Implementing a “threat-centric” security strategy means to focus on which one of the following options?