The success of the attack on Azumer Water shows many instances of improper mitigating controls, user accountability and awareness, as well as not following policy and regulations that could have prevented the deletion of 1,073 volunteer profiles from the database.  The attack started from a simple click of a link that was part of a phishing email scam brought on by the attackers.  John Smith, volunteer coordinator, did not pay attention in reading the phishing email and clicked on the link.  This set the course of events in which many volunteers fell on the attack and led to the attackers gaining entry into the companys database and deleting the entire thing.  
Azumer Waters IT infrastructure does not have a Demilitarized Zone (DMZ) separate from their internal infrastructure. ...