https://www.sans.org/reading-room/whitepapers/leadership/investing-information-security-case-study-community-banking-37167