STRIDE
A mnemonic for six threat categories — spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege — walked across each component and data flow.
Its value is as a prompt that makes analysis systematic rather than dependent on what the reviewer happened to think of. Each category also maps to a security property it violates, which points at the control:
Spoofing → authentication. Can something pretend to be this component or this user? Tampering → integrity. Can data be modified in transit or at rest? Repudiation → non-repudiation. Can someone deny having done something, because nothing recorded it? Information disclosure → confidentiality. Can data be read by someone who should not? Denial of service → availability. Can it be made unavailable? Elevation of privilege → authorisation. Can someone do more than they are permitted?
The method: draw a data-flow diagram with trust boundaries marked, then walk each boundary crossing and each store through the six. Boundary crossings are where nearly all interesting threats live, which is why the diagram matters more than the mnemonic.
The output should be a small number of prioritised, owned mitigations — not an exhaustive list. A threat model producing eighty findings with no ranking gets filed, and the exercise is worth repeating at each significant design change rather than performed once.