Security › Module 4 › Lesson 4
Lab — STRIDE
Pack STRIDE named, trust boundaries, and DFD literacy — STRIDE worksheet file from $ARCH_LAB only.
Visual · t41_stride_worksheet_lab
Lab: STRIDE worksheet pack. $ARCH_LAB only. Original Cyberlium.
Opening
STRIDE worksheet merges categories to boundaries to DFD — paperwork before architecture patterns module.
Lessons 4-1–4-3 named STRIDE, trust boundaries, and DFD literacy. This lab merges three sections into one $ARCH_LAB STRIDE worksheet with M1 ethics and M3 SBD cross-references. No live attack cookbooks or employer diagram imports — defensive threat modeling paperwork only. Next: Quiz — STRIDE Threat Modeling.
1. Lab contract: STRIDE worksheet pack
Create $HOME/cyberlium-lab/t41-m04-l04-stride-worksheet-lab.txt merging STRIDE rows, trust boundaries, and DFD elements with $ARCH_LAB fictional org LAB-ARCH-001 and M1/M3 cross-references.
Optional: link STRIDE mitigations to security requirements from M3 by feature name.
Command guide
Try these commands — Lab contract: STRIDE worksheet pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Microsoft STRIDE — https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool OWASP Threat Modeling — https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html Microsoft SDL — https://www.microsoft.com/en-us/securityengineering/sdl/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export ARCH_LAB=${ARCH_LAB:-$HOME/cyberlium-lab/t41-arch}
export ARCH_STRIDE=${ARCH_STRIDE:-$ARCH_LAB/LAB-ARCH-001/stride}
cat > "$ARCH_STRIDE/worksheet-customer-portal.md" <<'EOF'
# STRIDE Worksheet — Customer Portal — LAB-ARCH-001
**Scope:** Browser → CDN → API Gateway → Auth Service (fictional)
| Threat (STRIDE) | Scenario (literacy) | Defensive mitigation | Owner |
|-----------------|---------------------|----------------------|-------|
| Spoofing | Stolen session cookie (fictional) | HttpOnly + Secure cookies; short TTL; rotation | App Sec |
| Tampering | Modified API request body (fictional) | Schema validation + HMAC where applicable | Platform |
| Repudiation | User denies transaction (fictional) | Audit log with user ID + timestamp | Compliance |
| Info disclosure | Verbose error leaks stack (fictional) | Generic errors to client; detail in server logs only | Eng |
| DoS | Flood login endpoint (fictional) | Rate limit + CAPTCHA at edge | SRE |
| Elevation | User accesses admin API (fictional) | RBAC + scope checks on every route | App Sec |
LAB SAMPLE — threat modeling literacy — NOT penetration test playbook
EOFCommand — copy this
cat > "$ARCH_STRIDE/worksheet-admin-console.md" <<'EOF' # STRIDE Worksheet — Admin Console — LAB-ARCH-001 **Scope:** Admin browser → PAM jump → Control plane API (fictional) | Threat (STRIDE) | Scenario (literacy) | Defensive mitigation | Owner | |-----------------|---------------------|----------------------|-------| | Spoofing | Phished admin creds (fictional) | MFA + device compliance + PAM session | IT Sec | | Tampering | Unauthorized config change (fictional) | Change approval workflow + signed configs | Platform | | Repudiation | Admin denies destructive action (fictional) | Immutable audit + session recording stub | GRC | | Info disclosure | Admin panel exposes secrets (fictional) | Secret redaction in UI; vault references only | Eng | | DoS | Control plane overload (fictional) | Rate limits + circuit breakers | SRE | | Elevation | Support role runs prod deploy (fictional) | SoD: deploy role separate from support | CISO | LAB SAMPLE — defensive controls only EOF
Command — copy this
grep -E 'LAB SAMPLE|Spoofing|Defensive mitigation' "$ARCH_STRIDE/worksheet-customer-portal.md" "$ARCH_STRIDE/worksheet-admin-console.md" cat > "$ARCH_LAB/notes/stride-lab-summary.md" <<'EOF' # STRIDE Lab Summary — YOUR lab - worksheet-template.md: generic STRIDE grid - worksheet-customer-portal.md + worksheet-admin-console.md: filled examples - stride-named.txt + stride-process.md: methodology literacy ## Refusals - No attack cookbooks; mitigations are defensive design only EOF
Command — copy this
grep -E 'worksheet|Refusals' "$ARCH_LAB/notes/stride-lab-summary.md" curl -sS https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool | head -5
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t41-arch/LAB-ARCH-001/stride/worksheet-customer-portal.md | Select-String LAB
Primary tools to practice this lesson: grep, curl. Reference sites: Microsoft STRIDE (https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool); OWASP Threat Modeling (https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html); Microsoft SDL (https://www.microsoft.com/en-us/securityengineering/sdl/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for exploit steps, live target references, employer architecture exports — remove. Confirm all components are $ARCH_LAB fictional placeholders.
STRIDE mitigations stay defensive — not offensive cookbooks.
3. Lock the proof
chmod 600 on the pack. Quiz next — then DMZ and Segmentation.
STRIDE literacy feeds architecture patterns lessons in M5.
4. What you ship: STRIDE worksheet pack for $ARCH_LAB
Merged STRIDE, boundaries, DFD sections. $ARCH_LAB named. NO attack cookbooks. chmod 600.
5. What you record before the next lesson
Date. STRIDE worksheet path. $ARCH_LAB named. File t41-m04-l04-stride-worksheet-lab.txt chmod 600.
6. Wrong vs right: offensive playbooks vs YOUR threat models
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include live exploit walkthrough in worksheet. Skip trust boundary section.
Right
Write YOUR STRIDE worksheet pack for $ARCH_LAB. chmod 600. Next: Quiz — STRIDE Threat Modeling.
Mission: freeze YOUR STRIDE worksheet pack on disk
1) Merge M4 literacy sections. 2) Confirm zero attack cookbook refs. 3) Link M1/M3 cross-refs. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One governed STRIDE worksheet beats ten inconsistent threat sticky notes.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: STRIDE worksheet should include trust boundaries and mitigations.
True or False
Knowledge Check
APPLY: STRIDE worksheet supports:
Multiple choice