https://cyber.harvard.edu/cybersecurity/api.php?action=feedcontributions&feedformat=atom&user=Intern2 2026-09-06T02:26:37Z User contributions MediaWiki 1.43.6 https://cyber.harvard.edu/cybersecurity/?title=An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods&diff=495 2010-06-04T14:12:20Z

<p>Intern2: </p> <hr /> <div>==Full Title of Reference==<br /> ''An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and Other Public Security Goods''<br /> <br /> ==Full Citation==<br /> <br /> Bruce H. Kobayashi (2006), ''An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and other Public Security Goods.'' Supreme Court Economic Review, Vol. 14. [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=708562 SSRN'']<br /> <br /> [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;keyword=kob&amp;f=wikibiblio.bib#Kobayashi:2006 ''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Economics of Cybersecurity]]<br /> <br /> ==Key Words== <br /> <br /> Cybersecurity, public goods, private goods<br /> <br /> ==Synopsis==<br /> <br /> This paper examines the incentives of private actors to invest in cybersecurity. Prior analyses have examined investments in security goods, such as locks or safes that have the characteristics of private goods. The analysis in this paper extends this analysis to examine expenditures on security goods, such as information, that have the characteristics of public goods. In contrast to the private goods case, where individual uncoordinated security expenditures can lead to an overproduction of security, the public goods case can result in the underproduction of security expenditures, and incentives to free ride. Thus, the formation of collective organizations may be necessary to facilitate the production of public security goods, and the protection of information produced by the collective organization should be a central feature of such organizations. <br /> <br /> ==Additional Notes and Highlights==</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods&diff=494 2010-06-04T14:11:44Z

<p>Intern2: </p> <hr /> <div>==Full Title of Reference==<br /> ''An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and other Public Security Goods''<br /> <br /> ==Full Citation==<br /> <br /> Bruce H. Kobayashi (2006), ''An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and other Public Security Goods.'' Supreme Court Economic Review, Vol. 14. [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=708562 SSRN'']<br /> <br /> [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;keyword=kob&amp;f=wikibiblio.bib#Kobayashi:2006 ''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Economics of Cybersecurity]]<br /> <br /> ==Key Words== <br /> <br /> Cybersecurity, public goods, private goods<br /> <br /> ==Synopsis==<br /> <br /> This paper examines the incentives of private actors to invest in cybersecurity. Prior analyses have examined investments in security goods, such as locks or safes that have the characteristics of private goods. The analysis in this paper extends this analysis to examine expenditures on security goods, such as information, that have the characteristics of public goods. In contrast to the private goods case, where individual uncoordinated security expenditures can lead to an overproduction of security, the public goods case can result in the underproduction of security expenditures, and incentives to free ride. Thus, the formation of collective organizations may be necessary to facilitate the production of public security goods, and the protection of information produced by the collective organization should be a central feature of such organizations. <br /> <br /> ==Additional Notes and Highlights==</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods&diff=493 2010-06-04T14:08:27Z

<p>Intern2: </p> <hr /> <div>==Full Title of Reference==<br /> ''An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and other Public Security Goods''<br /> <br /> ==Full Citation==<br /> <br /> Bruce H. Kobayashi (2006), ''An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and other Public Security Goods.'' Supreme Court Economic Review, Vol. 14. [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=708562 SSRN'']<br /> <br /> [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Kobayashi:2006&amp;f=wikibiblio.bib ''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Economics of Cybersecurity]]<br /> <br /> ==Key Words== <br /> <br /> Cybersecurity, public goods, private goods<br /> <br /> ==Synopsis==<br /> <br /> This paper examines the incentives of private actors to invest in cybersecurity. Prior analyses have examined investments in security goods, such as locks or safes that have the characteristics of private goods. The analysis in this paper extends this analysis to examine expenditures on security goods, such as information, that have the characteristics of public goods. In contrast to the private goods case, where individual uncoordinated security expenditures can lead to an overproduction of security, the public goods case can result in the underproduction of security expenditures, and incentives to free ride. Thus, the formation of collective organizations may be necessary to facilitate the production of public security goods, and the protection of information produced by the collective organization should be a central feature of such organizations. <br /> <br /> ==Additional Notes and Highlights==</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=A_Model_for_When_Disclosure_Helps_Security:_What_Is_Different_About_Computer_and_Network_Security&diff=469 2010-06-03T19:30:20Z

<p>Intern2: New page: ==Full Title of Reference== A Model for When Disclosure Helps Security: What is Different About Computer and Network Security? ==Full Citation== Peter P. Swire, &#039;&#039;A Model for When D...</p> <hr /> <div>==Full Title of Reference==<br /> <br /> A Model for When Disclosure Helps Security: What is Different About Computer and Network Security? <br /> <br /> ==Full Citation==<br /> <br /> Peter P. Swire, ''A Model for When Disclosure Helps Security: What is Different About Computer and Network Security? '' (Journal on Telecommunications and High Technology Law, Vol. 2, Public Law and Legal Theory Working Paper Series No. 17, 2004). [http://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID581001_code69688.pdf?abstractid=531782&amp;mirid=1 ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;startkey=Swire:2004&amp;f=wikibiblio.bib ''BibTeX''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=531782 ''SSRN'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Information Sharing/Disclosure]]<br /> <br /> ==Key Words== <br /> <br /> ''See the article itself for any key words as a starting point''<br /> <br /> ==Synopsis==<br /> <br /> This Article asks the question: When does disclosure actually help security? The discussion begins with a paradox. Most experts in computer and network security are familiar with the slogan that there is no security through obscurity. The Open Source and encryption view is that revealing the details of a system will actually tend to improve security, notably due to peer review. In sharp contrast, a famous World War II slogan says loose lips sink ships. Most experts in the military and intelligence areas believe that secrecy is a critical tool for maintaining security. Both cannot be right - disclosure cannot both help and hurt security.<br /> <br /> Using a law and economics approach to resolve the paradox, Part I provides a model for deciding when either the Open Source or the military/intelligence viewpoints is likely to be correct. Part II explains why many computer and network security problems appear different from the traditional security problems of the physical world. Part III applies the analytic tools developed earlier in the paper to issues including the following: the enlargement of the public domain in a world of search engines; the relationship between disclosure and deterrence; the importance of not disclosing passwords or the combination to a safe.<br /> <br /> ==Additional Notes and Highlights==<br /> <br /> '' * Outline key points of interest</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons:_Open_Source,_Proprietary_Software,_and_Government_Systems&diff=468 2010-06-03T19:29:08Z

<p>Intern2: Undo revision 467 by Intern2 (Talk)</p> <hr /> <div>==Full Title of Reference==<br /> <br /> ==Full Citation==<br /> <br /> Peter P. Swire, ''A Theory of Disclosure for Security and Competitive Reasons: Open Source, Proprietary Software, and Government Systems'' (Hous. L. Rev., Vol. 42, No. 5, Ohio State Public Law Working Paper No. 4, 2006). [http://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID842228_code515373.pdf?abstractid=842228&amp;mirid=1''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;startkey=Swire:2006&amp;f=wikibiblio.bib ''BibTeX''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=842228 ''SSRN'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Information Sharing/Disclosure]]<br /> <br /> ==Key Words== <br /> <br /> ''See the article itself for any key words as a starting point''<br /> <br /> ==Synopsis==<br /> <br /> The paper presents a 2x3 matrix, where disclosure for security and competition are assessed for three types of systems or software: Open Source; proprietary software; and government systems. The paper finds greater convergence on disclosure between Open Source and proprietary software than most commentators have believed. For instance, Open Source security experts use secrecy in stealth firewalls and in other ways. Open Source programmers also often rely on gaps in Open Source licenses to gain competitive advantage by keeping key information secret. Meanwhile, proprietary software often uses more disclosure than assumed. For security, large purchasers and market forces often lead to disclosure about proprietary software. For competitive reasons, proprietary software companies often disclose a great deal when seeking to become a standard in an area or for other reasons.<br /> <br /> ==Additional Notes and Highlights==<br /> <br /> '' * Outline key points of interest</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons:_Open_Source,_Proprietary_Software,_and_Government_Systems&diff=467 2010-06-03T19:28:27Z

<p>Intern2: /* Full Citation */</p> <hr /> <div>==Full Title of Reference==<br /> <br /> ==Full Citation==<br /> <br /> Peter P. Swire, ''A Theory of Disclosure for Security and Competitive Reasons: Open Source, Proprietary Software, and Government Systems'' (Hous. L. Rev., Vol. 42, No. 5, Ohio State Public Law Working Paper No. 4, 2006). [http://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID842228_code515373.pdf?abstractid=842228&amp;mirid=1''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;startkey=Swire:2004&amp;f=wikibiblio.bib ''BibTeX''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=531782 ''SSRN'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Information Sharing/Disclosure]]<br /> <br /> ==Key Words== <br /> <br /> ''See the article itself for any key words as a starting point''<br /> <br /> ==Synopsis==<br /> <br /> The paper presents a 2x3 matrix, where disclosure for security and competition are assessed for three types of systems or software: Open Source; proprietary software; and government systems. The paper finds greater convergence on disclosure between Open Source and proprietary software than most commentators have believed. For instance, Open Source security experts use secrecy in stealth firewalls and in other ways. Open Source programmers also often rely on gaps in Open Source licenses to gain competitive advantage by keeping key information secret. Meanwhile, proprietary software often uses more disclosure than assumed. For security, large purchasers and market forces often lead to disclosure about proprietary software. For competitive reasons, proprietary software companies often disclose a great deal when seeking to become a standard in an area or for other reasons.<br /> <br /> ==Additional Notes and Highlights==<br /> <br /> '' * Outline key points of interest</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=466 2010-06-03T19:23:41Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]<br /> <br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]<br /> <br /> Arora et al. (''2006'') [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure - An Empirical Analysis]]<br /> <br /> Schwartz, Paul and Janger, Edward (''2007'') [[Notification of Data Security Breaches]]<br /> <br /> Granick, Jennifer Stisa (''2005'') [[The Price of Restricting Vulnerability Publications]]<br /> <br /> Romanosky et al. (''2008'') [[Do Data Breach Disclosure Laws Reduce Identity Theft]]<br /> <br /> Lernard, Thomas M. and Rubin, Paul H. ''(2005)'' [[An Economic Analysis of Notification Requirements for Data Security Breaches]]<br /> <br /> Lernard, Thomas M. and Rubin, Paul H. ''(2006)'' [[Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers]]<br /> <br /> Swire, Peter P (''2006'') [[A Theory of Disclosure for Security and Competitive Reasons: Open Source, Proprietary Software, and Government Systems]]<br /> <br /> Swire, Peter P (''2004'') [[A Model for When Disclosure Helps Security: What Is Different About Computer and Network Security]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons:_Open_Source,_Proprietary_Software,_and_Government_Systems&diff=465 2010-06-03T19:22:12Z

<p>Intern2: /* Full Citation */</p> <hr /> <div>==Full Title of Reference==<br /> <br /> ==Full Citation==<br /> <br /> Peter P. Swire, ''A Theory of Disclosure for Security and Competitive Reasons: Open Source, Proprietary Software, and Government Systems'' (Hous. L. Rev., Vol. 42, No. 5, Ohio State Public Law Working Paper No. 4, 2006). [http://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID842228_code515373.pdf?abstractid=842228&amp;mirid=1''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;startkey=Swire:2006&amp;f=wikibiblio.bib ''BibTeX''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=842228 ''SSRN'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Information Sharing/Disclosure]]<br /> <br /> ==Key Words== <br /> <br /> ''See the article itself for any key words as a starting point''<br /> <br /> ==Synopsis==<br /> <br /> The paper presents a 2x3 matrix, where disclosure for security and competition are assessed for three types of systems or software: Open Source; proprietary software; and government systems. The paper finds greater convergence on disclosure between Open Source and proprietary software than most commentators have believed. For instance, Open Source security experts use secrecy in stealth firewalls and in other ways. Open Source programmers also often rely on gaps in Open Source licenses to gain competitive advantage by keeping key information secret. Meanwhile, proprietary software often uses more disclosure than assumed. For security, large purchasers and market forces often lead to disclosure about proprietary software. For competitive reasons, proprietary software companies often disclose a great deal when seeking to become a standard in an area or for other reasons.<br /> <br /> ==Additional Notes and Highlights==<br /> <br /> '' * Outline key points of interest</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons:_Open_Source,_Proprietary_Software,_and_Government_Systems&diff=464 2010-06-03T19:18:08Z

<p>Intern2: /* Full Citation */</p> <hr /> <div>==Full Title of Reference==<br /> <br /> ==Full Citation==<br /> <br /> Peter P. Swire, ''A Theory of Disclosure for Security and Competitive Reasons: Open Source, Proprietary Software, and Government Systems'', Hous. L. Rev., Vol. 42, No. 5, Ohio State Public Law Working Paper No. 4 (2006). [http://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID842228_code515373.pdf?abstractid=842228&amp;mirid=1''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;startkey=Swire:2006&amp;f=wikibiblio.bib ''BibTeX''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=842228 ''SSRN'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Information Sharing/Disclosure]]<br /> <br /> ==Key Words== <br /> <br /> ''See the article itself for any key words as a starting point''<br /> <br /> ==Synopsis==<br /> <br /> The paper presents a 2x3 matrix, where disclosure for security and competition are assessed for three types of systems or software: Open Source; proprietary software; and government systems. The paper finds greater convergence on disclosure between Open Source and proprietary software than most commentators have believed. For instance, Open Source security experts use secrecy in stealth firewalls and in other ways. Open Source programmers also often rely on gaps in Open Source licenses to gain competitive advantage by keeping key information secret. Meanwhile, proprietary software often uses more disclosure than assumed. For security, large purchasers and market forces often lead to disclosure about proprietary software. For competitive reasons, proprietary software companies often disclose a great deal when seeking to become a standard in an area or for other reasons.<br /> <br /> ==Additional Notes and Highlights==<br /> <br /> '' * Outline key points of interest</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons:_Open_Source,_Proprietary_Software,_and_Government_Systems&diff=463 2010-06-03T19:11:26Z

<p>Intern2: New page: ==Full Title of Reference== ==Full Citation== Peter P. Swire, &#039;&#039;A Theory of Disclosure for Security and Competitive Reasons: Open Source, Proprietary Software, and Government Systems&#039;&#039;, ...</p> <hr /> <div>==Full Title of Reference==<br /> <br /> ==Full Citation==<br /> <br /> Peter P. Swire, ''A Theory of Disclosure for Security and Competitive Reasons: Open Source, Proprietary Software, and Government Systems'', Houston Law Review, Vol. 42, No. 5 (2006). [http://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID842228_code515373.pdf?abstractid=842228&amp;mirid=1''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;startkey=Swire:2006&amp;f=wikibiblio.bib ''BibTeX''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=842228 ''SSRN'']<br /> <br /> <br /> ==Categorization==<br /> <br /> Issues: [[Information Sharing/Disclosure]]<br /> <br /> ==Key Words== <br /> <br /> ''See the article itself for any key words as a starting point''<br /> <br /> ==Synopsis==<br /> <br /> The paper presents a 2x3 matrix, where disclosure for security and competition are assessed for three types of systems or software: Open Source; proprietary software; and government systems. The paper finds greater convergence on disclosure between Open Source and proprietary software than most commentators have believed. For instance, Open Source security experts use secrecy in stealth firewalls and in other ways. Open Source programmers also often rely on gaps in Open Source licenses to gain competitive advantage by keeping key information secret. Meanwhile, proprietary software often uses more disclosure than assumed. For security, large purchasers and market forces often lead to disclosure about proprietary software. For competitive reasons, proprietary software companies often disclose a great deal when seeking to become a standard in an area or for other reasons.<br /> <br /> ==Additional Notes and Highlights==<br /> <br /> '' * Outline key points of interest</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=462 2010-06-03T19:07:10Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]<br /> <br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]<br /> <br /> Arora et al. (''2006'') [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure - An Empirical Analysis]]<br /> <br /> Schwartz, Paul and Janger, Edward (''2007'') [[Notification of Data Security Breaches]]<br /> <br /> Granick, Jennifer Stisa (''2005'') [[The Price of Restricting Vulnerability Publications]]<br /> <br /> Romanosky et al. (''2008'') [[Do Data Breach Disclosure Laws Reduce Identity Theft]]<br /> <br /> Lernard, Thomas M. and Rubin, Paul H. ''(2005)'' [[An Economic Analysis of Notification Requirements for Data Security Breaches]]<br /> <br /> Lernard, Thomas M. and Rubin, Paul H. ''(2006)'' [[Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers]]<br /> <br /> Swire, Peter P (''2006'') [[A Theory of Disclosure for Security and Competitive Reasons: Open Source, Proprietary Software, and Government Systems]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Much_Ado_About_Notification:_Does_the_Rush_to_Pass_State-Level_Data_Security_Regulations_Benefit_Consumers&diff=461 2010-06-03T19:06:23Z

<p>Intern2: /* Full Citation */</p> <hr /> <div>==Full Title of Reference==<br /> <br /> Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers?<br /> <br /> ==Full Citation==<br /> <br /> Thomas M. Lenard and Paul H. Rubin, ''Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers?'', Regulation, Vol. 29, No. 1 (2006). [http://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID898208_code614152.pdf?abstractid=898208&amp;mirid=1 ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;startkey=Lenard_Rubin:2006&amp;f=wikibiblio.bib ''BibTeX''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=898208# ''SSRN'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Information Sharing/Disclosure]]<br /> <br /> ==Key Words== <br /> <br /> Data security breaches<br /> <br /> ==Synopsis==<br /> <br /> Data security breaches have received considerable public attention of late, and have prompted several states to mandate that firms whose data may have been compromised to notify their customers of the security breaches. This study finds that the costs of a notification requirement are likely to be substantially higher than the benefits. Even for consumers whose data have been compromised, the probability of being a victim of fraud is so low - only 2 percent - that little action is justified. Overall, we estimate that the expected benefits of mandatory notification are very small - less than $10 per compromised individual. <br /> <br /> ==Additional Notes and Highlights==<br /> <br /> '' * Outline key points of interest</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=460 2010-06-03T19:05:44Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]<br /> <br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]<br /> <br /> Arora et al. (''2006'') [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure - An Empirical Analysis]]<br /> <br /> Schwartz, Paul and Janger, Edward (''2007'') [[Notification of Data Security Breaches]]<br /> <br /> Granick, Jennifer Stisa (''2005'') [[The Price of Restricting Vulnerability Publications]]<br /> <br /> Romanosky et al. (''2008'') [[Do Data Breach Disclosure Laws Reduce Identity Theft]]<br /> <br /> Lernard, Thomas M. and Rubin, Paul H. ''(2005)'' [[An Economic Analysis of Notification Requirements for Data Security Breaches]]<br /> <br /> Lernard, Thomas M. and Rubin, Paul H. ''(2006)'' [[Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers?]]<br /> <br /> Swire, Peter P (''2006'') [[A Theory of Disclosure for Security and Competitive Reasons: Open Source, Proprietary Software, and Government Systems]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=459 2010-06-03T19:05:06Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]<br /> <br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]<br /> <br /> Arora et al. (''2006'') [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure - An Empirical Analysis]]<br /> <br /> Schwartz, Paul and Janger, Edward (''2007'') [[Notification of Data Security Breaches]]<br /> <br /> Granick, Jennifer Stisa (''2005'') [[The Price of Restricting Vulnerability Publications]]<br /> <br /> Romanosky et al. (''2008'') [[Do Data Breach Disclosure Laws Reduce Identity Theft]]<br /> <br /> Lernard, Thomas M. and Rubin, Paul H. ''(2005)'' [[An Economic Analysis of Notification Requirements for Data Security Breaches]]<br /> <br /> Lernard, Thomas M. and Rubin, Paul H. ''(2006)'' [[Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers?]<br /> <br /> Swire, Peter P (''2006'') [[A Theory of Disclosure for Security and Competitive Reasons: Open Source, Proprietary Software, and Government Systems]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Much_Ado_About_Notification:_Does_the_Rush_to_Pass_State-Level_Data_Security_Regulations_Benefit_Consumers&diff=458 2010-06-03T18:55:16Z

<p>Intern2: /* Full Citation */</p> <hr /> <div>==Full Title of Reference==<br /> <br /> Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers?<br /> <br /> ==Full Citation==<br /> <br /> Thomas M. Lenard and Paul H. Rubin, Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers?, Regulation, Vol. 29, No. 1 (2006). [http://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID898208_code614152.pdf?abstractid=898208&amp;mirid=1 ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;startkey=Lenard_Rubin:2006&amp;f=wikibiblio.bib ''BibTeX''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=898208# ''SSRN'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Information Sharing/Disclosure]]<br /> <br /> ==Key Words== <br /> <br /> Data security breaches<br /> <br /> ==Synopsis==<br /> <br /> Data security breaches have received considerable public attention of late, and have prompted several states to mandate that firms whose data may have been compromised to notify their customers of the security breaches. This study finds that the costs of a notification requirement are likely to be substantially higher than the benefits. Even for consumers whose data have been compromised, the probability of being a victim of fraud is so low - only 2 percent - that little action is justified. Overall, we estimate that the expected benefits of mandatory notification are very small - less than $10 per compromised individual. <br /> <br /> ==Additional Notes and Highlights==<br /> <br /> '' * Outline key points of interest</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Much_Ado_About_Notification:_Does_the_Rush_to_Pass_State-Level_Data_Security_Regulations_Benefit_Consumers&diff=457 2010-06-03T18:53:22Z

<p>Intern2: /* Full Citation */</p> <hr /> <div>==Full Title of Reference==<br /> <br /> Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers?<br /> <br /> ==Full Citation==<br /> <br /> Thomas M. Lenard and Paul H. Rubin, Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers?, Regulation, Vol. 29, No. 1 (2006). [http://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID898208_code614152.pdf?abstractid=898208&amp;mirid=1 ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;startkey=Lenard_Rubin:2006&amp;f=wikibiblio.bib ''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Information Sharing/Disclosure]]<br /> <br /> ==Key Words== <br /> <br /> Data security breaches<br /> <br /> ==Synopsis==<br /> <br /> Data security breaches have received considerable public attention of late, and have prompted several states to mandate that firms whose data may have been compromised to notify their customers of the security breaches. This study finds that the costs of a notification requirement are likely to be substantially higher than the benefits. Even for consumers whose data have been compromised, the probability of being a victim of fraud is so low - only 2 percent - that little action is justified. Overall, we estimate that the expected benefits of mandatory notification are very small - less than $10 per compromised individual. <br /> <br /> ==Additional Notes and Highlights==<br /> <br /> '' * Outline key points of interest</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Much_Ado_About_Notification:_Does_the_Rush_to_Pass_State-Level_Data_Security_Regulations_Benefit_Consumers&diff=456 2010-06-03T18:53:04Z

<p>Intern2: New page: ==Full Title of Reference== Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers? ==Full Citation== Thomas M. Lenard and Paul H. Ru...</p> <hr /> <div>==Full Title of Reference==<br /> <br /> Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers?<br /> <br /> ==Full Citation==<br /> <br /> Thomas M. Lenard and Paul H. Rubin, Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers?, Regulation, Vol. 29, No. 1 (2006). [http://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID898208_code614152.pdf?abstractid=898208&amp;mirid=1 ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;startkey=Lenard_Rubin:2006&amp;f=wikibiblio.bib ''BibTeX'']<br /> <br /> <br /> ==Categorization==<br /> <br /> Issues: [[Information Sharing/Disclosure]]<br /> <br /> ==Key Words== <br /> <br /> Data security breaches<br /> <br /> ==Synopsis==<br /> <br /> Data security breaches have received considerable public attention of late, and have prompted several states to mandate that firms whose data may have been compromised to notify their customers of the security breaches. This study finds that the costs of a notification requirement are likely to be substantially higher than the benefits. Even for consumers whose data have been compromised, the probability of being a victim of fraud is so low - only 2 percent - that little action is justified. Overall, we estimate that the expected benefits of mandatory notification are very small - less than $10 per compromised individual. <br /> <br /> ==Additional Notes and Highlights==<br /> <br /> '' * Outline key points of interest</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=455 2010-06-03T18:39:38Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]<br /> <br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]<br /> <br /> Arora et al. (''2006'') [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure - An Empirical Analysis]]<br /> <br /> Schwartz, Paul and Janger, Edward (''2007'') [[Notification of Data Security Breaches]]<br /> <br /> Granick, Jennifer Stisa (''2005'') [[The Price of Restricting Vulnerability Publications]]<br /> <br /> Romanosky et al. (''2008'') [[Do Data Breach Disclosure Laws Reduce Identity Theft]]<br /> <br /> Lernard, Thomas M. and Rubin, Paul H. ''(2005)'' [[An Economic Analysis of Notification Requirements for Data Security Breaches]]<br /> <br /> Lernard, Thomas M. and Rubin, Paul H. ''(2006)'' [[Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers?]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches&diff=448 2010-06-03T16:30:07Z

<p>Intern2: </p> <hr /> <div>==Full Title of Reference==<br /> An Economic Analysis of Notification Requirements for Data Security Breaches<br /> <br /> ==Full Citation==<br /> <br /> Thomas M. Lenard and Paul H. Rubin, ''An Economic Analysis of Notification Requirements for Data Security Breaches'', Progress on Point (July 2005), The Progress &amp; Freedom Foundation. [http://www.pff.org/issues-pubs/pops/pop12.12datasecurity.pdf ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;startkey=Lenard_Rubin:2005&amp;f=wikibiblio.bib ''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Information Sharing/Disclosure]]<br /> <br /> ==Key Words== <br /> <br /> ''See the article itself for any key words as a starting point''<br /> <br /> ==Synopsis==<br /> <br /> ''This could be an abstract from the article.''<br /> <br /> ==Additional Notes and Highlights==<br /> <br /> '' * Outline key points of interest</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches&diff=447 2010-06-03T16:29:33Z

<p>Intern2: /* Full Citation */</p> <hr /> <div>==Full Title of Reference==<br /> An Economic Analysis of Notification Requirements for Data Security Breaches<br /> <br /> ==Full Citation==<br /> <br /> Thomas M. Lenard and Paul H. Rubin, ''An Economic Analysis of Notification Requirements for Data Security Breaches'', Progress on Point (July 2005), The Progress &amp; Freedom Foundation. [http://www.pff.org/issues-pubs/pops/pop12.12datasecurity.pdf ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;startkey=Lenard_Rubin:2005&amp;f=wikibiblio.bib ''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Information sharing/Disclosure]]<br /> <br /> ==Key Words== <br /> <br /> ''See the article itself for any key words as a starting point''<br /> <br /> ==Synopsis==<br /> <br /> ''This could be an abstract from the article.''<br /> <br /> ==Additional Notes and Highlights==<br /> <br /> '' * Outline key points of interest</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches&diff=446 2010-06-03T16:29:03Z

<p>Intern2: New page: ==Full Title of Reference== An Economic Analysis of Notification Requirements for Data Security Breaches ==Full Citation== Thomas M. Lenard and Paul H. Rubin, &#039;&#039;An Economic Analysis of N...</p> <hr /> <div>==Full Title of Reference==<br /> An Economic Analysis of Notification Requirements for Data Security Breaches<br /> <br /> ==Full Citation==<br /> <br /> Thomas M. Lenard and Paul H. Rubin, ''An Economic Analysis of Notification Requirements for Data Security Breaches'', Progress on Point (July 2005), The Progress &amp; Freedom Foundation. [www.pff.org/issues-pubs/pops/pop12.12datasecurity.pdf ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;view=&amp;startkey=Lenard_Rubin:2005&amp;f=wikibiblio.bib ''BibTeX'']<br /> <br /> <br /> ==Categorization==<br /> <br /> Issues: [[Information sharing/Disclosure]]<br /> <br /> ==Key Words== <br /> <br /> ''See the article itself for any key words as a starting point''<br /> <br /> ==Synopsis==<br /> <br /> ''This could be an abstract from the article.''<br /> <br /> ==Additional Notes and Highlights==<br /> <br /> '' * Outline key points of interest</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods&diff=445 2010-06-03T16:26:33Z

<p>Intern2: </p> <hr /> <div>==Full Title of Reference==<br /> ''An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and other Public Security Goods''<br /> <br /> ==Full Citation==<br /> <br /> Bruce H. Kobayashi (2006), ''An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and other Public Security Goods.'' Supreme Court Economic Review, Vol. 14. [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=708562 ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Kobayashi:2006&amp;f=wikibiblio.bib ''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Economics of Cybersecurity]]<br /> <br /> ==Key Words== <br /> <br /> Cybersecurity, public goods, private goods<br /> <br /> ==Synopsis==<br /> <br /> This paper examines the incentives of private actors to invest in cybersecurity. Prior analyses have examined investments in security goods, such as locks or safes that have the characteristics of private goods. The analysis in this paper extends this analysis to examine expenditures on security goods, such as information, that have the characteristics of public goods. In contrast to the private goods case, where individual uncoordinated security expenditures can lead to an overproduction of security, the public goods case can result in the underproduction of security expenditures, and incentives to free ride. Thus, the formation of collective organizations may be necessary to facilitate the production of public security goods, and the protection of information produced by the collective organization should be a central feature of such organizations. <br /> <br /> ==Additional Notes and Highlights==</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods&diff=444 2010-06-03T16:26:02Z

<p>Intern2: New page: ==Full Title of Reference== An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and other Public Security Goods ==Full Citation== Bruce H. Kobayashi (2...</p> <hr /> <div>==Full Title of Reference==<br /> An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and other Public Security Goods<br /> <br /> ==Full Citation==<br /> <br /> Bruce H. Kobayashi (2006), ''An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and other Public Security Goods.'' Supreme Court Economic Review, Vol. 14. [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=708562 ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Kobayashi:2006&amp;f=wikibiblio.bib ''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Economics of Cybersecurity]]<br /> <br /> ==Key Words== <br /> <br /> Cybersecurity, public goods, private goods<br /> <br /> ==Synopsis==<br /> <br /> This paper examines the incentives of private actors to invest in cybersecurity. Prior analyses have examined investments in security goods, such as locks or safes that have the characteristics of private goods. The analysis in this paper extends this analysis to examine expenditures on security goods, such as information, that have the characteristics of public goods. In contrast to the private goods case, where individual uncoordinated security expenditures can lead to an overproduction of security, the public goods case can result in the underproduction of security expenditures, and incentives to free ride. Thus, the formation of collective organizations may be necessary to facilitate the production of public security goods, and the protection of information produced by the collective organization should be a central feature of such organizations. <br /> <br /> ==Additional Notes and Highlights==</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Economics_of_Cybersecurity&diff=443 2010-06-03T16:22:27Z

<p>Intern2: </p> <hr /> <div>Anderson, Ross ''(2001)'' [[Why Information Security is Hard]]<br /> <br /> Anderson, Ross, et. al ''(2008)'' [[Security Economics and the Internal Market]]<br /> <br /> Anderson, Ross and Moore, Tyler ''(2006)'' [[The Economics of Information Security]]<br /> <br /> Camp, L. Jean and Wolfram, Catherine ''(2004)'' [[Pricing Security]]<br /> <br /> Computer Economics, Inc. ''(2007)'' [[2007 Malware Report]] <br /> <br /> Franklin, Jason, et. al ''(2007'') [[An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants]]<br /> <br /> Kobayashi, Bruce H. ''(2006)'' [[An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and Other Public Security Goods]]<br /> <br /> Moore, Tyler, et. al ''(2009)'' [[The Economics of Online Crime]]<br /> <br /> Powell, Benjamin ''(2005)'' [[Is Cybersecurity a Public Good]]<br /> <br /> Thomas, Rob and Martin, Jerry (2006) [[The Underground Economy]]<br /> <br /> van Eeten, Michel J. G. and Bauer, Johannes M. ''(2008)'' [[Economics of Malware: Security Decisions, Incentives and Externalities]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Models_and_Measures_for_Correlation_in_Cyber-Insurance&diff=436 2010-06-03T16:12:40Z

<p>Intern2: New page: ==Full Title of Reference== Models and Measures for Correlation in Cyber-Insurance ==Full Citation== Rainer Bohme, &#039;&#039;Models and Measures for Correlation in Cyber-Insurance&#039;&#039;, Workshop on...</p> <hr /> <div>==Full Title of Reference==<br /> Models and Measures for Correlation in Cyber-Insurance<br /> <br /> ==Full Citation==<br /> <br /> Rainer Bohme, ''Models and Measures for Correlation in Cyber-Insurance'', Workshop on the Economics of Information Security (2006). [http://weis2006.econinfosec.org/docs/16.pdf ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Bohme_Kataria:2006&amp;f=wikibiblio.bib ''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Insurance]] [[Economics of Cyber Security]]<br /> <br /> ==Key Words==<br /> Insurance<br /> <br /> ==Synopsis==<br /> High correlation in failure of information systems due to worms and viruses has been cited as major impediment to cyber-insurance. However, of the many cyber-risk classes that influence failure of information systems, not all exhibit similar correlation properties. In this paper, we introduce a new classification of correlation properties of cyber-risks based on a twin-tier approach. At the first tier, is the correlation of cyber-risks within a firm i.e. correlated failure of multiple systems on its internal network. At second tier, is the correlation in risk at a global level i.e. correlation across independent firms in an insurer’s portfolio. Various classes of cyber-risks exhibit different level of correlation at two tiers, for instance, insider attacks <br /> exhibit high internal but low global correlation. While internal risk correlation within a firm influences its decision to seek insurance, the global correlation influences insurers’ decision in setting the premium. Citing real data we study the combined dynamics of the two-step risk arrival process to determine conditions conducive to the existence of cyber-insurance market. <br /> <br /> ==Additional Notes and Highlights==</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Insurance&diff=433 2010-06-03T16:08:12Z

<p>Intern2: </p> <hr /> <div>Clinton, Larry ''(Undated)'' [[Cyber-Insurance Metrics and Impact on Cyber-Security]]<br /> <br /> Bohme, Rainer ''(2005)'' [[Cyber-Insurance Revisited]]<br /> <br /> Bohme, Rainer and Kataria, Gaurav ''(2006)'' [[Models and Measures for Correlation in Cyber-Insurance]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=432 2010-06-03T16:05:21Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]<br /> <br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]<br /> <br /> Arora et al. (''2006'') [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure - An Empirical Analysis]]<br /> <br /> Schwartz, Paul and Janger, Edward (''2007'') [[Notification of Data Security Breaches]]<br /> <br /> Granick, Jennifer Stisa (''2005'') [[The Price of Restricting Vulnerability Publications]]<br /> <br /> Romanosky et al. (''2008'') [[Do Data Breach Disclosure Laws Reduce Identity Theft]]<br /> <br /> Lernard, Thomas M. and Rubin, Paul H. ''(2005)'' [[An Economic Analysis of Notification Requirements for Data Security Breaches]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft&diff=431 2010-06-03T15:47:57Z

<p>Intern2: </p> <hr /> <div>==Do Data Breach Disclosure Laws Reduce Identity Theft?==<br /> <br /> Sasha Romanosky, Rahul Telang, Alessandro Acquisti, ''Do Data Breach Disclosure Laws Reduce Identity Theft'' (2007). [http://weis2008.econinfosec.org/papers/Romanosky.pdf ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Romanosky_et_al:2008&amp;f=wikibiblio.bib''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Data Breach]]; [[Disclosure Laws]]; [[Identity Theft]]<br /> <br /> ==Key Words== <br /> <br /> [[information security]], [[disclosure laws]], [[disclosure policy]], [[identity theft]], [[security breach notification]]<br /> <br /> ==Synopsis==<br /> <br /> Identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with about 30% of known identity thefts caused by corporate data breaches. Many US states have responded by adopting data breach disclosure laws that require firms to notify consumers if their personal information has been lost or stolen. While the laws are expected to reduce identity theft, their full effects have yet to be empirically measured. We use panel from the US Federal Trade Commission with state and time fixed effects regression to estimate the impact of data breach disclosure laws on identity theft from 2002 to 2007. We find that adoption of data breach disclosure laws have a marginal effect on the incidences of identity thefts and reduce the rate by just under 2%, on average. While this effect is marginal, reducing identity theft is only one means by which these laws can be evaluated: we appreciate that they may have other benefits such as reducing the average victim's losses or improving a firm's security and operational practices. <br /> <br /> ==Additional Notes and Highlights==<br /> <br /> [http://www.networkworld.com/newsletters/sec/2008/072808sec1.html/ Paper review from networkworld.com: &quot;Do data-breach-disclosure laws reduce identity theft? Research attempts to answer the question&quot;]<br /> <br /> [http://www.consumeraffairs.com/news04/2008/06/data_breaches.html/ Paper review from consumeraffairs.com: &quot;Data Breach Disclosure Laws Don't Slow Down Identity Theft; Results of recent legislation called 'statistically insignificant'&quot;]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft&diff=430 2010-06-03T15:47:14Z

<p>Intern2: New page: ==Do Data Breach Disclosure Laws Reduce Identity Theft?== Sasha Romanosky, Rahul Telang, Alessandro Acquisti, &#039;&#039;Do Data Breach Disclosure Laws Reduce Identity Theft&#039;&#039; (2007). [http://wei...</p> <hr /> <div>==Do Data Breach Disclosure Laws Reduce Identity Theft?==<br /> <br /> Sasha Romanosky, Rahul Telang, Alessandro Acquisti, ''Do Data Breach Disclosure Laws Reduce Identity Theft'' (2007). [http://weis2008.econinfosec.org/papers/Romanosky.pdf ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Romanosky_et_al:2008&amp;f=wikibiblio.bib''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Data Breach]]; [[Disclosure Laws]]; [[Identity Theft]]<br /> <br /> ==Key Words== <br /> <br /> [[information security]], [[disclosure laws]], [[disclosure policy]], [[identity theft]], [[security breach notification]]<br /> <br /> ==Synopsis==<br /> <br /> Identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with about 30% of known identity thefts caused by corporate data breaches. Many US states have responded by adopting data breach disclosure laws that require firms to notify consumers if their personal information has been lost or stolen. While the laws are expected to reduce identity theft, their full effects have yet to be empirically measured. We use panel from the US Federal Trade Commission with state and time fixed effects regression to estimate the impact of data breach disclosure laws on identity theft from 2002 to 2007. We find that adoption of data breach disclosure laws have a marginal effect on the incidences of identity thefts and reduce the rate by just under 2%, on average. While this effect is marginal, reducing identity theft is only one means by which these laws can be evaluated: we appreciate that they may have other benefits such as reducing the average victim's losses or improving a firm's security and operational practices. <br /> <br /> ==Additional Notes and Highlights==<br /> <br /> [http://www.networkworld.com/newsletters/sec/2008/072808sec1.html/ from networkworld: &quot;Do data-breach-disclosure laws reduce identity theft? Research attempts to answer the question&quot;]<br /> <br /> [http://www.consumeraffairs.com/news04/2008/06/data_breaches.html/ from consumeraffairs &quot;Data Breach Disclosure Laws Don't Slow Down Identity Theft; Results of recent legislation called 'statistically insignificant'&quot;]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=429 2010-06-03T15:33:34Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]<br /> <br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]<br /> <br /> Arora et al. (''2006'') [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure - An Empirical Analysis]]<br /> <br /> Schwartz, Paul and Janger, Edward (''2007'') [[Notification of Data Security Breaches]]<br /> <br /> Granick, Jennifer Stisa (''2005'') [[The Price of Restricting Vulnerability Publications]]<br /> <br /> Romanosky et al. (''2008'') [[Do Data Breach Disclosure Laws Reduce Identity Theft]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=The_Price_of_Restricting_Vulnerability_Publications&diff=428 2010-06-03T15:25:30Z

<p>Intern2: </p> <hr /> <div>==The Price of Restricting Vulnerability Publications==<br /> <br /> Jennifer Stisa Granick, ''The Price of Restricting Vulnerability Publications'' (2007). [http://www.ijclp.net/files/ijclp_web-doc_10-cy-2004.pdf ''Web''] <br /> [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Granick:2005&amp;f=wikibiblio.bib ''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Disclosure]]; [[Information Sharing]]<br /> <br /> ==Key Words== <br /> <br /> [[information security]], [[vulnerability disclosure]], [[disclosure policy]], [[exploit]], [[code as speech]]<br /> <br /> ==Synopsis==<br /> <br /> There are calls from some quarters to restrict the publication of information about security vulnerabilities in an effort to limit the number of people with the knowledge and ability to attack computer systems. Scientists in other fields have considered similar proposals and rejected them, or adopted only narrow, voluntary restrictions. As in other fields of science, there is a real danger that publication restrictions will inhibit the advancement of the state of the art in computer security. Proponents of disclosure restrictions argue that computer security information is different from other scientific research because it is often expressed in the form of functioning software code. Code has a dual nature, as both speech and tool. While researchers readily understand the information expressed in code, code enables many more people to do harm more readily than with the non-functional information typical of most research publications. Yet, there are strong reasons to reject the argument that code is different, and that restrictions are therefore good policy. Code's functionality may help security as much as it hurts it and the open distribution of functional code has valuable effects for consumers, including the ability to pressure vendors for more secure products and to counteract monopolistic practices. <br /> <br /> ==Additional Notes and Highlights==</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=The_Price_of_Restricting_Vulnerability_Publications&diff=427 2010-06-03T15:25:14Z

<p>Intern2: New page: ==The Price of Restricting Vulnerability Publications== Jennifer Stisa Granick, &#039;&#039;The Price of Restricting Vulnerability Publications&#039;&#039; (2007). [http://www.ijclp.net/files/ijclp_web-doc_...</p> <hr /> <div>==The Price of Restricting Vulnerability Publications==<br /> <br /> Jennifer Stisa Granick, ''The Price of Restricting Vulnerability Publications'' (2007). [http://www.ijclp.net/files/ijclp_web-doc_10-cy-2004.pdf ''Web''] <br /> <br /> [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Granick:2005&amp;f=wikibiblio.bib ''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Disclosure]]; [[Information Sharing]]<br /> <br /> ==Key Words== <br /> <br /> [[information security]], [[vulnerability disclosure]], [[disclosure policy]], [[exploit]], [[code as speech]]<br /> <br /> ==Synopsis==<br /> <br /> There are calls from some quarters to restrict the publication of information about security vulnerabilities in an effort to limit the number of people with the knowledge and ability to attack computer systems. Scientists in other fields have considered similar proposals and rejected them, or adopted only narrow, voluntary restrictions. As in other fields of science, there is a real danger that publication restrictions will inhibit the advancement of the state of the art in computer security. Proponents of disclosure restrictions argue that computer security information is different from other scientific research because it is often expressed in the form of functioning software code. Code has a dual nature, as both speech and tool. While researchers readily understand the information expressed in code, code enables many more people to do harm more readily than with the non-functional information typical of most research publications. Yet, there are strong reasons to reject the argument that code is different, and that restrictions are therefore good policy. Code's functionality may help security as much as it hurts it and the open distribution of functional code has valuable effects for consumers, including the ability to pressure vendors for more secure products and to counteract monopolistic practices. <br /> <br /> ==Additional Notes and Highlights==</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=426 2010-06-03T15:19:28Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]<br /> <br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]<br /> <br /> Arora et al. (''2006'') [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure - An Empirical Analysis]]<br /> <br /> Schwartz, Paul and Janger, Edward (''2007'') [[Notification of Data Security Breaches]]<br /> <br /> Granick, Jennifer Stisa (''2005'') [[The Price of Restricting Vulnerability Publications]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Notification_of_Data_Security_Breaches&diff=425 2010-06-03T15:10:30Z

<p>Intern2: </p> <hr /> <div>==Notification of Data Security Breaches==<br /> <br /> Paul Schwartz and Edward Janger, ''Notification of Data Security Breaches'' (2007). [http://www.michiganlawreview.org/assets/pdfs/105/5/schwartz.pdf ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Schwartz_Janger:2007&amp;keyword=schwartz&amp;f=wikibiblio.bib''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Disclosure]]; [[Data Security]]<br /> <br /> ==Key Words== <br /> <br /> [[information security]], [[disclosure policy]]<br /> <br /> ==Synopsis==<br /> <br /> The law increasingly requires private companies to disclose information for the benefit of consumers. The latest examples of such regulation are state and federal laws that require companies to notify individuals of data security incidents involving their personal information. These laws, proposed in the wake of highly publicized data spills, seek to punish the breached entity and to protect consumers by requiring the entity to notify its customers about the security breach. There are competing approaches, however, to how the law is to mandate release of information about data leaks. This Article finds that the current statutes’ focus on reputational sanction is incomplete. An important function of breach notification is mitigation of harm after a data leak. This function requires a multi-institutional coordinated response of the kind that is absent from current policy proposals. This Article advocates creation of a coordinated response architecture and develops the elements of such an approach. Central to this architecture is a coordinated response agent (CRA) that oversees steps for automatic consumer protection and heightens mitigation. This Article also proposes a bifurcated notice scheme that lets firms know that the CRA is watching and is scrutinizing their decision whether or not to disclose information about a breach to the affected individuals. Moreover, the CRA will set in motion automatic protective measures on behalf of the breached consumers. Finally, the CRA will regulate the content of notification messages to reflect the nature of the data breach. <br /> <br /> ==Additional Notes and Highlights==</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Notification_of_Data_Security_Breaches&diff=424 2010-06-03T15:10:12Z

<p>Intern2: </p> <hr /> <div>==Notification of Data Security Breaches==<br /> <br /> Paul Schwartz and Edward Janger ''Notification of Data Security Breaches'' (2007). [http://www.michiganlawreview.org/assets/pdfs/105/5/schwartz.pdf ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Schwartz_Janger:2007&amp;keyword=schwartz&amp;f=wikibiblio.bib''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Disclosure]]; [[Data Security]]<br /> <br /> ==Key Words== <br /> <br /> [[information security]], [[disclosure policy]]<br /> <br /> ==Synopsis==<br /> <br /> The law increasingly requires private companies to disclose information for the benefit of consumers. The latest examples of such regulation are state and federal laws that require companies to notify individuals of data security incidents involving their personal information. These laws, proposed in the wake of highly publicized data spills, seek to punish the breached entity and to protect consumers by requiring the entity to notify its customers about the security breach. There are competing approaches, however, to how the law is to mandate release of information about data leaks. This Article finds that the current statutes’ focus on reputational sanction is incomplete. An important function of breach notification is mitigation of harm after a data leak. This function requires a multi-institutional coordinated response of the kind that is absent from current policy proposals. This Article advocates creation of a coordinated response architecture and develops the elements of such an approach. Central to this architecture is a coordinated response agent (CRA) that oversees steps for automatic consumer protection and heightens mitigation. This Article also proposes a bifurcated notice scheme that lets firms know that the CRA is watching and is scrutinizing their decision whether or not to disclose information about a breach to the affected individuals. Moreover, the CRA will set in motion automatic protective measures on behalf of the breached consumers. Finally, the CRA will regulate the content of notification messages to reflect the nature of the data breach. <br /> <br /> ==Additional Notes and Highlights==</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Notification_of_Data_Security_Breaches&diff=423 2010-06-03T15:06:34Z

<p>Intern2: New page: http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Schwartz_Janger:2007&amp;keyword=schwartz&amp;f=wikibiblio.bib</p> <hr /> <div>http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Schwartz_Janger:2007&amp;keyword=schwartz&amp;f=wikibiblio.bib</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=422 2010-06-03T15:06:18Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]<br /> <br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]<br /> <br /> Arora et al. (''2006'') [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure - An Empirical Analysis]]<br /> <br /> Schwartz, Paul and Janger, Edward (''2007'') [[Notification of Data Security Breaches]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure_-_An_Empirical_Analysis&diff=421 2010-06-03T14:41:04Z

<p>Intern2: New page: ==Does Information Security Attack Frequency Increase With Vulnerability Disclosure? - An Empirical Analysis== Ashish Arora, Anand Nandkumar, Rahul Telang, &#039;&#039;Does Information Security Att...</p> <hr /> <div>==Does Information Security Attack Frequency Increase With Vulnerability Disclosure? - An Empirical Analysis==<br /> <br /> Ashish Arora, Anand Nandkumar, Rahul Telang, ''Does Information Security Attack Frequency Increase With Vulnerability Disclosure?'' (2007). [http://www.heinz.cmu.edu/~rtelang/vuln_freq_ISF.pdf ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Arora_Nandkumar_Telang:2006&amp;f=wikibiblio.bib''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Disclosure]]; [[Information Sharing]]; [[Information Security]]<br /> <br /> ==Key Words== <br /> <br /> [[information security]], [[software vulnerability]], [[disclosure policy]]<br /> <br /> ==Synopsis==<br /> <br /> Research in information security, risk management and investment has grown in importance over the last few years. However, without reliable estimates on attack probabilities, risk management is difficult to do in practice. Using a novel data set, we provide estimates on attack propensity and how it changes with disclosure and patching of vulnerabilities. Disclosure of software vulnerability has been controversial. On one hand are those who propose full and instant disclosure whether the patch is available or not and on the other hand are those who argue for limited or no disclosure. Which of the two policies is socially optimal depends critically on how attack frequency changes with disclosure and patching. In this paper, we empirically explore the impact of vulnerability information disclosure and availability of patches on attacks targeting the vulnerability. Our results suggest that on an average both secret (non-published) and published (published and not patched) vulnerabilities attract fewer attacks than patched (published and patched) vulnerabilities. When we control for time since publication and patches, we find that patching an already known vulnerability decreases the number of attacks, although attacks gradually increase with time after patch release. Patching an unknown vulnerability, however, causes a spike in attacks, which then gradually decline after patch release. Attacks on secret vulnerabilities slowly increase with time until the vulnerability is published and then attacks rapidly decrease with time after publication.<br /> <br /> ==Additional Notes and Highlights==</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=420 2010-06-03T14:40:53Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]<br /> <br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]<br /> <br /> Arora et al. (''2006'') [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure - An Empirical Analysis]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=419 2010-06-03T14:40:19Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]<br /> <br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]<br /> <br /> Arora et al. (''2006'') [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure. An Empirical Analysis]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure&diff=418 2010-06-03T14:36:34Z

<p>Intern2: </p> <hr /> <div>==Does Information Security Attack Frequency Increase With Vulnerability Disclosure? - An Empirical Analysis==<br /> <br /> Ashish Arora, Anand Nandkumar, Rahul Telang, ''Does Information Security Attack Frequency Increase With Vulnerability Disclosure?'' (2007). [http://www.heinz.cmu.edu/~rtelang/vuln_freq_ISF.pdf ''Web''] [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Arora_Nandkumar_Telang:2006&amp;f=wikibiblio.bib''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Disclosure]]; [[Information Sharing]]; [[Information Security]]<br /> <br /> ==Key Words== <br /> <br /> [[information security]], [[software vulnerability]], [[disclosure policy]]<br /> <br /> ==Synopsis==<br /> <br /> Research in information security, risk management and investment has grown in importance over the last few years. However, without reliable estimates on attack probabilities, risk management is difficult to do in practice. Using a novel data set, we provide estimates on attack propensity and how it changes with disclosure and patching of vulnerabilities. Disclosure of software vulnerability has been controversial. On one hand are those who propose full and instant disclosure whether the patch is available or not and on the other hand are those who argue for limited or no disclosure. Which of the two policies is socially optimal depends critically on how attack frequency changes with disclosure and patching. In this paper, we empirically explore the impact of vulnerability information disclosure and availability of patches on attacks targeting the vulnerability. Our results suggest that on an average both secret (non-published) and published (published and not patched) vulnerabilities attract fewer attacks than patched (published and patched) vulnerabilities. When we control for time since publication and patches, we find that patching an already known vulnerability decreases the number of attacks, although attacks gradually increase with time after patch release. Patching an unknown vulnerability, however, causes a spike in attacks, which then gradually decline after patch release. Attacks on secret vulnerabilities slowly increase with time until the vulnerability is published and then attacks rapidly decrease with time after publication.<br /> <br /> ==Additional Notes and Highlights==</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure&diff=417 2010-06-03T14:32:20Z

<p>Intern2: New page: http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Arora_Nandkumar_Telang:2006&amp;f=wikibiblio.bib</p> <hr /> <div>http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Arora_Nandkumar_Telang:2006&amp;f=wikibiblio.bib</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=416 2010-06-03T14:31:31Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]<br /> <br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]<br /> <br /> Arora et al. (''2006'') [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure? An Empirical Analysis]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors_-_An_Empirical_Investigation&diff=410 2010-06-03T14:13:41Z

<p>Intern2: </p> <hr /> <div>==Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation==<br /> <br /> <br /> Rahul Telang, Sunil Wattal, ''Impact of Software Vulnerability Announcements on the Market Value of Software Vendors'' (2007). [http://infosecon.net/workshop/pdf/telang_wattal.pdf ''Web''] <br /> <br /> [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Telang_Wattal:2007&amp;f=wikibiblio.bib ''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Disclosure]]; [[Information Sharing]]<br /> <br /> ==Key Words== <br /> <br /> [[information security]], [[software vulnerability]], [[quality]], [[disclosure policy]]<br /> <br /> ==Synopsis==<br /> <br /> Researchers in the area of information security have mainly been concerned with tools, techniques and policies that firms can use to protect themselves against security breaches. However, information security is as much about security software as it is about secure software. Software is not secure when it has defects or flaws which can be exploited by hackers to cause attacks such as unauthorized intrusion or denial of service attacks. Any public announcement about a software defect is termed as ‘vulnerability disclosure’. In this paper, we use the event study methodology to examine the role that financial markets play in determining the impact of vulnerability disclosures on software vendors. We collect data from leading national newspapers and industry sources by searching for reports on published software vulnerabilities. Our main result is that vulnerability disclosures do lead to a negative and significant change in market value for a software vendor. On average, a vendor loses around 0.6 % value in stock price when a vulnerability is reported. This is equivalent to a loss in market capitalization values of $0.86 billion per vulnerability announcement. To provide further insight, we use the information content of the disclosure announcement to classify vulnerabilities into various types. This is the first study to measure vendors ’ incentive to develop secure software and also provides many interesting implications for software vendors as well as policy makers.<br /> <br /> ==Additional Notes and Highlights==</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors_-_An_Empirical_Investigation&diff=409 2010-06-03T14:12:35Z

<p>Intern2: New page: ==Impact of Software Vulnerability Announcements on the Market Value of Software Vendors== ==Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Em...</p> <hr /> <div>==Impact of Software Vulnerability Announcements on the Market Value of Software Vendors==<br /> <br /> ==Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation==<br /> <br /> <br /> Rahul Telang, Sunil Wattal, ''Impact of Software Vulnerability Announcements on the Market Value of Software Vendors'' (2007). [http://infosecon.net/workshop/pdf/telang_wattal.pdf ''Web''] <br /> <br /> <br /> [http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&amp;action=viewsource&amp;startkey=Telang_Wattal:2007&amp;f=wikibiblio.bib ''BibTeX'']<br /> <br /> ==Categorization==<br /> <br /> Issues: [[Disclosure]]; [[Information Sharing]]<br /> <br /> ==Key Words== <br /> <br /> [[information security]], [[software vulnerability]], [[quality]], [[disclosure policy]]<br /> <br /> ==Synopsis==<br /> <br /> Researchers in the area of information security have mainly been concerned with tools, techniques and policies that firms can use to protect themselves against security breaches. However, information security is as much about security software as it is about secure software. Software is not secure when it has defects or flaws which can be exploited by hackers to cause attacks such as unauthorized intrusion or denial of service attacks. Any public announcement about a software defect is termed as ‘vulnerability disclosure’. In this paper, we use the event study methodology to examine the role that financial markets play in determining the impact of vulnerability disclosures on software vendors. We collect data from leading national newspapers and industry sources by searching for reports on published software vulnerabilities. Our main result is that vulnerability disclosures do lead to a negative and significant change in market value for a software vendor. On average, a vendor loses around 0.6 % value in stock price when a vulnerability is reported. This is equivalent to a loss in market capitalization values of $0.86 billion per vulnerability announcement. To provide further insight, we use the information content of the disclosure announcement to classify vulnerabilities into various types. This is the first study to measure vendors ’ incentive to develop secure software and also provides many interesting implications for software vendors as well as policy makers.<br /> <br /> ==Additional Notes and Highlights==</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=408 2010-06-03T14:06:39Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]<br /> <br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=407 2010-06-03T14:06:33Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]];<br /> <br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=406 2010-06-03T14:06:23Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]],<br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=405 2010-06-03T14:06:14Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]<br /> Telang, Rahul and Wattal, Sunil (''2007'') [[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation]]</div>

Intern2 https://cyber.harvard.edu/cybersecurity/?title=Information_Sharing/Disclosure&diff=404 2010-06-03T14:05:04Z

<p>Intern2: </p> <hr /> <div>Aviram, Amitai and Tor, Avishalom (''2003'') [[Overcoming Impediments to Information Sharing]]</div>

Intern2