The Process of Security by Bruce Schneier

https://www.schneier.com/essays/archives/2000/04/the_process_of_secur.html