Maybe this is a good primer? 

https://blog.securityinnovation.com/creating-your-own-personal-threat-model