[tptacek]

Ignore threat modeling and CISSP, both of which are industry kabuki dances. The rest of the advice in this comment is fine.