Security › Module 3 › Lesson 1
Secure Defaults
Shift left named literacy covers early security involvement, threat modeling in design, secure SDLC gates, and cost-of-fix curves — document shift-left row on YOUR $ARCH_LAB before requirements security.
Visual · t41_shift_left_named
Shift left named literacy. $ARCH_LAB only. Original Cyberlium.
Opening
Fixing security in production costs more — literacy teaches shift-left vocabulary so fictional org design decisions on $ARCH_LAB happen before code ships.
Shift left moves security activities earlier in the lifecycle — requirements review, architecture threat modeling, secure coding standards, pre-merge scanning — when changes are cheaper. On Cyberlium you practice on fictional LAB-ARCH-001 feature stories and design docs under $ARCH_LAB, never paste real employer production backlog items or customer feature specs without fictional labeling. Cyberlium writes shift-left row on YOUR $ARCH_LAB — lifecycle phase, security activity, cost rationale for one fictional feature on LAB-ARCH-001. Next: Requirements Security.
1. Shift left activities (named)
Requirements: security user stories and abuse cases on YOUR fictional org. Design: STRIDE on architecture diagrams before build. Build: secure coding standards and SAST in CI. Test: DAST and security test cases. Deploy: configuration baselines and review gates.
On $ARCH_LAB, write shift-left row — phase, activity, why earlier is cheaper for one fictional LAB-ARCH-001 feature.
Command guide
Try these commands — Shift left activities (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, grep. Reference sites: OWASP ASVS (https://owasp.org/www-project-application-security-verification-standard/); Microsoft SDL (https://www.microsoft.com/en-us/securityengineering/sdl/); NIST SSDF (https://csrc.nist.gov/publications/detail/sp/800-218/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why shift left reduces architecture debt
Retrofit MFA on legacy API costs more than designing auth in requirements. Shared shift-left vocabulary aligns product, engineering, and security on the same sprint gate. Documented gates survive architecture review on lab templates.
Students draft lab shift-left notes — production programs follow enterprise SDLC and change control.
3. Lab boundary
Forbidden: copying real employer Jira exports into lab requirements without fictional labels. Allowed: shift left named card — phase and activity with $ARCH_LAB fictional example.
Ship: shift-left row for YOUR lab feature. Next: Requirements Security.
4. What you ship: shift-left row for $ARCH_LAB
Lifecycle phase, security activity, cost rationale. $ARCH_LAB named. chmod 600.
5. What you record before the next lesson
Date. Shift-left row. $ARCH_LAB named. File t41-m03-l01-shift-left-named.txt chmod 600.
6. Wrong vs right: offensive playbooks vs YOUR threat models
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip requirements security because 'we'll pen test later.' Paste employer sprint backlog into lab.
Right
Write shift-left row for YOUR $ARCH_LAB fictional feature. Next: Requirements Security.
Mission: document shift left on YOUR lab feature
1) Pick one fictional LAB-ARCH-001 feature. 2) Name earliest security activity phase. 3) Write cost rationale for shifting left. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Shift left is earlier involvement — not 'skip testing entirely.'
Knowledge Check
APPLY: Shift left on Cyberlium primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Fixing security issues in design phase typically costs less than production retrofit.
True or False
Knowledge Check
APPLY: Shift left literacy on Cyberlium uses:
Multiple choice