# Insights into Organizational Security Readiness: Lessons Learned from Cyber-Attack Case Studies
## 3 Case Study Methodology
### Categorization of the Human Aspects
**Case Studies:** All the case studies on cyber attacks  
**Types of Attacks:** Categorization of cyber attacks  
**Human Factors:** Ignorace, Negligence, Configuration, Deceit  
**Industry:** Technology, Health, Entertainment, Advertisement, Transportation, Energy, Food & Agriculture, Communication, Nuclear, Financial, Manufacturing, Retail, Education  
**Financial Intensity:** Low (1) = less than $100K, Less than Moderare (2) = less than $250K, Moderate (3) = less than $500K, High (4) = less than $1 Million, Huge (5) = greater than $1 Million  
**Non-Financial Intensity:** Biometric, Health, PII, Reputation, Credebility, Maturity, Privacy  
**# of Customers (Vicitims) Impacted:** Low (1) = less than 50K, Less than Moderare (2) = less than 100K, Moderate (3) = less than 250K, High (4) = less than 500K, Huge (5) = greater than 500K  
**Cultural Factors:** Cultural coherence with cyber awareness, be acclimated with the corporate culture  
**End User Trust & Loyalty:** Buy-in within the organization and be loyal to follow cyber policies and protect digital assets for the company  
**Policy Issues:** Minimal/weak cybersecurity policy (Y = having policy issue or no policy, N = Having sound cybersecurity policy)  
**Training & Awareness:** Adequate training to educate the employees on cyber threats  
**Technology Adoption (for Cybersecurity Prevention):** Efficient technology applied to protect from cyber threats  
**Investment:** Enough Funding (investment) on cybersecurity implementation/precautions  
**(b)**  
**Figure 3. (a)** Human aspects of cyber threats. (b) Summary of the factors in Table 2.  
\begin{table}
\begin{tabular}{l|l|l|l|l|l|l|l|l|l|l|l|l} \hline \hline \multirow{2}{*}{**Case Studies**} & \multirow{2}{*}{**Types of Cyber**} & \multirow{2}{*}{**Human**} & \multirow{2}{*}{**Fraction**} & \multirow{2}{*}{**Inquiry**} & \multirow{2}{*}{**Inquiry**} & \multirow{2}{*}{**Non-**} & \multicolumn{2}{c|}{**\# of**} &  
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Case Studies**} & \multirow{2}{*}{**Types of Cyber**} & \multirow{2}{*}{**Human** **Attacks**} & \multirow{2}{*}{**Industry**} & \multirow{2}{*}{**Financial**} & \multirow{2}{*}{**Non-** **Intensity**} & \multirow{2}{*}{**Financial**} & \multirow{2}{*}{**Councomers**} & \multirow{2}{*}{**Councomers**} & \multirow{2}{*}{**End User**} & \multirow{2}{*}{**Policy**} & \multirow{2}{*}{**Training \& & & & & \\  & & **Attacks** & **Factors** & & & (0-9) & **Intensity** & & & **Di-50** & & & & & \\ \hline Cross Site Capting & Brower Based & \multirow{2}{*}{Configuration} & Entertainment & - & Reputation & - & N & N & Y & N & N & N \\ \cline{2-11} (OSS) & & & Social & & & & & & & & & & & \\ \hline Cloud Agent Pick & Social & \multirow{2}{*}{Decult} & \multirow{2}{*}{-} & \multirow{2}{*}{Reputation} & \multirow{2}{*}{5} & \multirow{2}{*}{Y} & \multirow{2}{*}{N} & \multirow{2}{*}{Y} & \multirow{2}{*}{N} & \multirow{2}{*}{Y} & \multirow{2}{*}{Y} & \multirow{2}{*}{Y} & \multirow{2}{*}{Y} \\ -Password Attack & & & & & & & & & & & & \\ \hline DCS Attack & \multirow{2}{*}{Decult} & \multirow{2}{*}{Entertainment} & - & Reputation & 4 & N & N & Y & N & N & N \\ \cline{2-11} DDO Attack & & & & & & & & & & & & & \\ \hline DDO-SNIT & DDoS & \multirow{2}{*}{Decult} & \multirow{2}{*}{-} & \multirow{2}{*}{Conability} & - & N & N & Y & N & N & N & - \\ \hline Biting & \multirow{2}{*}{Decult} & \multirow{2}{*}{Transportation} & \multirow{2}{*}{3} & \multirow{2}{*}{Privacy} & \multirow{2}{*}{2} & N & N & Y & - & N & N \\ \cline{2-11} \cline{6 Among these human factors, ignorance and negligence are the two main factors where the users are either not aware of the kind of threats they fell victim to, or the users neglected the fact that they could be the victims of known cyber-attacks. For instance, the Stuxnet worm exploited Iran's nuclear program in 2009-2010, which Iranians had no knowledge of. RSA-APT attack is another example of ignorance from the victims where they experienced a zero-day attack that started with a phishing email that read \"2011 Recruitment Plan\" [29]. The Heartland Payment System had a data breach in 2008 through a malware attack without any prior knowledge from the victims. As Reuters reported back on 21 May 2014, 145 million eBay accounts were hacked with their passwords being compromised; therefore, a massive number of password reset requests went out to all 145 million eBay users to reset their passwords. The Home Depot data attack gained access to the payment system, installed malware, and sent payment information to the hacker's server.  
On the other hand, the Sony wiper malware attack in 2014 is a good example of negligence, where Sony ignored the fact that there could be a real threat on their system until it was too late [30]. A similar issue was revealed when P.F. Chang's sales machine was hacked with customers' debit card and credit card information [31]. On 30 March 2011, Epsilon revealed a Data Breach attack on brand name companies like Citibank, Capital One, Marriott, Best Buy, and JP Morgan and Chase, in which they lost close to $4 billion [32].