"Finally, have a plan" I'd argue that you're more secure and your life is easier if the plan (threat model), or at least the planning, come first. The greater

"Finally, have a plan" I'd argue that you're more secure and your life is easier if the plan (threat model), or at least the planning, come first. The greater your understanding of your data, users, platform, and attackers, the more likely you are to make good (e.g. secure, economical) choices about infrastructure, design, implementation, testing, incident response, etc. "Plans are nothing; planning is everything." - Dwight D. Eisenhower