A good, practical article on Threat Modeling: https://martinfowler.com/articles/agile-threat-modelling.html