How to mitigate risk from nation-state attacks