What are some areas to consider when performing a threat analysis?

Please recommend some evaluation strategies. What tools have you used to search for vulnerabilities in your operation?

For my websites the strategy that I always base my security testing off of is the OWASP standard.  OWASP stands for - Open Web Application Security Project.  This is a community that was created to help developers program in a manner to make a secure site.  They have 10 main rules to follow and when doing so your applications are normally pretty secure from general vulnerabilities.  This is something that any web developer should follow by.  Also in recent years they have expaned their guide to include specific things to look for in general to prevent other types of security issues that can become present on your site as well - http://www.owasp.org/index.php/Guide_Table_of_Content

We develop web applicatons for start-ups and small businesses. Three of the concerns that we have to face are cross sight scripting (XSS), cross sight request forgeries (XSRF)  and SQL injection attacks. Be sure to include those in your threat analysis.