internal vs external threats