However, there seem to be zero links to tools and approaches to actually do something? Most links are to articles explaining why the manifesto exists... by companies offering consulting in this area.
It's pretty Microsoft skewed (lots of references to Azure resources), but is a reasonable way to start thinking about the topic.
[1]: https://www.microsoft.com/en-us/securityengineering/sdl/thre...
1. break down your systems into smaller units
2. for each unit, figure out:
- what attackers are after (e.g. stealing a database)
- what attackers can do (e.g. infiltrate the network)
- what's the likelihood of each attack and scenario you can think about, along with the impact
- what you've done to prevent it (and is it good enough?)
- what you've done to detect it (and is it good enough?)
- what you would do to respond to a successful attack (and, is it good enough?)