Cyberwarfare / Nation-State Attacks
,
Fraud Management & Cybercrime
,
Government
Why Modern Threat Modeling Must Account for State Control of Infrastructure
Security leaders have been encouraged to view governments as partners for most of the past three decades. Regulators set the rules, law enforcement responds when incidents occur, and national cyber agencies provide guidance, indicators and frameworks. The underlying assumption has been that public authorities, while sometimes slow or clumsy, are broadly aligned with organizational interests.
See Also: On-Demand | NYDFS MFA Compliance: Real-World Solutions for Financial Institutions
That assumption is becoming less reliable.
This is not a political argument. It is a risk management one. When you strip away ideology and focus purely on threat modeling, there are credible scenarios where state actors control, influence or disrupt the very infrastructure your organization depends on. For CISOs, especially those operating across borders, that reality deserves sober consideration.
State-Level Infrastructure Control as a Threat Model
Traditionally, public authorities have been viewed as part of the trusted environment. Power grids, telecoms, transport ministries, cloud regions, internet exchange points and certificate authorities all sit within jurisdictions that are assumed to be neutral or supportive.
That model breaks down when the government uses infrastructure as a lever of control. Global examples of such disruptions already exist: mandated network shutdowns during unrest, lawful interception frameworks extended beyond criminal investigations, compulsory data localization and emergency powers that override commercial contracts.
None of this requires malicious intent to create risk. From a CISO’s perspective, intent is less important than capability. If a government can compel a telecommunications firm to throttle traffic, require access to encryption keys, revoke operating licenses or seize data centers, then those actions belong in the threat model alongside ransomware attacks and insider breaches.
How Threat Modeling Changes When the Adversary Controls Infrastructure
Most threat models assume the attacker is constrained by physics, access and cost. When the adversary has regulatory authority or physical control, those constraints look very different. Availability risk becomes more complex. Outages may not be random or accidental. They may be targeted, time-bound and legally justified. Recovery time objectives that assume vendor goodwill or reminder clauses may prove optimistic.
Integrity risks also shift. Configuration changes imposed upstream, changes to routing, DNS manipulation or forced updates can undermine security controls without ever touching your environment directly.
Confidentiality is perhaps the most uncomfortable area. Even when actions are lawful, compelled access to data can conflict with customer expectations, contractual commitments or obligations in other jurisdictions.
For CISOs, this means expanding threat modeling beyond technical attack paths. Legal powers, regulatory triggers and political context become part of the system map – not to predict outcomes, but to understand exposure.
Business Continuity Planning for Hostile Infrastructure Scenarios
Business continuity plans often assume infrastructure failure, but not hostility. There is a difference between a fiber cut and a mandated shutdown – one is accidental and the other may be selective, prolonged and resistant to escalation.
Practical steps include diversifying critical dependencies across jurisdictions where possible. This is not just about cloud providers, but about identity services, certificate authorities, communications platforms and payment rails.
Scenario planning matters. Tabletop exercises should include cases where services remain technically functional but are legally unavailable. Ask what happens if connectivity is restricted during business hours, or if access to logs is compelled without the ability to notify affected parties.
Organizations should also examine decision authority. In a hostile infrastructure scenario, delays caused by unclear escalation paths can be as damaging as the outage itself. Pre-agreed thresholds for executive involvement and legal consultation are essential.
Ethical and Legal Considerations Across Jurisdictions
Operating in multiple jurisdictions introduces ethical tension that no control framework can fully resolve. What’s lawful in one country may be illegal in another. Mandatory disclosure in one region may be a breach elsewhere.
CISOs sit uncomfortably at the intersection of these conflicts. While legal teams determine compliance, security leaders are often the ones implementing the technical mechanisms that make compliance possible.
Transparency matters. Organizations should be clear, internally and externally, about the limits of protection they can offer under different legal regimes. Overstating security guarantees in environments where compelled access is possible creates ethical risk as well as legal exposure.
There’s also a personal dimension. Security leaders must be supported when navigating these gray zones. Asking teams to quietly implement controls that undermine user trust without discussion or documentation is corrosive to culture and increases long-term risk.
Planning Without Paranoia
Planning for government as a potential adversary doesn’t mean assuming hostility or rejecting cooperation. It means acknowledging that power asymmetry exists and that infrastructure is increasingly a tool of statecraft.
The role of the CISO is not to litigate politics but to ensure the organization understands its dependencies and failure modes. In a world where digital infrastructure and state power are tightly coupled, ignoring that relationship is no longer a neutral choice.