Write the threat model before you write the architecture