I agree offcourse that a threat analysis is very specific and can differ between implementation depending on requirements. But what I ment was more just to mention it briefly (perhaps in a conclusion) since it is overlooked quite often. People yelling and screaming we need security! We need certificates! While sometimes none of those actually is needed……. .

But great articles, have read them al ,

a threat analysis is not something you can do once and then apply on all web services. It’s like having one single figure you can use to say what the chance of theft is in a store. That would of course depend on the location of the store and type of articles sold.

My goal in these articles is just to provide the information about types of securtiy available and what they actually secure. It’s up to you to do a threat analysis on your own services and decide which type of security you apply.

Would be interesting to also see your thoughts on another topic if you could squeeze it in the conclusion:

- When to implement security. (Threat analysis)

Looking forward to your posts!!!