/2006/05/22/threat-modeling-web-applications
https://www.shahidshah.com/blog/threat-modeling-web-applications