. "Necessary controls in an application should be identified using threat analysis to ensure that the application is protected against common types of attacks based on the threats it faces." . . .