Table 4 Factors organized by risky/safe ratings (Study 2)

The hospital recently installed additional emergency electrical generators.

A disaster recovery plan has been implemented.

Machines are not connected to both the private network and the internet.

Results of the audit meet or exceed best practices for network configuration and maintenance.

The recovery effort from a natural disaster is expected to be rapid.

The network is a self-contained, segregated, and air-gapped network.

The IT staff man the network 24/7.

The networks are fully manned with very little employee turnover.

IT staff is highly trained in their area of expertise via outside training firms and local universities.

The chief strategy officer (CSO) has put in place a dedicated controls management team whose job is to make sure that the security controls implemented are the most effective ones possible whether or not they are required for compliance.

The CSO is passionate about security.

The personnel manning facilities are competent.

The IT department is adequately staffed.

IT had a yearly audit due to HIPAA requirements.

All digitized records are stored and processed on a private network.

An audit was recently passed.

The network is in full compliance with the DoD.

The IT staff are fully trained.

85% of these employees have been employees of the company for 15 years or more.

The recent legislation on the reformation of the national health care system

Various adversarial organizations have growing concerns over the lack of medical record privacy because of the legislation.

The type of data the hospital handles

All patient records are digitized.

End users have Windows machines.

It (the network) involves a large hospital.

The hacker’s intent was to motivate another reformation of the national health care system.

The network is within a small geographical region near a war zone.

The network is heterogeneous with Windows, UNIX, and proprietary military operating systems.

The organization has 20 offices worldwide.

The software development firm has 13,000 employees.

Competition is fierce in the business intelligence domain.

Offices are located in North America, South America, Asia, Europe, and Australia.

It took a couple of years to recover from these two incidents.

Clients are from the government military and commercial sectors of 135 countries.

The intranet hosts a database of technical reports, proprietary design information, social collaboration tools, email servers, etc.

A prolonged outage of digital recordkeeping could cause significant damage to the hospital’s ability to serve its patients.

Release of patient care information puts the hospital in legal liability.

Hackers in the past few weeks have been attacking various medical centers nationwide.

These attacks in the past few weeks have leaked private patient care information on the internet.

These adversarial organizations are persistent and academically capable of executing an attack.

Release of patient care information damages the hospital’s reputation.

Release of patient care information violates HIPAA regulations.

The primary adversary has excellent offensive cyber skills equal to or better than 90 existing nation states.

The primary adversary is well funded.

Malicious activity has been noted on the network in the past six months since wartime operations intensified in this region.

The adversary was likely trained by the U.S. government in the past two years.

The adversary is highly motivated.

The adversary is deeply interested in U.S. troop positioning.

The network has Windows systems.

The primary adversary is a nation state.

The network stores highly sensitive data related to enemy versus U.S. troop positioning and high-value target location information.

This network stores and processes time-sensitive intelligence information.

The information stored and processed on this network includes Top Secret SEI 5 Eyes NOFORN information.

This involves a classified military network.

Competitors have sophisticated well-funded espionage teams to steal competitive information.

Almost all employee machines have access to both the internet and intranet.