U DERSTA DI G THE IMPACT OF I TER ET SECURITY BREACH O MARKET VALUE: MA AGEME T DETERRE CE POLICIES PERSPECTIVE

Transcription

1 U DERSTA DI G THE IMPACT OF I TER ET SECURITY BREACH O MARKET VALUE: MA AGEME T DETERRE CE POLICIES PERSPECTIVE Francs Kof Andoh-Badoo Unversy of Texas Pan Amercan 1201 W Unversy Drve Ednburg, TX andohbadoof@utpa.edu ABSTRACT Ths study employs the deterrence theory to examne the factors that mpact frm damage assocated wh announcements of Internet secury breaches n the publc meda. Frm damage s measured as the observed cumulatve abnormal returns assocated wh the announcement. The fndngs suggest that nvestors nterpret a secury breach as management s nacton to deter potental computer abusers from volatng organzatonal secury polces and controls. Specfcally, nvestors are more lkely to react negatvely to Internet frms than Non-Internet frms. In addon, nvestors react more negatvely to more recent attacks. Keywords: Internet secury breach, deterrence theory, rsk management, market value, cumulatve abnormal returns, event studes, decson tree nducton, frm damage 1. I TRODUCTIO Internet secury breach has been dentfed as one of the mportant challengng ssues of management practce n the nformaton age. Despe s ncreasng use to provde electronc commerce actves, the nternet s very susceptble to secury vulnerables. Que recently, was reported that over two-thrds of Amercans are serously concerned about cyber crmnals and hackers (McCrohan 2003). Informaton secury has been dentfed as the most crcal factor that nfluences people s ntenton to purchase onlne (Salsbury et al. 2001; Yang et al. 2002). Salsbury et al. (2001) note that buyers are concerned about the lack of protecton of ther nformaton to secury breaches. Buyers mght perceve secury breaches as managements falure to provde effectve mechansms to protect ther nformaton assets held whn the organzaton and or n trans durng electronc commerce transactons from secury breach attacks. The deterrence theory stpulates that managers can deter, prevent, and detect abuse as well as pursue remedes and or punsh offenders for computer abuse (Straub et al. 1998). Thus, lack of effectve management polces could be ced as a reason why a frm would be h wh secury breach. Event studes on nternet secury breaches report that the announcements of nternet secury breaches lead to loss of market value (e.g.,andoh-badoo et al. 2007; Campbell et al. 2003; Cavusoglu et al. 2004a; Gordon et al. 2002; Hovav et al. 2003). However, none of these studes has explored nvestors reacton to management practces that could lead to secury breaches. The purpose of ths study s to use the deterrence theory to nvestgate how nvestors lnk nternet secury breaches to managements secury polces and actons. We use the tradonal event study analyss to measure the market value declne that results from announcements of nternet secury breaches n the publc meda. Frm damage can be operatonalzed as the observed cumulatve abnormal return (CAR) attrbutable to the announcement of Internet secury breach over the event wndow.

2 We use Decson Tree nducton to examne the lkelhood frm type and perod of attack nfluence the damage to the frms arsng from nternet secury breaches. The deterrence theory s used to explan how nvestors nterpret management polces and actons that lead to secury breaches. The rest of the paper s organzed as follows. We frst dscuss the theoretcal foundatons and hypotheses. We then present our research methodology followed by the results and a dscusson of the results. We fnally conclude the paper hghlghtng the manageral mplcatons and lmatons. 2. THEORIES A D HYPOTHESES 2.1. Theoretcal background The deterrence theory (e.g.,straub et al. 1998) forms the theoretcal foundaton for the hypotheses developed and tested to explan the relatonshps between frm damage (observed negatve cumulatve abnormal returns) and frm type and perod of attack. Deterrence Theory and Internet Secury Breaches The deterrence theory poss that the admnstraton of approprate strong dsncentves and sanctons can be used to deter an ndvdual s ntenton to comm antsocal acts Ths theory s extensvely used n crmnology research (Blumsten 1978; Pearson et al. 1985). Straub and others have used the deterrence theory to study nformaton systems secury rsks (Hoffer et al. 1989; Straub 1990; Straub et al. 1992; Straub et al. 1993; Straub et al. 1990; Straub et al. 1998). In general, ths stream of research argues that actons taken by management can deter potental computer abusers from volatng organzatonal secury polces. Gven that a great majory of computer secury breaches are perpetuated by legmate users, wh most of these users beng nternal, the expectaton s that countermeasures taken whn the organzaton can serve as effectve controls aganst breaches. The effectveness of secury countermeasures as deterrence mechansms depends a great deal on user actons and awareness ((D'Arcy et al. 2007). Makng users aware of the exstence of deterrence mechansms can dscourage napproprate behavor because of the ncreased percepton of beng caught and punshed ((D'Arcy et al. 2007). To summarze, the Deterrence theory suggests that frms should be able to develop effectve polces that would deter ntruders from attackng ther networks and systems. Thus, nvestors would nterpret the announcements of nternet secury breaches as lack of effectve actons by management to prevent secury breaches. 2.2 Hypotheses Cumulatve abnormal returns (frm damage) Accordng to the deterrence theory, nvestors beleve that nternet secury breach s a result of management falure to mplement effectve secury polces and controls to deter ntruders. Thus, Internet secury breach s bad news to nvestors and our expectaton s that nvestors wll react negatvely to any announcement that a frm has been breached. We therefore state the frst hypothess as: Hypothess 1: The CAR attrbutable to the announcement of an Internet secury breach s negatve. Frm Type Prevous related studes and the nformaton systems secury lerature suggest that frms that depend heavly on the Internet (referred to as Net frms, such as Amazon.com and ebay) are found to have greater nterest n Internet secury ssues than do other frms (e.g., Cavusoglu et al. 2004a). In the case of Net frms, an ncdent that shuts down the network could result n no sales, whlst a conventonal frm that suffers the same ncdent may generate sales from tradonal markets. The Deterrence theory suggests 2

3 that nvestors would expect that Net frms would have effectve controls and polces that would deter attackers from breachng ther web ses and other nformaton resources. Snce Hence nvestors reacton to nternet secury breach on Net frms would be hgher than for Non-net frms. We hypothesze that: Hypothess 2: All else equal, the lkelhood of negatve CAR attrbutable to announcements of Internet secury breaches by et frms s sgnfcantly hgher than the lkelhood of negatve CAR attrbutable to announcements of Internet secury breaches by on- et frms. Tme Lag In February 2000, several major frms such as Yahoo, E-Bay, Amazon, and E-trade had ther web ses shut down by a Denal of Servce attack. Ths s the tme when major frms were h by the Denal of Servce attack and most frms experenced a secury breach for the frst tme. Snce then several organzatons have developed several proactve countermeasures and secury controls as response to secury threats. Thus, nvestors would react more negatvely to attacks that are more recent than those that occurred pror to February Ths s because they expect that management should have taken major steps to prevent secury ncdents after they have learnt a lot from ther own experences and those of others. Thus, we hypothesze that: Hypothess 3: All else equal, the lkelhood of negatve CAR attrbutable to announcements of Internet secury breaches for Post February 2000 s sgnfcantly hgher than the lkelhood of negatve CAR attrbutable to announcements of nternet secury breaches for Pre February 2000 announcements. 3. RESEARCH METHODOLOGY Our research approach nvolves usng tradonal event study methodology to estmate the CAR assocated wh announcements of nternet secury breaches n the publc meda. We then use decson tree nducton to examne the relatonshp between the ndependent varables (frm characterstcs, attack characterstcs) and CAR. Detals of the methodology are presented n the sectons below. 3.1 Data Collecton We defne an event as an announcement about a frm s Internet secury breach n one of the major newspapers. Usng Lexs-Nexs Academc onlne feature, we nclude n our sample all announcements n the Wall Street Journal, New York Tmes, Fnancal Tmes, Washngton Post, and USA Today for the perod 1997 through The lst of keywords used for searchng events nclude: vrus names (e.g., love bug, sobg, and blaster worm); Attacker Type (e.g., Hacker, Vandal); Results of the attack (e.g., Denal of Servce, Theft of Servce), names of organzatons reported n prevous studes (e.g., Yahoo, ebay), or a term or combnaton of such terms (e.g., nformaton secury breach, computer system secury, Internet secury ncdent, and breach). Only events nvolvng publcly traded frms were consdered n ths study. We recorded 110 events. However, we elmnated some events usng the followng crera: (1) when an event was reported more than once n a sngle or n dfferent newspapers, we kept only the frst announcement; (2) only frms that were lsted on New York Stock Exchange (NYSE), NASDAQ, or Amercan Stock Exchange (AMEX) and had return data n the CRSP database were ncluded for analyss; (3) for frms n the CRSP database, the returns data had to be avalable for 120 days before the event for the computaton of stock market return; and (4) where there were confoundng effects such as earnng announcements, dvdends or any major announcement n the event wndow nvolvng the breached frm that could mpact return, the event was dropped. Our fnal sample sze after the elmnatons was 41. 3

4 3.2 Codng We classfed Frms as Net and Non-Net. We used Internet Stock lstng TM and Morgan Stanley Dean Wter s Internet Company lst to dentfy Net and Non-Net frms (e.g., Cavusoglu et al. 2004b; Im et al. 2001). We use February 2000 as the cutoff date. Ths s the tme when major frms were h by the Denal of Servce attack and most frms experenced secury breaches for the frst tme. We beleve that ths perod would be recognzed as the tme that busnesses and nvestors became more aware of secury breaches. Attack was classfed as Pre February 2000 when they occurred on or before the cutoff date and Post February otherwse. 3.3 Event Study and CAR To compute the abnormal return from the announcement, we frst have to estmate the returns n the absence of the event. The market model developed by Sharpe (1963), whch s used to estmate return, s represented as: where α, R = α + β R + ε R = return of stock on day t; mt β are the ntercept and slope parameters respectvely for frm, and stock on day t. mt R s the return of the market portfolo on day t, ε s the dsturbance term for Accordng to the Effcent Market Hypothess (Fama et al. 1969), f nvestors feel that nternet secury breach causes decreases n future cash flow, the frm wll observe a negatve abnormal return. Ths reflects the market reacton to the announcement whch s quckly absorbed nto the frm s stock. The abnormal return for frm on day t of the event wndow can be estmated as: AR = R ˆ α ˆ + β ( Rmt ) where αˆ and βˆ are the ordnary least square estmates of α and β. These parameters are estmated usng the market model over 120 day perod endng wh the day mmedately precedng the frst day of the event wndow,.e. day (-2). The summaton of the daly abnormal returns over the event wndow s the cumulatve abnormal return. The cumulatve abnormal return for stock over the event wndow ( T 1, T 2) s computed as: CAR ( T1, T 2) t= T1 For a sample of n stocks the cumulatve abnormal return over the event wndow s n CARR ( T1, T 2 ) = 1 = n T 2 = 1 AR CAR ( T1, T 2) 3.4. Decson Tree Inducton A decson tree (DT) s a representaton of a gven decson problem n tree structure where every non-leaf node s assocated wh one of the decson varables, and every branch from a non-leaf node s assocated wh a subset of the values of the correspondng decson varable, and each leaf node s assocated wh a value of the target (or dependent) varable. If the target varable s dscrete then the DT s consdered to be a classfcaton tree and for each node the DT generaton algorhm generates the relatve frequences 4

5 (probables) for the classes of the target varable. At every leaf a class s assgned, wh the wnnng class beng the one that provdes the largest class probably (even f the probably s less than 50%). In ths paper we use classfcaton trees. Decson tree nducton dentfes those varables most sgnfcant n predctng the outcome. The most sgnfcant attrbute s located at the root of the tree and succeedng attrbutes further dscrmnate between the outcomes. The sequence of attrbute values n the decson tree can easly be converted to the rules of an expert system. Several DTs may be generated by varyng the spltng methods (e.g. Entropy, Gn) and/or excludng selected ndependent varables as potental predctors. In ths study, every case at the leaf node s assgned to one possble class, Negatve or Normal. Negatve refers to negatve CAR whle Normal means a CAR value greater or equal to zero. For the gven target event (e.g. CAR s Negatve), the posteror probables for each sblng node are compared. 4. RESULTS In ths secton, we present and dscuss the results for the Internet secury breach sample. Frst, we present the results and dscusson of the cumulatve abnormal return attrbuted to the announcement of Internet secury breach. We also dscuss the results of the DT nducton. 4.1 Event Study and CAR We present the results of the Eventus analyss for the sample of events from the Internet secury breach announcements. Table 1: Cumulatve Abnormal Returns for Internet Secury Breach Sample Cumulatve Average Abnormal Return Medan Cumulatve Abnormal Return Equally Precson Posve: egatve Generalzed Sgn Days Weghted Weghted Z (-1, +1) -3.18% -1.75% -1.45% 14: < * Sgnfcant at.05 ** Sgnfcant at.01 The generalzed sgn test (one tal test) shows that the results are sgnfcant at the 5% level. Thus, Hypothess 1 s confrmed by our data. Whn a three day wndow of secury breach announcements, frms on an average lost 3.18% of ther market value. 4.2 DT Inducton, Frm Type and Perod of Attack We used SAS Enterprse Mner 4.3 tool to generate the Decson Trees. We generated several DTs, usng three spltng methods (.e. Ch-Square, Entropy and Gn). These methods are presented as the sources of the rules generated n Table 3 as DT_C, DT_E, and DT_G respectvely. 5

6 Frm Type Table 2: Sets of Rules that nclude Frm Type as a Dscrmnatng Predctor Source Rules DT_EGa IF Frm Type = NET & Results { THEFT OF SERVICE, CORRUPTION OF INFORMATION } & Attacker { CORPORATE RAIDERS, VANDALS } THEN N = 3 CAR: {POSITIVE: 0.0%; NEGATIVE: 100.0%} IF Frm Type = NON-NET & Results { THEFT OF SERVICE, CORRUPTION OF INFORMATION } & Attacker { CORPORATE RAIDERS, VANDALS } THEN N = 9 CAR: {POSITIVE: 44.4%; NEGATIVE: 55.6%} DT_Gc IF Frm Type = NON-NET & Access = UNAUTHORIZED USE THEN N = 6 CAR: {POSITIVE: 83.3%; NEGATIVE: 16.7%} IF Frm Type = NET & Access = UNAUTHORIZED USE THEN N = 3 CAR: {POSITIVE: 33.3%; NEGATIVE: 66.7%} IF Frm Type = NET & Perod = PRE FEB 2000 & Access = UNAUTHORIZED ACC THEN N = 5 CAR: {POSITIVE: 40.0%; NEGATIVE: 60.0%} IF Frm Type = NON-NET & Perod = PRE FEB 2000 & Access = UNAUTHORIZE ACC THEN N = 3 CAR: {POSITIVE: 66.7%; NEGATIVE: 33.3%} All three rules (See Table 2) for the frm type varable show that the lkelhood of negatve CAR attrbutable to the announcement of an nternet secury breach s hgher for net frms than non-net frms thus provdng support for Hypothess 2. Perod of Attack Table 3: Sets of Rules that nclude Perod (Tme) as a Dscrmnatng Predctor Source Rules DT_C IF Access = UNAUTHORIZED ACC & Perod = PRE FEB 2000 THEN N : 8 CAR: {POSITIVE: 50.0%; NEGATIVE: 50.0%} IF Perod = POST FEB 2000 & Access = UNAUTHORIZED ACC THEN N : 24 CAR: {POSITIVE: 16.7%; NEGATIVE: 83.3%} The par of rules n Table 3 suggests that for attacks nvolvng Unauthorzed Access, those that occurred Pre February 2000 are less lkely to lead to negatve CAR than those that occurred Post February 2000 (50% vs 83%) and therefore the data provdes support for H3. 6

7 5. DISCUSSIO S Generally, the announcement of nternet secury breach n the publc meda leads to negatve CAR, whch s an operatonalzaton of frm damage. The DT analyss provdes evdence to suggest that the frm type and perod of attack are good predctors of the lkelhood of frm damage. In the followng, we explan the fndngs usng the deterrence theory. 5.1 Frm Type Snce Net frms depend solely on the nternet, a secury breach on a frm s web se or nformaton resources could prevent the frm from performng any transactons. The Deterrence theory suggests that nvestors would expect that Net frms would spend consderable effort n mplementng effectve countermeasure polces and controls to prevent secury breaches. Hence, the fndng from the data that Net frms are more lkely to suffer frm damage than Non-Net frms s n agreement wh the expectaton of the deterrence theory. 5.2 Perod of Attack The results suggest that pror to the wdespread knowledge about Internet secury breaches n February 2000, nvestors dd not lnk announcements on Internet secury breaches to market value (Pre February 2000) when the breach was perpetrated by Unauthorzed users,.e. the outsder, much as they do Post February 2000 when many ndvduals and frms became more aware of secury breaches. Secury Managers have become more aware of secury and technques to proactvely actvely deal wh them (D'Arcy et al. 2007). The deterrence theory suggests that managers are expected to use these technques to prevent secury breaches. Ths expectaton explans why we observe that most recent attacks are more lkely to cause damage. 6. MA AGERIAL IMPLICATIO S As organzatons make conscentous efforts to elmnate or reduce Internet secury breaches, would ncrease consumer confdence n e-commerce actves and assure nvestors of frm s commment to secure ther busness systems, whch eventually may enhance busness actves and mprove the stock market performance. As the publc becomes more aware of the nformaton technology ssues, they are better nformed n nterpretng the mplcatons of Internet secury and the mpact Internet secury breaches have on market value of breached frms. Secury managers should mplement effectve polces and controls that would take nto consderaton some of the fndngs such as mnmzng vulnerables as nvestors do not take lghtly when hackers notfy frms about ther systems vulnerables. In addon, Net frms should take extra efforts n avodng secury breach because nvestors expect them to do better than Non-Net frms n protectng nformaton and network resources. 7. CO CLUSIO Prevous relevant studes on secury and frm damage have observed that announcements of nternet secury breaches n the publc meda and further that frm and attack characterstcs nfluence the lkelhood of frm damage. However, there s lack of theoretcal bass for explanng the phenomena. In ths paper, we explored the relatonshps between frm damage and frm characterstcs and attack characterstcs usng the deterrence theory. The paper seeks to contrbute to theory development n Internet secury breaches and frm damage as measured by abnormal returns observed when a secury breach s announced n the publc meda. The fndngs suggest that nvestors nterpret secury breach as management s nacton to deter potental computer abusers from volatng organzatonal secury polces. We examne some of the lmatons of our study n ths secton. One of the problems wh performng an event study on Internet secury breaches s that of sample sze. Whle frms are eager to make publc e- commerce natves, the same s not true for Internet secury breaches. 7

8 Although one may consder the sample sze of 41 used n the current study to be small, s greater than the sze of events that Campbell et al. (2003) and Hovav and D Arcy (2003) used. Nevertheless, a large sample sze would enhance the valdy of the fndngs. 8. REFERE CES Andoh-Badoo, F. K., and Ose-Bryson, K.-M. "Explorng the Characterstcs of Internet Secury Breaches that Impact the Market Value of Breached Frms," Expert Systems wh Applcatons (32:3) 2007, pp Blumsten, A. "Deterrence and Incapacaton: Estmatng the Effects of Crmnal Sanctons on Crme Rate," A. Blumsten, J. Cohen and D. Nagn (eds.), Natonal Academy of Scences, Washngton, DC, Campbell, K., Gordon, L. A., Loeb, M. P., and Zhou, L. "The economc cost of publcly announced nformaton secury breaches: emprcal evdence from the stock market," Journal of Computer Secury (11:3) 2003, pp Cavusoglu, H., Mshra, B., and Raghunathan, S. "The effect of Internet secury breach announcements on market value: capal market reactons for breached frms and Internet secury developers," Internatonal Journal of Electronc Commerce (9:1) 2004a, pp Cavusoglu, H., Mshra, B., and Raghunathan, S. "A model for evaluatng IT secury nvestments," Communcatons of the ACM (47:7) 2004b, pp D'Arcy, J., and Hovav, A. "Deterrng Internal Informaton Systems Msuse," Communcatons of the ACM (50:10) 2007, pp Fama, E. F., Fsher, L., Jensen, M. C., and Roll, R. "The adjustment of stock prces to new nformaton," Internatonal Economc Revew (10:1) 1969, pp Gordon, L. A., and Loeb, M. P. "The economcs of nformaton secury nvestment," ACM transactons on nformaton and system secury (5:4) 2002, pp Hoffer, J. A., and Struab, D. W. "The 9 to 5 Underground: are you polcng computer crmes?," Sloan Management Revew (30:4) 1989, pp Hovav, A., and D'Arcy, J. "The mpact of denal-of-servce announcements on the market value of frms," Rsk Management and Insurance Revew (6:2) 2003, pp Im, K. S., Dow, K. E., and Grover, V. "Research Report: A Reexamnaton of IT nvestment and the market value of the frm - An event study methodology," Informaton Systems Research (12:1) 2001, pp McCrohan, K. F. "Facng the Threats to Electronc Commerce," Journal of Busness and Industral Marketng (18:2) 2003, pp Pearson, F. S., and Wener, N. A. "Toward an Integraton of Crmnologcal Theores," Journal of Crme and Crmnology (76:1) 1985, pp Salsbury, W., Pearson, R., Pearson, A., and Mller, D. "Identfyng Barrers that Keep Shoppers off the World Wde Web: Developng a Scale of Perceved Web Secury," Industral Management and Data Systems (101:4) 2001, pp Sharpe, W. "A smplfed model for portfolo analyss," Management Scence (9) 1963, pp Straub, D. W. "Effectve IS secury," Informaton Systems Research (1:3) 1990, pp

9 Straub, D. W., Carlson, P. J., and Jones, E. H. "Deterrng hghly motvated computer abusers: a feld experment n computer secury: the need for Internatonal cooperaton," G.G. Gable and W.J. Caell (eds.), North-Holland, Amsterdam, 1992, pp Straub, D. W., Carlson, P. J., and Jones, E. H. "Cheatng by student programmers: a feld experment n computer secury," Journal of Management Systems (5:1) 1993, pp Straub, D. W., and Nance, W. D. "Dscoverng and dscplnng computer abuse n organzatons: a feld study," MIS Quarterly (14:1) 1990, pp Straub, D. W., and Welke, R. J. "Copng wh systems rsk: secury plannng models for management decson makng," MIS Quarterly (23:4) 1998, pp Yang, Z., and Jun, M. "Consumer Percepton of e-servce Qualy: From Internet Purchaser and Non-Purchaser Perspectves," Journal of Busness Strateges (19:1) 2002, pp