Getting Started with Software Threat Modeling: Lessons Learned