/2006/05/22/threat-modeling-web-applications
https://shahidshah.com/blog/threat-modeling-web-applications