Security › Module 8 › Lesson 3
Cost Tradeoffs
Cost vs risk tradeoff literacy — risk rating stub, control cost stub, residual risk note, accept/mitigate decision, rationale row — tradeoff rows on YOUR `$ARCH_LAB` LAB-ARCH-001.
Visual · t41_cost_risk_tradeoffs
Cost vs risk = named tradeoff rows. $ARCH_LAB LAB-ARCH-001. Original Cyberlium.
Opening
Architecture balances cost and risk — name tradeoff rows on YOUR lab org before recommending zero controls or unlimited spend theater without analysis.
Cost vs risk tradeoff literacy names: risk rating stub category, control cost stub category, residual risk note category, accept vs mitigate decision category, and rationale row category. Analyst documents tradeoff matrix on `$ARCH_LAB` LAB-ARCH-001 — three control decisions from Module 8-2 gaps with honest rationale — without recommending skip-all-controls to save budget fraud, without inflating risk for vendor sales, without offensive 'accept breach' narratives. Cyberlium teaches tradeoff vocabulary on YOUR notes. Refused: reckless accept-all-risk, fraudulent cost claims, offensive harm enablement. Lab row: tradeoff matrix (three decisions, rationale, LAB label).
1. Named tradeoff rows
Risk rating, control cost, residual risk, accept/mitigate, rationale — five literacy anchors.
Each decision links Module 8-2 gap — same LAB-ARCH-001 thread.
Command guide
Try these commands — Named tradeoff rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
TOGAF — https://www.opengroup.org/togaf SABSA — https://sabsa.org/ NIST 800-160 — https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ARCH_LAB=${ARCH_LAB:-$HOME/cyberlium-lab/t41-arch}
cat > "$ARCH_LAB/notes/security-in-ea.md" <<'EOF'
# Security in Enterprise Architecture — LAB-ARCH-001
## Integration points
- Security architecture repository alongside EA catalog (fictional)
- SABSA attributes map to TOGAF business/data/application views
- STRIDE worksheets linked from application architecture records
- Control standards referenced in technology standards catalog
## Governance
- Architecture review board includes security architect (fictional role)
- Exception process: risk acceptance with expiry (links GRC literacy)
## Refusals
- No rubber-stamp approvals; lab documents review checklist only
EOFCommand — copy this
grep -E 'SABSA|STRIDE|Refusals|review board' "$ARCH_LAB/notes/security-in-ea.md"
python3 -c "print('Security in EA: cross-link SABSA + STRIDE + controls — literacy')"Primary tools to practice this lesson: grep, python3. Reference sites: TOGAF (https://www.opengroup.org/togaf); SABSA (https://sabsa.org/); NIST 800-160 (https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Decision discipline
Accept decision requires documented residual risk — not silent control removal.
Cost stub uses lab fictional numbers — not live employer budget data.
3. Refused
No skip-all-controls fraud; no inflated risk for sales; no offensive harm enablement narratives.
Tradeoff literacy supports informed architecture — not reckless acceptance.
4. What you ship: cost vs risk tradeoff matrix
Three decisions + rationale + residual risk + LAB label + NEVER skip-all-controls line.
5. What you record before the next lesson
Tradeoff matrix path.
6. Wrong vs right: offensive playbooks vs YOUR threat models
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Recommend accept-all-residual-risk on `$ARCH_LAB` to justify removing every control for budget fraud.
Right
Tradeoff matrix from `$ARCH_LAB` LAB-ARCH-001 gaps. Next: Control Selection Lab.
Mission: tradeoff matrix
1) Name five tradeoff literacy rows. 2) Three decisions from Module 8-2 gaps. 3) Rationale and residual risk each. 4) Write NEVER skip-all-controls fraud line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Accept vs mitigate — literacy decision criteria?”
Knowledge Check
APPLY: Cost vs risk literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Accept-all-residual-risk without rationale is acceptable.
True or False
Knowledge Check
APPLY: Tradeoff matrix includes:
Multiple choice