Useful resources:
NIST: Cybersecurity Framework
Top 10 Web Application Security Risks
Attack Surface Analysis Cheat Sheet
https://github.com/Microsoft/AttackSurfaceAnalyzer