Start with a drawing
List the assets that matter — credentials, personal data, money movement, availability — then draw where each one crosses a trust boundary. Almost every real incident lives on one of those crossings.
Enumerate, then rank
Walk each boundary and ask what an attacker gains by controlling one side of it. Rank the results by blast radius and by how cheap the attack is to attempt, not by novelty.
- Authentication and session handling at the client boundary.
- Authorisation checks on every server-side data path, not just the UI.
- Third-party callbacks: verify signatures before parsing anything.
- Secrets: server runtime only, never shipped to the browser.
Mitigate and record
Each ranked threat gets a mitigation, an owner and a test. The test is the part most teams skip, and the part that keeps the model true as the service changes.
Revisit on change
New integration, new data class, new region: each is a reason to reopen the drawing. A threat model is a living artefact or it is decoration.