Threat Modelling
A structured exercise that identifies what can go wrong with a design, before it is built, by walking the system's trust boundaries.
Four questions, in order: what are we building, what can go wrong, what are we going to do about it, and did we do a good job? STRIDE supplies the vocabulary for the second — spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege — walked across each component and each data flow.
The highest-yield artefact is a data-flow diagram with trust boundaries drawn on it, because almost every interesting threat lives on a boundary crossing.
The reason to do this at design time is arithmetic: a threat found in a diagram costs an afternoon; the same threat found in production costs an incident, a fix, a patch cycle and possibly a disclosure. Doing it once per significant design change is enough.