Cyber Breach at Staysure.co.uk Ltd: A Case Study

This report discusses the cyber breach at Staysure.co.uk Ltd, including a summary of the case study, security architecture, risk analysis, recommendations, and psychological motivations.

Running head: CYBER BREACH
CYBER BREACH
Name of student
Name of university
Author’s note:

1
CYBER BREACH
Table of Contents
Introduction....................................................................................................................2
Discussion......................................................................................................................2
Stage 1........................................................................................................................2
Task 1: Summary...................................................................................................2
Task 2: Security architecture..................................................................................4
Stage 2: Threat analysis and threat assessment..........................................................4
Task 3: Risk analysis and threat assessment..........................................................4
Task 4: Recommendations.....................................................................................7
Stage 3: Psychological motivations........................................................................10
Task 5: Psychological motivations for insider attack..........................................10
Stage 4: Security architecture...................................................................................12
Task 6: Design of security assurance architecture...............................................12
Task 7: Security policies......................................................................................14
Conclusion....................................................................................................................16
References....................................................................................................................17

2
CYBER BREACH
Introduction
This report aims to discuss the issue of cyber breach at Staysure.co.uk Ltd. A detailed
case articulation is provided in this report. The summary of the case study from the open
source is provided in this report. A high level security diagram is provided in this report for
the company. A risk assessment of the architecture and the system is carried out that covers
all the assets, vulnerabilities, threat actors, and the threat sources. A short recommendation is
provided for preventing the breach. The psychological motivations that could be used for
explaining the attack is discussed in this report. A security assurance architecture is provided
that could have prevented the data breach with explanation of the components and the
architectures. A set of information security policies that covers the system for including the
overall security policies is provided in this report.
Discussion
Stage 1
Task 1: Summary
Staysure.co.uk Ltd has the speciality in the financial and insurance services in Europe
and UK. It was designed in 2004 for providing the travel insurance and then expanded further
for providing motor, home, health, and life insurance along with several other insurance
products. In the month of October, 2013 Staysure.co.uk faced a serious security breach
wherein over 100,000 live details of credit card along with the other personal details of
customers were compromised. The security breach almost affected 7% of customers who had
bought insurance from the Staysure prior May 2012. Prior May 2012, the card numbers of the
customers were stored by the company along CVV numbers and several other personal
details like the name and address of the customers. The encryption of the card details was
done but the entry of the CVV numbers in the database were not done according to the rules

3
CYBER BREACH
of the industry. The CEO of the company claimed that the storing of the details was done for
helping the customers in the process of renewal. Post May 2012, the details storing was
ceased by the company. The server where the website server was based had a vulnerability of
software and even though the publishing of the software patch was done in the between 2010
and 2013, the controller of data failed in updating the software both the times due to lack of
the formal process for review and applying the updates of software. The failure of updating
the security flaws and the database software in IT security system created significant
vulnerability to the cyber attack. The flaws in the JBoss application web server were
exploited among October 2013. The vulnerability was used by the attacker in the application
server for injecting the malicious JavaScript code called the JSPSpy on the website of the
firm. Using JSPSpy, the attackers were able to remotely view and then perform the
modification on the source code of the website and then query on the database that contains
all the details of customers. It also allows the attackers to open a command shell that allows
them to remotely execute the privileged commands of operating system. The attackers
particularly downloaded after they targeted the details of payment card. Although, encryption
was done to the card numbers, the attackers were able in identifying the keys that were used
in the encryption and then could decryption was performed for the card numbers. During the
time of attack, the database included almost 110, 096 live details of cards, that posed a threat
of being exposed and then used for the fraudulent transactions. The knowledge of the attack
was gained by the company on 14th November 2013 and then immediately hiring of
independent experts of forensic data was done and wrote to over 93, 389 customers for
providing them with the knowledge of the attack. Free access to the Data patrol was provided
to the affected customers by the company that is the monitoring service of the identity fraud.

4
CYBER BREACH
Task 2: Security architecture
Figure 1: Security architecture of Staysure.co.Uk
Stage 2: Threat analysis and threat assessment
Task 3: Risk analysis and threat assessment
The main intention of the risk assessment and the threat analysis is in maximising the
protection of three pillars of security called Integrity, Accessibility, and Confidentiality while
even providing the functionality and usability (Mc Brearty, Farrelly and Curran 2016). A risk
to an organisation or any individual in the collaborative relationship of the asset, threat, and
vulnerability. The several risks levels can be presented as product of impact and the
probability.

5
CYBER BREACH
Quantative Qualitative Description
5 High Any high risk can take place often and it
can have a significant effect on
organisation. Various measures would be
required for the mitigation of any high
level risk.
4 Medium Any medium risk could occur with the
higher probability but it might not persist.
If this occurs the organisations could have
any significant or severe effect.
3 Medium Any medium risk would likely to occur in
many situations and if any medium level
attack occurs it might have the moderate
to severe effect on organisation.
2 Low
medium
Any low medium risk could be considered
when any organisation would have any
moderate or minor impact as the result of
any attack.
1 Low
medium
Any low medium risk could be considered
to be low when likelihood of any attack on
any entity is low and impact of the attack
on entity is minor or negligible.

6
CYBER BREACH
This figure shows the risk matrix that represents various risk levels. Any vulnerability
is the weakness in system, which can be exploited by any attacked or it can be unintentionally
triggered by any person in any organisation. The likelihood is possibility, which any
vulnerability would be advantageous or any vulnerability would be triggered by anyone
unintentionally. The likelihood is connected to the intent of the attacker, the ability of the
attacker and the target of the attacker. If any certain vulnerability would be exploited, impact
on any organisation could be expressed in the terms like the minor, moderate, negligible,
significant, severe.
This table below displays the risk assessment architecture for the Staysure.co.Uk. This
firm had various flaws in the security in system that the attackers used for gaining the access
to the information of the customer.
Asset Threat Vulnerability Threat Actor Consequence
s
Likelihood
Customer
personal
details
Can be
accessed and
manipulated
No security
procedure
was
implemented
in the
database as
the data is
Any person
or hacker in
the
organisations
Gaining the
access to the
database with
getting the
access to
webserver or
the SQL
The personal
details of the
employees
like the
name, phone
address
could be

7
CYBER BREACH
hugely
accessible
injections accessed,
used or
modified
Company
website
The website
source code
could be
modified
and then
malicious
code could
be injected
and then
made to
execute on
browser
The cross
site scripting
could be
performed
on website if
the security
measures are
not properly
handled
while the
development
of the
website.
Insider or
any hacker
Web pages The
injection of
the
malicious
code in the
web pages
could be
done and
therefore
allowing the
access to
web server
and database
Controller
system of
data
Lack of the
intrusion
detection
system
Any system
without the
proper
security
measures
could be
simply
penetrated
Insider or
any hacker
who is
attempting in
getting the
unauthorised
access
Any backdoor
that is created
in the web
server
Gaining
access to
data
controllers
allows threat
actor in
executing
the
privileged
commands
of operating
system
Details of
financial
card
Incorrect
storage of
the financial
details
The
unencrypted
details that
are stored in
the database
Insider or
any hacker
who are
attempting to
obtain
unauthorised
access
The source
code of the
website could
be exploited
for the
querying the
database
The card
details could
be used for
making the
fraudulent
transaction
and the
cloning
Task 4: Recommendations
Commonly, the data breaches could happen due to the hackers obtaining the access to
information or else lose any device that has the unencrypted information. Some of the
methods of preventing the breaches to the website are:

8
CYBER BREACH
Protection of the information: The sensitive information should be protected
whenever the storing has been done or accessed (Black 2013).
Reduction of the data transfer: Strict ban must be implemented on the transfer of the
data from one device to any another external device (Gao, Zhong and Mei 2015). The loss of
the removable media would put data on disk under severe risk.
Restriction of the download: Media that would serve as the allegiance to hackers must
be placed with restriction in downloading (Laube and Böhme 2016). It could significantly
reduce the transferring risk of the downloadable media to any external source.
Shredding of the files: organisation must shred the files and the folder prior disposing
any equipment of storage (Ahmed and Hossain 2014). There are several applications that can
retrieve the information after executing the formatting.
Ban on the unencrypted device: The organisation must implement ban on device that
have been unencrypted. The portable devices and the laptops which are unencrypted are
vulnerable to the attack.
Securing transfer: The exploitation of the secure courier services and the packaging
that is tamper proof during the bulk data transportation would help in the preventing any
breach (Wang et al. 2013).
Strong password: password for access should be unpredictable and immensely
difficult to hack. The change of the password in regular intervals.
Automation of the security: the automating system which regularly checks the settings
of the password, firewall and the server configuration may bring the reduction of the risk in
sensitive information (Hovav and Gray 2014).

9
CYBER BREACH
Identification of the threats: the team of security must have the capability of
identifying the suspicious activity on the network and it should be prepared in case there is
any attack from network.
Monitoring the leakage of data: The periodic checking of the controls of security
would allows the team of security in having the control on network (Serwadda and Phoha
2013). The constant check on the contents of the internet for locating whether any private
data is accessible for the viewing to the public is also a good practise of monitoring the data
Tracking the data: the tracking of the data motion in the network of the organisation
would prevent the unintentional use of the sensitive information (Lee, Geng and Raghunathan
2013).
Defining the accessibility: Outlining the accessibility to the people who are currently
working on the sensitive data of the company would help in reducing the risk of the malicious
users.
Training of security measures: Offering the training of the security and privacy to all
the clients, employees and any other connected to the data activities would help in reducing
the awareness regarding the data breaches (Liu et al. 2015).
Stopping incursion: by shutting down the avenues to the warehouse of the company
would prevent any incursion by any hacker. The solutions of production, security, and
production should be complained for preventing the targeted attacks (Amin, Maitra and Rana
2013).
Response to any breach: possessing any response for any kind of breaches would help
in triggering the swift response to any data breaches and assist in harm reduction. This plan
could possess the steps involved notifications of any concerned staff or agency who could
handle the breach (Chou 2013).

10
CYBER BREACH
Stage 3: Psychological motivations
Task 5: Psychological motivations for insider attack
It has been observed that the motivation is the major factor that leads to the insider
threats. These motivations includes the stress, greed, espionage and revenge (Gordon et al.
2015). The motivation of the insider attack could be grouped into three major categories,
which are financial gain, sabotage, and the business gain. It has been discovered that in the
recent times, the major reason for the insider attacks is the financial, which is the intention of
the attacker to sell the data and information of the organisation that exists in database
(Crossler et al. 2013). Frequently, the insiders intentionally misuse the system for gaining the
sensitive data for the business or financial gains. Whether motivation is accidental or
deliberate, this represents the significant risk of the inappropriate activity of the user
(Soomro, Shah and Ahmed 2016). The motivation of the malicious insider could include the
intent of gaining personal financial data or insider might have been recruited by any
competitive organisations, which financially rewards the insider for the breach. The
opportunity could be an important motivational factor, the methods by which the availability
of the opportunity could motivate the employees in abusing the organisations (Huang, Behara
and Goo 2014). Most of the insider breaches in the banking and the finance sector is
motivated by the personal gains, instead of any desire of sabotaging the information or the
infrastructure of the organisations. The insiders stole the information for selling it and then
modified the data for achieving the financial gains for their own. Another motivation for the
insider breaches is the business advantages (Romanosky, Hoffman and Acquisti 2014). In
these cases, the malicious insiders stole the intellectual property for gaining any business
advantage. In some situations, the insiders stole information for gaining any direct advantage
at any new job or for implementing any new competing business. If insiders consist of the
motive for harming the organisation and having the physical or logical access either

11
CYBER BREACH
unauthorised or authorised, and are familiar with environment of workplace, they could
represent any serious threat to organisation (Wang et al. 2013). The malicious insider threats
can be categorised as the emotions based, financially based, and politically based. The
emotions based are the threats that are caused when any insider is depressed, frustrated, angry
or bored on the basis on any situation that involves any organisation or any workplace, there
is a high probability that the people might act out maliciously (Lafuente 2015). The
financially based insider threats are commonly motivated by the intent of gaining extra
money by any individual. If any employee is suffering from any kind of hardship financially,
or they are intending to improve the financial situations then it raises the chances of
exploiting the opportunity of insider breaches for gaining money. The unintentional insider
threats can be caused due to the lack in the knowledge or understanding, convenience, or
misplaced technology (Arlitsch and Edelman 2014). The lack of the knowledge regarding any
particular aspect if the policies of cybersecurity are increasingly technical and robust. The
aspect of Work on-the-go immensely more common every year. Moreover increased threat of
the prying eyes that are attempting in gaining access in these protected devices, it provides
any opportunity for the insiders in accidentally misplace the equipment, creating it a huge
risk (Ritter et al. 2015).

12
CYBER BREACH
Stage 4: Security architecture
Task 6: Design of security assurance architecture
Figure 2: Advanced security architecture
Cloud: The cloud is the shared pool of resources of computer system that are
configurable has high level services, which can be swiftly provisioned with the minimum
effort of the management, frequently over internet (Yang, Shieh and Tzeng 2013). The cloud
computing depends on the resources sharing for achieving the coherence and the economies
scale that is similar to the public utility.
The third party clouds enables the organisation in focussing on the main businesses
rather than expanding the resources on the computer maintenance and the infrastructure (Sen

13
CYBER BREACH
and Borle 2015). The company can increase the agility as the technology of cloud computing
might increase the flexibility of the user with the adding, re-provisioning, or the expansion of
the technological resources of the infrastructure. A model of delivery of public cloud converts
the capital expenditures to the expenditure of operation. This lowers the barriers to the entry
as the infrastructure is commonly offered by any third party and does not need to be
purchased for infrequent or one-time intensive tasks of computing (Gao, Zhong and Mei
2014). The benefit of the independence of the location and device enables the users in
accessing the systems by using any web browser irrespective of the location or kind of device
that is being used. The maintenance of the cloud is easy to execute as it does not require to
installed on each of the computer of the user and it can be accessed from various places
(Wang and Wang 2014). The performance is maintained by the IT experts from service
providers and the consistent and the architectures that are loosely coupled are then
constructed using the services of web as system interface. The productivity might increase
when the multiple users could work on similar data simultaneously, instead of waiting for it
in being saved and then emailed (Cezar, Cavusoglu and Raghunathan 2013).
Firewall: The first line of defense in any organisation is the firewall.. Firewalls follow
a set of established rules and protocols for monitoring incoming and outgoing traffic. The
secure network is blocked from the access of internet and enables the pass-through of pre-
cleared data (Van Deursen, Buchanan and Duff 2013). Firewalls are adjusted for allowing
remote access as required and it can be combined in the solutions of virtualisation or
mobility. In the area of computing, the introduction to the firewall is the system of network
security, which controls and monitors the outgoing and incoming network traffic on the basis
of the predetermined rules of security (Arnbak et al. 2014). Any firewall specifically
implements the extensive barrier among any trusted internal network and the external
network that is untrusted like the internet. Any firewall can be implemented as the packet

14
CYBER BREACH
filter. The packer filters acts by the inspection of the packets that is transferred among the
computers (Zhao, Xue and Whinston 2013). When the matching of any filter is not accurate
to the filtering rules set of the packet, then the filter packet either drops packet or then rejects
packet and then generate any notification of the Internet Control Message Protocol or else it
has been access the passage. The packets might be filtered by the destination protocol, port
numbers of the destination, protocol and the source (Siponen, Mahmood and Pahnila 2014).
Task 7: Security policies
The implementation of the security policies is vital for the organisation
Staysure.co.uk. Every person in the organisations is required to apprehend the importance of
role that is being played in the maintenance of the security. Some of the recommended
policies for the organisation are:
Internet usage: the threats of the access to the internet includes the downloading of the
malicious software like the spyware, viruses and Trojans (Safa et al. 2015). The internet
Usage policy addresses the condition where any of the employees are being allowed to
exploit the computers of the company for the personal usage and if the downloading of the
software would be done by anyone other than the administrator.
Social networking/email: The social networking and the email have made their
respective categories of the concerns of security (Budka, Deshpande and Thottan 2014). The
technologies makes it easy for disseminating the information. As the information makes way
out of any building, the retrieving of the information is really difficult. The email policy
addresses that the appropriate content of the email must be shared on the internet. The use of
the private emails is strictly restricted. Only the email function that is provided by the
organisation must be put to use and no use of the social networking sites is allowed in the

15
CYBER BREACH
organisations as the information of the organisation might be released on such social media
sites.
Key control: As the electronic access devices and the mechanical keys might be
duplicated and then exploited without any trail, the organisation has implemented the
measures for tracking the currently holding mechanical keys and the permission for the keys
would be properly maintained by the organisation (Jouini and Rabai 2016). The employees
are provided with a tracking key inside the badges of the employees that can be tracked by
the managers of the organisation for tracking the total movement and the activities of the
employees. This establishes the best security measure to extend the security to higher
standards and prohibit the sharing of any information to any competitors.
Security of the mobile devices: the use of the personal mobile devices in the
organisation is strictly prohibited as these devices could be used for transferring the
information from out the organisation by any malicious insider (Chang and Ramachandran
2016). It has been noticed in the past that the use of mobile devices has been done for
carrying out sensitive information from the organisation to competitors and therefore the use
of the mobile devices is prohibited.
Management of visitors: Any unescorted or unauthorised visitor could be the physical
threat and the stealing of sensitive information of the company can be done by these
individuals (Das et al. 2014). Therefore the policy have been implemented for steering all the
visitors in a controlled point of entry. It has been decided that the visitors must be escorted at
all times and also in several areas. The visitors are required to wear the badges and then sign
in and out are considered.
Agreement of non-disclosure: This policy covers the social media, email, and verbal
communication for preventing the sharing of sensitive information (Ryoo et al. 2014). It is

16
CYBER BREACH
required from the employees to understand and perceive the amount of information that they
might pass on or use.
Conclusion
Therefore, the conclusion can be drawn that the Staysure.co.uk could not protect the
details of the company but with the implementation of advanced security architecture and the
enhanced security policies, the company can prevent these kind of data breaches in the future.
Staysure.co.uk Ltd has the speciality in the financial and insurance services in Europe and
UK. It was designed in 2004 for providing the travel insurance and then expanded further for
providing motor, home, health, and life insurance along with several other insurance
products. In the month of October, 2013 Staysure.co.uk faced a serious security breach
wherein over 100,000 live details of credit card along with the other personal details of
customers were compromised. Using JSPSpy, the attackers were able to remotely view and
then perform the modification on the source code of the website and then query on the
database that contains all the details of customers. The main intention of the risk assessment
and the threat analysis is in maximising the protection of three pillars of security called
Integrity, Accessibility, and Confidentiality while even providing the functionality and
usability. A risk to an organisation or any individual in It has been observed that the
motivation is the major factor that leads to the insider threats. These motivations includes the
stress, greed, espionage and revenge. The motivation of the insider attack could be grouped
into three major categories, which are financial gain, sabotage, and the business gain. It has
been discovered that in the recent times, the major reason for the insider attacks is the
financial, which is the intention of the attacker to sell the data and information of the
organisation that exists in database.

17
CYBER BREACH
References
Ahmed, M. and Hossain, M.A., 2014. Cloud computing and security issues in the cloud. International
Journal of Network Security & Its Applications, 6(1), p.25.
Amin, R., Maitra, T. and Rana, S.P., 2013. An improvement of wang. et. al.’s remote user
authentication scheme against smart card security breach. Int. J. Comput. Appl, 75(13),
pp.37-42.
Arlitsch, K. and Edelman, A., 2014. Staying safe: Cyber security for people and
organizations. Journal of Library Administration, 54(1), pp.46-56.
Arnbak, A., Asghari, H., Van Eeten, M. and Van Eijk, N., 2014. Security collapse in the
HTTPS market. Communications of the ACM, 57(10), pp.47-55.
Black, J., 2013. Developments in data security breach liability. The Business Lawyer, 69(1), pp.199-
207.
Budka, K.C., Deshpande, J.G. and Thottan, M., 2014. Network Security. In Communication
Networks for Smart Grids (pp. 209-225). Springer, London.
Cezar, A., Cavusoglu, H. and Raghunathan, S., 2013. Outsourcing information security:
Contracting issues and security implications. Management Science, 60(3), pp.638-657.
Chang, V. and Ramachandran, M., 2016. Towards achieving data security with the cloud
computing adoption framework. IEEE Trans. Services Computing, 9(1), pp.138-151.
Chou, T.S., 2013. Security threats on cloud computing vulnerabilities. International Journal
of Computer Science & Information Technology, 5(3), p.79.

18
CYBER BREACH
Crossler, R.E., Johnston, A.C., Lowry, P.B., Hu, Q., Warkentin, M. and Baskerville, R.,
2013. Future directions for behavioral information security research. computers &
security, 32, pp.90-101.
Das, S., Kim, T.H.J., Dabbish, L.A. and Hong, J.I., 2014, July. The effect of social influence
on security sensitivity. In Proc. SOUPS (Vol. 14).
Gao, X., Zhong, W. and Mei, S., 2014. A game-theoretic analysis of information sharing and
security investment for complementary firms. Journal of the Operational Research
Society, 65(11), pp.1682-1691.
Gao, X., Zhong, W. and Mei, S., 2015. Security investment and information sharing under an
alternative security breach probability function. Information Systems Frontiers, 17(2), pp.423-438.
Gordon, L.A., Loeb, M.P., Lucyshyn, W. and Zhou, L., 2015. Externalities and the
magnitude of cyber security underinvestment by private sector firms: a modification of the
Gordon-Loeb model. Journal of Information Security, 6(1), p.24.
Hovav, A. and Gray, P., 2014. The Ripple Effect of an Information Security Breach Event: A
Stakeholder Analysis. CAIS, 34, p.50.
http://securityaffairs.co/wordpress/21002/cyber-crime/staysure-hacked.html
http://www.insurancetimes.co.uk/broker-fined-175000-by-information-watchdog-after-cyber-
criminals-raid-customer-records/1411917.article
http://www.itgovernance.co.uk/blog/staysure-fails-to-comply-with-the-pci-dss-and-is-fined-
175000-by-the-ico/
https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2015/02/ico-fines-
insurance-firm-after-hacked-card-details-used-for-fraud/

19
CYBER BREACH
Huang, C.D., Behara, R.S. and Goo, J., 2014. Optimal information security investment in a
Healthcare Information Exchange: An economic analysis. Decision Support Systems, 61,
pp.1-11.
Jouini, M. and Rabai, L.B.A., 2016. A security framework for secure cloud computing
environments. International Journal of Cloud Applications and Computing (IJCAC), 6(3),
pp.32-44.
Lafuente, G., 2015. The big data security challenge. Network security, 2015(1), pp.12-14.
Laube, S. and Böhme, R., 2016. The economics of mandatory security breach reporting to
authorities. Journal of Cybersecurity, 2(1), pp.29-41.
Lee, C.H., Geng, X. and Raghunathan, S., 2013. Contracting information security in the
presence of double moral hazard. Information Systems Research, 24(2), pp.295-311.
Liu, Y., Sarabi, A., Zhang, J., Naghizadeh, P., Karir, M., Bailey, M. and Liu, M., 2015,
August. Cloudy with a Chance of Breach: Forecasting Cyber Security Incidents. In USENIX
Security Symposium (pp. 1009-1024).
Mc Brearty, S., Farrelly, W. and Curran, K., 2016, June. Preserving Data Privacy with
Searchable Symmetric Encryption. In Signals and Systems Conference (ISSC), 2016 27th
Irish (pp. 1-7). IEEE.
Ritter, A., Wright, E., Casey, W. and Mitchell, T., 2015, May. Weakly supervised extraction
of computer security events from twitter. In Proceedings of the 24th International
Conference on World Wide Web (pp. 896-905). International World Wide Web Conferences
Steering Committee.
Romanosky, S., Hoffman, D. and Acquisti, A., 2014. Empirical analysis of data breach
litigation. Journal of Empirical Legal Studies, 11(1), pp.74-104.

20
CYBER BREACH
Ryoo, J., Rizvi, S., Aiken, W. and Kissell, J., 2014. Cloud security auditing: challenges and
emerging approaches. IEEE Security & Privacy, (1), pp.1-1.
Safa, N.S., Sookhak, M., Von Solms, R., Furnell, S., Ghani, N.A. and Herawan, T., 2015.
Information security conscious care behaviour formation in organizations. Computers &
Security, 53, pp.65-78.
Sen, R. and Borle, S., 2015. Estimating the contextual risk of data breach: An empirical
approach. Journal of Management Information Systems, 32(2), pp.314-341.
Serwadda, A. and Phoha, V.V., 2013, November. When kids' toys breach mobile phone
security. In Proceedings of the 2013 ACM SIGSAC conference on Computer &
communications security (pp. 599-610). ACM.
Siponen, M., Mahmood, M.A. and Pahnila, S., 2014. Employees’ adherence to information
security policies: An exploratory field study. Information & management, 51(2), pp.217-224.
Soomro, Z.A., Shah, M.H. and Ahmed, J., 2016. Information security management needs
more holistic approach: A literature review. International Journal of Information
Management, 36(2), pp.215-225.
Van Deursen, N., Buchanan, W.J. and Duff, A., 2013. Monitoring information security risks
within health care. computers & security, 37, pp.31-45.
Wang, D. and Wang, P., 2014. Understanding security failures of two-factor authentication
schemes for real-time applications in hierarchical wireless sensor networks. Ad Hoc
Networks, 20, pp.1-15.
Wang, D., Ma, C.G., Zhang, Q.M. and Zhao, S., 2013. Secure password-based remote user
authentication scheme against smart card security breach. Journal of Networks, 8(1), p.148.

21
CYBER BREACH
Wang, Y., Li, J., Meng, K., Lin, C. and Cheng, X., 2013. Modeling and security analysis of
enterprise network using attack–defense stochastic game Petri nets. Security and
Communication Networks, 6(1), pp.89-99.
Yang, Y.P.O., Shieh, H.M. and Tzeng, G.H., 2013. A VIKOR technique based on
DEMATEL and ANP for information security risk control assessment. Information
Sciences, 232, pp.482-500.
Zhao, X., Xue, L. and Whinston, A.B., 2013. Managing interdependent information security
risks: Cyberinsurance, managed security services, and risk pooling arrangements. Journal of
Management Information Systems, 30(1), pp.123-152.