There's also "Threat Modeling: Designing for Security" http://amazon.decenturl.com/threat-modeling (2014)
Reply on news.ycombinator.com