Prepare one architecture and threat-model package per project

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R02 — OWASP ASVS

   R31 — NIST AI RMF

   R39 — OWASP Threat Modeling

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Finalize one self-contained Architecture & Threat-Model Package per flagship project (P1, P2, P3). Each package must include:

   • System architecture and trust-boundary diagram.

   • Asset inventory and shared contract schemas (Identity, D11 Ledger, Provenance, D8 Test Case, D4 PII Token).

   • STRIDE threat model and attack paths mapped to D1–D12 and C1–C12.

   • Reproducible test/benchmark metrics and honest residual-risk statements.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 110 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Three polished, employer-ready Architecture & Threat-Model Markdown/PDF packages in the portfolio root.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R02OWASP ASVS↗ owasp.org

  Access-control, validation, authentication, file-handling, and logging requirements.

• R31NIST AI RMF 1.0↗ nist.gov

  Govern, Map, Measure, and Manage functions; risk ownership, measurement, and lifecycle documentation.

• R39OWASP Threat Modeling↗ owasp.org

  Four-question framework & STRIDE: assets, trust boundaries, data flows, threat identification, and mitigation tracking.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP · Community guide
  Threat Modeling

  The four-question framework and the STRIDE-per-element mapping over data flows, stores, processes, and external entities, which gives each project package a repeatable method instead of a blank page.

  R39moved 2026-11-11
• videoPrabh Nair · 90 min
  Practical Threat Modeling Master Class: STRIDE-Powered

  Works a full e-commerce threat model from DFD through trust boundaries and risk scoring, then extends the method to serverless and AI systems — the closest template for a per-project package.

  R39checked 2026-11-11
• videoZ. Cliffe Schreuders · Lecture
  Threat modeling using STRIDE and Attack Trees

  Pairs STRIDE with attack trees so threats chain into multi-step attack paths, which is how you map a sequence like injection to tool misuse to exfiltration onto D1–D12 controls.

  R39checked 2026-11-11
• articleDrata · 12 min read
  Using the STRIDE Threat Model: Tutorial & Best Practices

  Gives the element-to-threat table (which STRIDE letters apply to flows, stores, and processes) plus trust-boundary placement rules, useful for keeping the model systematic under time pressure.

  R39unchecked 2026-11-11
• docsOWASP · Standard + levels
  OWASP Application Security Verification Standard

  ASVS supplies the access-control, validation, authentication, file-handling, and logging requirements that turn each STRIDE mitigation into a numbered, testable verification item.

  R02moved 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.