You draw the system, mark where data crosses a boundary, list threats per element and decide a mitigation for each. It is cheapest when done at design time.
Threat modeling
A structured way to ask what you are building, what can go wrong and what you will do about it, before attackers ask the same questions.