Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation

Full Title of Reference

Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation

Full Citation

Rahul Telang, Sunil Wattal, Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation, 33 IEEE Transactions on Software Engineering 8 (2007). Web

BibTeX

Categorization

• Issues: Incentives; Information Sharing/Disclosure; Metrics
• Approaches: Regulation/Liability

Key Words

Communications Privacy Law, Computer Emergency Response Team, Disclosure Policy, Hacker, Software Vulnerability, Transparency

Synopsis

Researchers in the area of information security have mainly been concerned with tools, techniques and policies that firms can use to protect themselves against security breaches. However, information security is as much about security software as it is about secure software. Software is not secure when it has defects or flaws which can be exploited by hackers to cause attacks such as unauthorized intrusion or denial of service attacks. Any public announcement about a software defect is termed as ‘vulnerability disclosure’. In this paper, we use the event study methodology to examine the role that financial markets play in determining the impact of vulnerability disclosures on software vendors. We collect data from leading national newspapers and industry sources by searching for reports on published software vulnerabilities. Our main result is that vulnerability disclosures do lead to a negative and significant change in market value for a software vendor. On average, a vendor loses around 0.6 % value in stock price when a vulnerability is reported. This is equivalent to a loss in market capitalization values of $0.86 billion per vulnerability announcement. To provide further insight, we use the information content of the disclosure announcement to classify vulnerabilities into various types. This is the first study to measure vendors ’ incentive to develop secure software and also provides many interesting implications for software vendors as well as policy makers.

Additional Notes and Highlights

Outline:

 1. Introduction
 2. Hypotheses
 3. Data Description & Methodology
   3.1 Vulnerability Disclosure Process
   3.2 Data
   3.3 Methodology 
     The Market Model
     The Market Adjusted Model
     Results
     Market Capitalization
 4. Effect of Vulnerability Characteristics
     Ongoing Research
 5. Conclusions and Discussion
     Comparison with prior event studies
     Implications for Software Quality and Disclosure Policy