Security › Module 10 › Lesson 4
Lab — Capstone
Execute capstone on `$ARCH_LAB` LAB-ARCH-001 — checklist, lab path, evidence pack sealed; zero offensive refs.
Visual · t41_capstone_lab
Capstone: checklist × $ARCH_LAB LAB-ARCH-001 literacy evidence. Original Cyberlium.
Opening
Close the architecture literacy loop — design honest, controls traced, reviews documented — without stranger org review abuse or offensive architecture artifacts.
Walk Topic 41 checklist on YOUR `$ARCH_LAB` LAB-ARCH-001: verify org template inventory, lab path current, SABSA through review packs indexed, scan for offensive architecture files and stranger org review notes (must be zero). Update index with capstone UTC completion. Integrity paragraph: LAB-ARCH-001 discipline and control selection key insight from YOUR path. No stranger org reviews, no offensive architecture, no lab-as-live-employer fraud, no missing LAB disclaimers on docs. Optional mentor review — three clarity questions. Secure notes chmod 600 after if brief requires.
1. Execute checklist
Check each row; link artifact or N/A labeled LAB; confirm zero offensive refs in any file.
Scan sealed pack for unauthorized stranger org data — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP ASVS — https://owasp.org/www-project-application-security-verification-standard/ Microsoft SDL — https://www.microsoft.com/en-us/securityengineering/sdl/ NIST 800-160 — https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final SABSA — https://sabsa.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ARCH_LAB=${ARCH_LAB:-$HOME/cyberlium-lab/t41-arch}
grep NEVER "$ARCH_LAB/notes/defensive-only.txt"
grep -E 'never|attack cookbooks|LAB SAMPLE' "$ARCH_LAB/roe.txt"
echo '=== Capstone: STRIDE → diagrams → patterns → SABSA → EA → controls → review ==='
grep Spoofing "$ARCH_STRIDE/worksheet-customer-portal.md"
grep mermaid "$ARCH_DESIGN/context-diagram.md" | head -2
grep LAB "$ARCH_PATTERNS/pattern-catalog-stub.md" | head -2
grep Integrity "$ARCH_SABSA/attribute-stub.md"
grep linked "$ARCH_ENTERPRISE/ea-alignment-stub.md" | head -2
grep IA-2 "$ARCH_CONTROLS/control-selection-table.md"
grep '\[ \]' "$ARCH_LAB/notes/capstone-checklist.txt" | head -5
python3 - <<'PY'
import os
lab = os.environ.get('ARCH_LAB', os.path.expanduser('~/cyberlium-lab/t41-arch'))
path = os.path.join(lab, 'notes', 'capstone-summary.txt')
open(path, 'w').write('
'.join([
'Security Architecture Capstone',
'scope: YOUR $HOME/cyberlium-lab/t41-arch/ fictional LAB-ARCH-001 only',
'fundamentals: CIA + trust boundaries + defense-in-depth layers',
'STRIDE: worksheet-customer-portal + worksheet-admin-console',
'diagrams: context + container + dfd-order-flow (markdown/mermaid)',
'patterns: api-gateway + microservices + catalog stub',
'SABSA: attribute-stub + trace; EA: ea-alignment-stub',
'controls: control-selection-table (NIST/ASVS literacy)',
'never: offensive attack cookbooks / unauthorized bypass how-tos',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'scope|never|LAB-ARCH-001|STRIDE' "$ARCH_LAB/notes/capstone-summary.txt"
═══ WINDOWS ═══
Capstone on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t41-arch/notes/defensive-only.txt | Select-String NEVER Get-Content $HOME/cyberlium-lab/t41-arch/notes/capstone-summary.txt | Select-String never Get-Content $HOME/cyberlium-lab/t41-arch/LAB-ARCH-001/stride/worksheet-customer-portal.md | Select-String Spoofing
Primary tools to practice this lesson: grep, python3. Reference sites: OWASP ASVS (https://owasp.org/www-project-application-security-verification-standard/); Microsoft SDL (https://www.microsoft.com/en-us/securityengineering/sdl/); NIST 800-160 (https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final); SABSA (https://sabsa.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Integrity paragraph
LAB-ARCH-001 inventory + LAB label discipline + control trace key → professional handoff idea from YOUR lab path.
Name what breaks if you skip LAB labels or add offensive content — ethics tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 42 Certification Prep Hub on separate authorized track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed literacy pack + integrity paragraph + zero offensive scan.
5. What you record before the next lesson
Capstone pack path. $ARCH_LAB LAB-ARCH-001 quiet.
6. Wrong vs right: offensive playbooks vs YOUR threat models
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone includes offensive attack architecture walkthrough as bonus exhibit.
Right
Capstone complete on $ARCH_LAB LAB-ARCH-001 with full teardown. Next: topic quiz.
Mission: Topic 41 capstone
1) Walk checklist with evidence links. 2) Integrity paragraph from your path. 3) Seal pack — zero offensive refs. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Offensive architecture earns capstone credit.
True or False
Knowledge Check
APPLY: Capstone teardown includes:
Multiple choice