Security › Module 3 › Lesson 1
Secure Defaults
Shift left named literacy covers early security involvement, threat modeling in design, secure SDLC gates, and cost-of-fix curves — document shift-left row on YOUR $ARCH_LAB before requirements security.
Visual · t41_shift_left_named
Shift left named literacy. $ARCH_LAB only. Original Cyberlium.
Opening
Fixing security in production costs more — literacy teaches shift-left vocabulary so fictional org design decisions on $ARCH_LAB happen before code ships.
Shift left moves security activities earlier in the lifecycle — requirements review, architecture threat modeling, secure coding standards, pre-merge scanning — when changes are cheaper. On Cyberlium you practice on fictional LAB-ARCH-001 feature stories and design docs under $ARCH_LAB, never paste real employer production backlog items or customer feature specs without fictional labeling. Cyberlium writes shift-left row on YOUR $ARCH_LAB — lifecycle phase, security activity, cost rationale for one fictional feature on LAB-ARCH-001. Next: Requirements Security.
1. Shift left activities (named)
Requirements: security user stories and abuse cases on YOUR fictional org. Design: STRIDE on architecture diagrams before build. Build: secure coding standards and SAST in CI. Test: DAST and security test cases. Deploy: configuration baselines and review gates.
On $ARCH_LAB, write shift-left row — phase, activity, why earlier is cheaper for one fictional LAB-ARCH-001 feature.
Command guide
Try these commands — Shift left activities (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP ASVS — https://owasp.org/www-project-application-security-verification-standard/ Microsoft SDL — https://www.microsoft.com/en-us/securityengineering/sdl/ NIST SSDF — https://csrc.nist.gov/publications/detail/sp/800-218/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export ARCH_LAB=${ARCH_LAB:-$HOME/cyberlium-lab/t41-arch}
curl -sS https://owasp.org/www-project-application-security-verification-standard/ | head -10
cat > "$ARCH_LAB/notes/design-principles-named.txt" <<'EOF'
Security design principles — NAMED LITERACY:
Least privilege: minimum access needed for role/function
Separation of duties: no single actor controls entire sensitive workflow
Fail secure: deny by default on error; safe degradation
Economy of mechanism: simpler designs easier to verify and operate
Complete mediation: every access checked; no hidden backdoors in design
Lab: security-design/principles-checklist.md — fictional LAB-ARCH-001 literacy
EOFCommand — copy this
grep -E 'Least privilege|Fail secure|LAB-ARCH-001' "$ARCH_LAB/notes/design-principles-named.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: OWASP ASVS (https://owasp.org/www-project-application-security-verification-standard/); Microsoft SDL (https://www.microsoft.com/en-us/securityengineering/sdl/); NIST SSDF (https://csrc.nist.gov/publications/detail/sp/800-218/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why shift left reduces architecture debt
Retrofit MFA on legacy API costs more than designing auth in requirements. Shared shift-left vocabulary aligns product, engineering, and security on the same sprint gate. Documented gates survive architecture review on lab templates.
Students draft lab shift-left notes — production programs follow enterprise SDLC and change control.
3. Lab boundary
Forbidden: copying real employer Jira exports into lab requirements without fictional labels. Allowed: shift left named card — phase and activity with $ARCH_LAB fictional example.
Ship: shift-left row for YOUR lab feature. Next: Requirements Security.
4. What you ship: shift-left row for $ARCH_LAB
Lifecycle phase, security activity, cost rationale. $ARCH_LAB named. chmod 600.
5. What you record before the next lesson
Date. Shift-left row. $ARCH_LAB named. File t41-m03-l01-shift-left-named.txt chmod 600.
6. Wrong vs right: offensive playbooks vs YOUR threat models
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip requirements security because 'we'll pen test later.' Paste employer sprint backlog into lab.
Right
Write shift-left row for YOUR $ARCH_LAB fictional feature. Next: Requirements Security.
Mission: document shift left on YOUR lab feature
1) Pick one fictional LAB-ARCH-001 feature. 2) Name earliest security activity phase. 3) Write cost rationale for shifting left. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Shift left is earlier involvement — not 'skip testing entirely.'
Knowledge Check
APPLY: Shift left on Cyberlium primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Fixing security issues in design phase typically costs less than production retrofit.
True or False
Knowledge Check
APPLY: Shift left literacy on Cyberlium uses:
Multiple choice