## 5 Discussion
### Vulnerabilities Mitigation
#### 5.2.2 Hack  
As evidenced in the cases examined in this paper, such as eBay, Target, and Home Depot, phishing is a common threat vector used to initiate data breaches. A practical approach for reducing the success rate of these attacks is implementing a robust SETA program, which is discussed in more detail in Section 5.2.7. Such a program plays a fundamental role in enhancing employees' ability to recognize and thwart security threats, such as phishing attempts. [PERSON] et al. [67] reviewed the literature on phishing mitigation procedures through different vectors, such as e-mail and websites. Most proposed techniques rely on Machine Learning or training and awareness. Multifactor Authentication (MFA) may protect the user account even after successful phishing, as the user's identification and password obtained with the technique would not suffice for logging in, requiring an extra factor. As related in Section 5.2.1, in Target and Home Depot breaches, after successfully phishing credentials, the attacker used banking malware to exfiltrate data. As the financial sector represents the most significant contribution portion in the dataset, we find it convenient to discuss this type of malware. [PERSON] et al. [68] surveyed some of these malware (namely, Zeus V2, Citadel, Carberp, Vawtrak, Dridex, Dyre, and Rovnix), providing Indicators of Compromise (IoC) for identifying their infection and evaluating their similarities and differences. However, it is relevant to note that certain malware strains are region-focused, such as Guildma, Grandoreiro, and Javali, which primarily targeted Brazilian entities [69]. A threat intelligence project may be needed to identify common malicious activities within the organization's operational domain. Even after a successful malware infection, the data breach may be prevented if the company effectively applies other security measures, such as encryption and access control. This was not the case, for example, with LinkedIn, which, as discussed in Section 4.3, had millions of unsalted password hashes leaked, highlighting the importance of comprehensive security measures to protect sensitive data. Several factors compounded LinkedIn's security vulnerabilities. Firstly, the company employed the SHA-1 hashing algorithm, which has been demonstrated to be vulnerable to various attacks. NIST SP 800-131A revision 2 has disallowed the use of SHA-1, permitting it for non-digital signature applications only. Currently, SHA-2 and SHA-3 are secure message-digesting algorithms. Secondly, LinkedIn's security was compromised by the absence of a salt algorithm to enhance the security of hashed passwords. When the same password is processed using the same message-digesting algorithm, it consistently generates the same hash value, which increases predictability and susceptibility to brute-force attacks. Salting algorithms involve appending a unique string to the password before hashing it, significantly improving its security. Additionally, password leak bases should be continually monitored, in search of credentials in use at the organization. Section 4.1 briefly introduced the Heartland Payment System breach, which relied on SQL injection. For application-level vulnerabilities, such as the one exploited at HPY, the Open Worldwide Application Security Project (OWASP) is a well-known reference. They regularly publish the Top 10 vulnerabilities in the application security scope, along with their mitigation strategies, such as input validation, Web Application Firewall (WAF), and software testing. Although not in the studied dataset, attackers successfully intruded on cloud providers in the 2020 SolarWinds hack case, exposing and breaching their customers' data [70]. In this incident, adversaries inserted arbitrary code in the source code of a company product called Orion. Afterward, SolarWinds distributed the malicious code to its customers as part of the product, infecting over 18,000, including government entities and private companies [71].