during a risk analysis meeting, you are asked to specify internal threats being considered. which item is not considered an internal threat?