Lab — Capstone

Execute capstone on `$ARCH_LAB` LAB-ARCH-001 — checklist, lab path, evidence pack sealed; zero offensive refs.

Lab — Capstone• Audio Walkthrough

00:00/03:01

Visual · t41_capstone_lab

Capstone: checklist × $ARCH_LAB LAB-ARCH-001 literacy evidence. Original Cyberlium.

Close the architecture literacy loop — design honest, controls traced, reviews documented — without stranger org review abuse or offensive architecture artifacts.

Walk Topic 41 checklist on YOUR `$ARCH_LAB` LAB-ARCH-001: verify org template inventory, lab path current, SABSA through review packs indexed, scan for offensive architecture files and stranger org review notes (must be zero). Update index with capstone UTC completion. Integrity paragraph: LAB-ARCH-001 discipline and control selection key insight from YOUR path. No stranger org reviews, no offensive architecture, no lab-as-live-employer fraud, no missing LAB disclaimers on docs. Optional mentor review — three clarity questions. Secure notes chmod 600 after if brief requires.

1. Execute checklist

Check each row; link artifact or N/A labeled LAB; confirm zero offensive refs in any file.

Scan sealed pack for unauthorized stranger org data — remove before handoff.

Command guide

Try these commands — Execute checklist

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

OWASP ASVS — https://owasp.org/www-project-application-security-verification-standard/ Microsoft SDL — https://www.microsoft.com/en-us/securityengineering/sdl/ NIST 800-160 — https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final SABSA — https://sabsa.org/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export ARCH_LAB=${ARCH_LAB:-$HOME/cyberlium-lab/t41-arch}
grep NEVER "$ARCH_LAB/notes/defensive-only.txt"
grep -E 'never|attack cookbooks|LAB SAMPLE' "$ARCH_LAB/roe.txt"
echo '=== Capstone: STRIDE → diagrams → patterns → SABSA → EA → controls → review ==='
grep Spoofing "$ARCH_STRIDE/worksheet-customer-portal.md"
grep mermaid "$ARCH_DESIGN/context-diagram.md" | head -2
grep LAB "$ARCH_PATTERNS/pattern-catalog-stub.md" | head -2
grep Integrity "$ARCH_SABSA/attribute-stub.md"
grep linked "$ARCH_ENTERPRISE/ea-alignment-stub.md" | head -2
grep IA-2 "$ARCH_CONTROLS/control-selection-table.md"
grep '\[ \]' "$ARCH_LAB/notes/capstone-checklist.txt" | head -5
python3 - <<'PY'
import os
lab = os.environ.get('ARCH_LAB', os.path.expanduser('~/cyberlium-lab/t41-arch'))
path = os.path.join(lab, 'notes', 'capstone-summary.txt')
open(path, 'w').write('
'.join([
  'Security Architecture Capstone',
  'scope: YOUR $HOME/cyberlium-lab/t41-arch/ fictional LAB-ARCH-001 only',
  'fundamentals: CIA + trust boundaries + defense-in-depth layers',
  'STRIDE: worksheet-customer-portal + worksheet-admin-console',
  'diagrams: context + container + dfd-order-flow (markdown/mermaid)',
  'patterns: api-gateway + microservices + catalog stub',
  'SABSA: attribute-stub + trace; EA: ea-alignment-stub',
  'controls: control-selection-table (NIST/ASVS literacy)',
  'never: offensive attack cookbooks / unauthorized bypass how-tos',
]))
print(f'Wrote {path}')
PY

Command — copy this

grep -E 'scope|never|LAB-ARCH-001|STRIDE' "$ARCH_LAB/notes/capstone-summary.txt"

═══ WINDOWS ═══

Capstone on YOUR lab Windows VM only

Command — copy this

Get-Content $HOME/cyberlium-lab/t41-arch/notes/defensive-only.txt | Select-String NEVER
Get-Content $HOME/cyberlium-lab/t41-arch/notes/capstone-summary.txt | Select-String never
Get-Content $HOME/cyberlium-lab/t41-arch/LAB-ARCH-001/stride/worksheet-customer-portal.md | Select-String Spoofing

Primary tools to practice this lesson: grep, python3. Reference sites: OWASP ASVS (https://owasp.org/www-project-application-security-verification-standard/); Microsoft SDL (https://www.microsoft.com/en-us/securityengineering/sdl/); NIST 800-160 (https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final); SABSA (https://sabsa.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Integrity paragraph

LAB-ARCH-001 inventory + LAB label discipline + control trace key → professional handoff idea from YOUR lab path.

Name what breaks if you skip LAB labels or add offensive content — ethics tie-in.

3. Shutdown

Notes secured chmod 600; index signed complete UTC.

Ready for Topic 42 Certification Prep Hub on separate authorized track.

4. What you ship: capstone evidence pack complete

Checked checklist + sealed literacy pack + integrity paragraph + zero offensive scan.

5. What you record before the next lesson

Capstone pack path. $ARCH_LAB LAB-ARCH-001 quiet.

6. Wrong vs right: offensive playbooks vs YOUR threat models

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Capstone includes offensive attack architecture walkthrough as bonus exhibit.
Right: Capstone complete on $ARCH_LAB LAB-ARCH-001 with full teardown. Next: topic quiz.

Hands-on Exercise