# Insights into Organizational Security Readiness: Lessons Learned from Cyber-Attack Case Studies
## 1 Introduction  
Cyber threats are increasing for all entities, including individuals, small businesses and large corporations, leading to a varying degree of loss. In some cases, even amateur-led cyber-attacks can lead to massive disruptions. Cyber threats will become worse and more intense due to the pervasive nature of connectivity and the constant movement of data, which is not always well protected. There are well-studied areas of physical threats, such as fire and flood hazards; however, we still lack a deeper understanding of cyber-attacks. In traditional threats, prior events are studied and analyzed, and the lessons learnt are utilized for the future handling of such events. In this paper, we take this approach to study a vast array of cyber-attacks, in order to understand and inform the decision making and mitigation strategies for different types of cyber-attacks. We classify real-world cyber-attack case studies based on different types of attacks, analyze the major factors contributing to these attacks, and discuss possible mitigation strategies. Our aim is to provide knowledge which can be used to potentially prevent organizations from being victims of cyber threats by studying existing cyber-attacks. In most cyber-attacks, human behavioral aspects and the response to malicious stimuli are the weakest link in bringing about a successful cyber-attack. Behaviors such as distraction, ignorance, curiosity, failure to comply with security policy, and a lack of awareness ofcyber threats can cause major damage or potentially lead to an attack [1]. In our survey of real-world cyber-attack case studies, we identify and categorize the human aspects of the attacks, look at the financial and any other adverse impacts from these attacks, identify the challenges, and come up with potential mitigation strategies. The connection of these cyber threats to human aspects can help educate the stakeholders--including end users, decision makers and system administrators alike--to potentially be more aware of cyber-attacks. While the existing surveys take more of a theoretical perspective of different cyber-attacks, none of the surveys have addressed the evaluation of such a vast array of real-world cyber-attacks. For instance, [PERSON] gives an overview of Social Engineering attacks [2], and [PERSON] talks about Sony's data beach incident [3] in general. These surveys, however, do not provide an aggregated analysis of real-world cyber-attacks. In this paper, we attempt to explore multiple cyber-attacks and derive some common lessons learned by mining the factors we collected from these case studies to find commonalities across these cases. The contributions in this study are as follows:  
* the evaluation of multiple real-world cyber-attacks to understand the types of attack;
* the categorization of the human factors leading up to the cyber threats;
* The characterization of cyber-attacks;
* the mitigation strategies; and
* the lessons learned for providing actionable knowledge to create more awareness for all stakeholders. We evaluate over 43 cyber-attack incidents and study the process, impact, and outcomes of the threats. Specifically, we study both qualitative and quantitative characteristics, including the type of industry, financial intensity of the attack, non-financial intensity impacts, number of impacted customers, and the impact on users' trust and loyalty. In addition, we explore the factors leading up to the attacks: the human behavioral aspects; organizational cultural factors at play; security policies adapted; technology adoption and investment of the business; training and awareness of all stakeholders, including users, customers and employees; and investments in cybersecurity. We also analyze how these factors are related to each other by evaluating the co-occurrence and linkage of factors to form graphs of connected frequent rules seen across the case studies.