A descriptive study of Microsoft’s threat modeling technique
descriptive studies : what they can and cannot do .