Threat identification

- STRIDE per element (Spoofing, Tampering, Repudiation, Info disclosure, DoS, Elevation) - Attack tree construction for critical assets - Abuse case development - Consider third-party and supply chain threats - Privacy threats (LINDDUN if applicable)