LAB-ARCH-001/security-design}
cat > "$ARCH_DESIGN/dfd-order-flow.md" <<'EOF'
# DFD — Order Placement Flow — LAB-ARCH-001
```
[Customer] --(1 HTTPS order JSON)--> [API Gateway]
|
(2 validate JWT + schema)
v
[Order Service]
|
(3 INSERT order PII) | (4 publish event)
v v
[(PostgreSQL)] [Event Bus] --> [Notification Svc]
```
Data labels (fictional): (1) session token + order; (3) PII at rest encrypted
Trust boundary between (1) and (2): Internet → Edge
Links STRIDE worksheet-customer-portal.md mitigations
LAB SAMPLE — DFD literacy — NOT live system documentation
EOFCommand — copy this
grep -E 'Trust boundary|STRIDE|LAB SAMPLE' "$ARCH_DESIGN/dfd-order-flow.md" cat > "$ARCH_LAB/notes/diagram-lab-summary.md" <<'EOF' # Architecture Diagram Lab Summary — YOUR lab - context-diagram.md: system context (mermaid-style) - container-diagram.md: zones + services - dfd-order-flow.md: labeled data flows + boundaries - dfd-named.txt: DFD element literacy ## Integrity - All diagrams labeled LAB SAMPLE — fictional LAB-ARCH-001 only EOF
Command — copy this
grep -E 'context-diagram|LAB SAMPLE|Integrity' "$ARCH_LAB/notes/diagram-lab-summary.md" curl -sS https://www.microsoft.com/en-us/securityengineering/sdl/ | head -3
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t41-arch/LAB-ARCH-001/security-design/context-diagram.md | Select-String LAB Get-Content $HOME/cyberlium-lab/t41-arch/LAB-ARCH-001/security-design/dfd-order-flow.md | Select-String Trust
Primary tools to practice this lesson: grep, curl. Reference sites: OWASP Threat Modeling (https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html); Microsoft SDL (https://www.microsoft.com/en-us/securityengineering/sdl/); NIST 800-160 (https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for live ARNs, employer firewall exports, attack cookbook language — remove. Confirm all systems are $ARCH_LAB fictional placeholders.
Pattern examples stay defensive design — not offensive target maps.
3. Lock the proof
chmod 600 on the pack. Quiz next — then SABSA Layers Named.
Architecture patterns literacy feeds SABSA lessons in M6.
4. What you ship: architecture patterns pack for $ARCH_LAB
Merged DMZ, microservices, cloud sections. $ARCH_LAB named. NO attack cookbooks. chmod 600.
5. What you record before the next lesson
Date. Patterns pack path. $ARCH_LAB named. File t41-m05-l04-patterns-lab.txt chmod 600.
6. Wrong vs right: offensive playbooks vs YOUR threat models
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include employer cloud export in pack. Skip microservices identity section.
Right
Write YOUR architecture patterns pack for $ARCH_LAB. chmod 600. Next: Quiz — Architecture Patterns.
Mission: freeze YOUR architecture patterns pack on disk
1) Merge M5 literacy sections. 2) Confirm zero live export or attack refs. 3) Link M1/M2/M4 cross-refs. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One governed patterns pack beats ten inconsistent architecture whiteboard photos.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Patterns pack should reference LAB-ARCH-001 fictional systems.
True or False
Knowledge Check
APPLY: Patterns pack supports:
Multiple choice