Assumes Person Knows
Threats in technology are easily misrepresented in the way we "fail" to use in the way the tools are designed. If we are unable to understand the structure in an organizations management capabilities; a) we will build outside the system of recordb) if we cannot negotiate or honor the business purpose, we will replicate outside the system of record or force opening up controls
In either of the above situations, a person must know the rules and requirements in depth. We know worldwide gaps exist with what people know and the difference in regard to policy or laws and how these policies or laws impact the role a person has in a company.
Build for the rule and gain the knowledge the person or threat knows the intended use and purposely deviated to cause harm.