determined by several b annual IDC and Gartner surveys) constitutes a good measure of overall investment in information security. In order to ensure that the revenues are only related to information security, and not other IT products and services, we select thirty public information security firms who control more than 50% market share of the information security sector and who offer no other IT products. These firms fall into three main information security market segments, namely content security, identity and access management (IDAM), and network security (the latter includes technologies such as VPN, SSL, and intrusion detection and prevention). For the content security segment, our sample includes Symantec, McAfee and Trend Micro who have traditionally controlled a significant share of the market (for instance, a combined 53.8% of the content security market in 2006 according to Canalys c ). The IDAM market segment includes the most influential players such as Entrust, Internet Security Systems, RSA Security, WatchGuard Technologies, and Secure Computing. For network security, we include companies such as Check Point Software, Network Engines, and SonicWALL. Although some of the firms in the sample, such as RSA, were acquired recently, we are fortunate that our analysis covers the period until their acquisition became effective. The acquiring firms offer other than information security products and services, so including their revenues beyond this point would result in a noisy and inaccurate measure of information security investment. The selected firms are mostly US-based (except for Checkpoint Software) but their customers are worldwide, so the revenues of these firms capture worldwide demand for information security products and services, which is consistent with the boundary-less characteristics of the Internet. Severity of Malicious Attacks. We compile 6,400 instances of malicious attacks, (as is done in 11 ), from the Web site of Symantec, d the leading antivirus b For example, Worldwide Identity and Access Management 2007 2011 Forecast with Submarket Segments c http://www.canalys.com/pr/2007/r2007032.htm d http://www.symantec.com/business/security_response/ threatexplorer/azlisting.jsp Figure 1: Quantifying the Benefits of Information Security Investment service provider, covering the period from January 1998 to December 2006. Their severity levels were rated by subject matter experts, based on three attributes, namely wildness, destructiveness, and distribution. Wildness refers to the extent to which a threat has already spread among computer users; destructiveness is an assessment of the damage that a given infection could cause; and distribution refers to how quickly a malicious entity spreads itself. The estimated severity comes in the form of a linguistic variable that takes values from the set S = {Low, Medium, High}. Many authors 6 have argued that fuzzy logic is ideal for representing and processing such linguistic terms. We represent the linguistic variable using trapezoidal fuzzy numbers for ease of analysis. e Multiple malicious attacks could strike on the same day. Also, since revenues are reported quarterly, we use a fuzzy weighted sum method 1 for aggregating the data on a quarterly basis. The fuzzy sets resulting from the aggregation, which is implemented in Mathematica s Fuzzy Logic Toolbox, f are defuzzified using the centroid method. 1 For a quick cross validation of our compiled severity dataset, we relate the yearly-aggregated time series of the severity of malicious attacks to dollar losses data from the CSI/FBI (http://www.gocsi.com/) reports from 1998 to 2006. These data encompass the types of malicious attacks under study and are based upon surveys conducted by experts in the information security field. We find a correlation of 0.58 (significant beyond the 0.1 level) despite the small sample size of the dataset. e http://www.wolfram.com/products/applications/ fuzzylogic f http://www.wolfram.com/products/applications/ fuzzylogic Analysis and Results Figure 1 summarizes the framework of our empirical research. First, we postulate that investment in information security increases the revenues of information security firms, in turn boosting their present and forecasted fundamentals and positively impacting their stock price. This is indicative that the market performance of the information security sector is demanddriven, consistent with, 5 which shows stock prices have been more sensitive to demand-driven output fluctuations than to supply-driven variations. Second, we hypothesize that when firms acquire protection against malicious attacks, they avoid the potential adverse effects of security breaches on their stock price. Time Series Models for Forecasting We use both time series and vector auto-regression (VAR) analyses to demonstrate the benefits of investing in information security. All quarterly revenues and stock market data from 1998 to 2006 are gathered from the CRSP g database. A summary of the variables used in the analyses follows: 1. Revenues: the sum of the quarterly revenues of the thirty selected information security firms. 2. Market Return: the quarterly NAS- DAQ Composite Index, which is composed of technology stocks, including information security. Previous research has established that NASDAQ is representative of the worldwide technology stock market. For example, Jeon and Jang 7 showed that NASDAQ affects the Korean market at every level of aggregation, and that no significant reverse effect existed. 3. Stock Price: the average of the quarterly stock price of the firms in the sample. g The Center for Research in Security Prices (CRSP) maintains one the most comprehensive collection of financial and economic data. 114 communications of the acm november 2009 vol. 52 no. 11
Figure 2: Plots of the Revenues, Severity, Stock Price, and Market Return Time Series 4. Severity: the quarterly-aggregated severity of malicious attacks. Figure 2, which plots the time series of all four variables, reveals that the revenues of information security firms have followed an increasing trend over the past eight years. Given that the collected revenues represent the majority but not the entirety of the sales of the information security sector, the increasing investment trend bears proof that the information security sector is consolidating. This is expected since, in addition to the existing customers who need to upgrade their products, newer firms are investing to acquire protection. Prior to relating the Revenues, Se verity, and Stock Price time series, using VAR analysis, we ensure the series are stationary and account for seasonality, if any. The Revenues and Severity time series trend upward and do not revolve around a fixed mean over time. Further the autocorrelation functions of both time series decay slowly to zero, with autocorrelations exceeding twice their Table 1: AR Model for Differenced Severity Table 2: AR Model with Seasonal Variation for Differenced Revenues corresponding standard errors past lag. 6 This confirms that the means of both time series are non-stationary. Similarly, an examination of the autocorrelation function of the Stock Price time series reveals high first-order autocorrelation. Following the Box and Jenkins approach, 10 we perform first-order differencing of all three time series to make them stationary. After differencing, the Revenues and Severity time series appear to be highly correlated with a lag effect. The Revenues and Severity time series models serve as benchmarks, with which to compare the fit and accuracy of the VAR model. We use Lag i to denote a shift back by i time periods and Diff i to denote ith order differencing. The differenced Severity time series follows an autoregressive (AR) process, whose estimates are shown in Table 1. The AR model allows forecasting the severity of current malicious attacks from the time series past values. The model corresponds to the lowest Akaike information criterion (AIC) value of 8.81 (AIC is a measure of the goodness of fit of the model 10 ) and a standard error of 78.37. Coefficients are significant beyond the 5% significance level. The differenced Revenues time series appears to exhibit seasonality, which we capture using a set of quarterly dummy variables to account for the seasonal pattern. These variables are Q 1,t, Q 2,t, Q 3,t, where Q i,t, = { 1 when t is an i quarter, 1 i 3. 0 otherwise Table 2 gives the significant coefficients and their estimates. The constant variable in the model represents the change in the revenue level during fourth quarters. Q 1,t, Q 2,t, and Q 3,t, are the amounts that must be added to these fourth quarter predictions to obtain the model s prediction for the first, second, and third quarters respectively. The coefficients in Table 2 are significant beyond the 1% significance level, with a standard error of 185.89 and an AIC value of 10.58. The negative sign on Q 1,t suggests that the incremental revenues in the first quarter is, on average, below the fourth quarter average prediction, consistent with the findings of UBS Research. h Next we use VAR analysis to relate each variable to its own lagged value as well as to the lagged values of the other two variables. Relating Revenues, Severity, and Stock Price using VAR Analysis. The results of the VAR analysis shown in Table 3 are based on the multivariate h Is there a Fourth Quarter IT Anomaly? november 2009 vol. 52 no. 11 communications of the acm 115
model with the smallest AIC of 20.11. Coefficients are significant beyond the 5% significance level and standard errors are mostly lower than those of the corresponding time series models. The differenced revenues and stock prices in the 4 th quarter appear to be higher than what they are in other quarters, as shown in the negative dummy variables of the differenced Revenues. A more interesting finding in Table 3 suggests that investment in information security has been instrumental in reducing the severity of malicious attacks in the short term (lag = 1 quarter; an average incremental reduction of 47.21%). Further, increased revenues translate into higher stock prices (lag = 3 quarters; average incremental increase of 0.61%). We conjecture that this increase in market value is actually an aggregation of prior incremental increases, as it has been shown there is an inherent momentum in the stock market s reactions. The information transfer effect, discussed in prior literature, 3 is also reflected in Table 3 in the form of incremental stock price increases for information security firms (1.79%; lag = 2 quarters). Upon relating the severity of malicious attacks, post-differencing, to the value-weighted NASDAQ return, we find a negative overall correlation (-.52; p- value = 0.03). We conjecture that the increase in the stock price of information security firms, such as the information transfer effect, is overshadowed by the reduction in the market value of firms who were breached. Finally, to complete the validation of the framework in Figure 1, we report that the valueweighted NASDAQ return and the differenced stock prices of information security firms, post-differencing, are highly correlated (0.78; p-value < 0.00), which is expected given that some of the information security firms in the sample are part of NASDAQ. Next, we extend our analyses by investigating how our results differ across the three identified information security segments, namely content security, IDAM, and network security. Table 3: Results of VAR Analysis for Overall Information Security Sector Figure 3: Investment Trends by Market Segment Dissecting Information Security Segments. We repeat our analysis over the samples of firms covering the three market segments identified in the study. The influence of investment on reducing severity is the highest in the content security segment with a 33.23% incremental reduction (lag = 1 quarter; p-value < 0.00), followed by a 23.78% incremental reduction for IDAM (lag = 1 quarter; p-value = 0.03), and a 24.02% incremental reduction for network security, significant only at the 10% level 116 communications of the acm november 2009 vol. 52 no. 11