There are at least three different common approaches to creating a threat model:
You can take a look at Wikipedia for a quick overview.
I wonder if one of those approaches has proven to be superior in general or if you have to choose them depending on the situation at hand. I have experience with all three of them and I personally prefer the attacker-centric approach because it feels straight forward and it fits my way of thinking. I can see the benefits of the asset-centric approach, especially if you want to see the business impact of certain threats directly. The software-centric approach feels clumsy and heavy-weight to me. If you want to drill in really deep and have a lot of time at hand for threat modeling it might be a good option though.
These are just my personal experiences. Is there an approach that has has proven to be superior in general or do you have to choose them depending on the situation at hand? Is there a common understanding about that in the Security Community.