We should identify threats to the security of our system.

We should assess how likely each threat will happen.

We should assess the importance of each threat.

We should assess how much it costs to defend against each threat.

We should defend our system against each threat.