https://www.sans.org/reading-room/whitepapers/breaches/opm-vs-apt-proper-implementation-key-controls-prevented-disaster-36852