Assume basic principles, recognizing that some things are universally applicable; verify that systems operate and are controlled unpredictably to ensure that hackers cannot take advantage of predictable patterns; expand the scope of the assessment to a couple of domains at a time; don’t use documentation or flow diagrams until after your evaluation; identify most likely possible entry points for the domain you’re evaluating; consider threats to the company, intellectual property, and authorization; consider only external human threats; and consider internal system threats.