Security › Module 6 › Lesson 4
Lab — SABSA
SABSA literacy lab on `$ARCH_LAB` — layer card, business context sheet, attribute profile matrix bundled for LAB-ARCH-001.
Visual · t41_sabsa_lab
Lab: SABSA pack on YOUR $ARCH_LAB LAB-ARCH-001. Original Cyberlium.
Opening
Ship SABSA literacy artifacts from YOUR lab org — layers, context, attributes — zero stranger org diagrams or offensive architecture.
On YOUR `$ARCH_LAB` per brief: (1) scope proof — LAB-ARCH-001 fictional org template path labeled LAB; (2) SABSA layer card Module 6-1; (3) business context sheet Module 6-2; (4) attribute profile matrix Module 6-3; (5) SABSA summary stub (layer count, context row count, zone count); (6) integrity — `$ARCH_LAB` only, LAB-ARCH-001 scope, no stranger org architecture, no offensive attack design, defensive literacy only; (7) chmod 600 pack. Cross-link Modules 2–5 defense and pattern literacy — professional SABSA handoff.
1. Lab deliverables
Layer + context + attribute matrix cross-indexed to one LAB-ARCH-001 org.
Summary cites honest zone and layer coverage — not zero-fiction completeness.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP ASVS — https://owasp.org/www-project-application-security-verification-standard/ Microsoft patterns — https://learn.microsoft.com/en-us/azure/architecture/patterns/ NIST 800-53 — https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export ARCH_LAB=${ARCH_LAB:-$HOME/cyberlium-lab/t41-arch}
export ARCH_PATTERNS=${ARCH_PATTERNS:-$ARCH_LAB/LAB-ARCH-001/patterns}
cat > "$ARCH_PATTERNS/pattern-catalog-stub.md" <<'EOF'
# Security Pattern Catalog — LAB-ARCH-001
| Pattern | Use case (fictional) | Key control | ASVS ref (literacy) |
|---------|----------------------|-------------|---------------------|
| API Gateway | External API entry | OAuth2 + rate limit | V4.x access control |
| Service mesh sidecar | Internal mTLS | SPIFFE/SPIRE stub | V9.x communications |
| Vault | Secret storage | Dynamic credentials | V6.x stored crypto |
| Bulkhead | Noisy neighbor isolation | Separate pools | V1.x architecture |
| Circuit breaker | Dependency failure | Fail fast + fallback | V10.x misconfiguration |
LAB SAMPLE — pattern selection literacy — NOT vendor deployment guide
EOFCommand — copy this
grep -E 'API Gateway|LAB SAMPLE|Pattern' "$ARCH_PATTERNS/pattern-catalog-stub.md" cat > "$ARCH_LAB/notes/patterns-lab-summary.md" <<'EOF' # Security Patterns Lab Summary — YOUR lab - api-gateway-pattern.md + microservices-security-pattern.md: defensive stubs - pattern-catalog-stub.md: catalog table for LAB-ARCH-001 - security-patterns-named.txt: named pattern literacy ## Refusals - No bypass/attack cookbooks; patterns describe defensive controls only EOF
Command — copy this
grep -E 'pattern-catalog|Refusals' "$ARCH_LAB/notes/patterns-lab-summary.md" curl -sS https://owasp.org/www-project-api-security/ | head -3
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t41-arch/LAB-ARCH-001/patterns/pattern-catalog-stub.md | Select-String Gateway
Primary tools to practice this lesson: grep, curl. Reference sites: OWASP ASVS (https://owasp.org/www-project-application-security-verification-standard/); Microsoft patterns (https://learn.microsoft.com/en-us/azure/architecture/patterns/); NIST 800-53 (https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Every design sample labeled LAB and LAB-ARCH-001 — not production stranger org data.
Zero offensive attack architecture files in pack.
3. Teardown
Secure notes chmod 600; SABSA pack ready for enterprise reference module.
Archive stub optional per brief.
4. What you ship: SABSA lab pack
Layer + context + attributes + summary + integrity — chmod 600.
5. What you record before the next lesson
SABSA lab pack path.
6. Wrong vs right: offensive playbooks vs YOUR threat models
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
SABSA lab includes offensive attack path diagram as bonus deliverable.
Right
SABSA lab pack on `$ARCH_LAB` LAB-ARCH-001. Next: quiz.
Mission: SABSA lab
1) Scope and LAB-ARCH-001 template proof. 2) SABSA layer card and business context. 3) Attribute profile matrix. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “SABSA summary — minimum metric rows?”
Knowledge Check
APPLY: SABSA lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Offensive attack diagrams earn SABSA lab credit.
True or False
Knowledge Check
APPLY: SABSA lab pack should:
Multiple choice