The impact of information security breaches: Has there been a downward shift in costs?

Journal of Computer Security

Volumn 19, Issue 1, 2011, Pages 33-56

  Gordon, Lawrence A ^a,b   Loeb, Martin P ^a,b   Zhou, Lei ^a  

^a UNIVERSITY OF MARYLAND   (United States)

^b UNIVERSITY OF MARYLAND   (United States)

Author keywords

cost of information security breaches; Economics of information security

Indexed keywords

CONFLICTING EVIDENCE; DEVASTATING EFFECTS; DISASTER RECOVERY; ECONOMICS OF INFORMATION SECURITY; INFORMATION SECURITY; MARKET MODEL; MEDIA REPORTING; PRIMARY EFFECTS; SECURITY BREACHES; STOCK MARKET; STOCK RETURNS;

COMMERCE; COSTS; ECONOMICS; INDUSTRY;

SECURITY OF DATA;

EID: 79951817096     PISSN: 0926227X     EISSN: None     Source Type: Journal    
DOI: 10.3233/JCS-2009-0398     Document Type: Article

References (41)

1. A. Acquisti, A. Friedman and R. Telang, Is there a cost to privacy breaches? An event study, in: Workshop on the Economics of Information Security, Cambridge, UK, 2006, available at: http://citeseerx.ist.psu.edu/viewdoc/ download?doi=10.1.1.73.2942&rep=rep1&type=pdf.
2. R. Anderson, Why information security is hard - an economic perspective, in: Proceeding of 17th Annual Computer Security Applications Conference (ACSAC), New Orleans, LA, 2001, available at: http://www.cl.cam.ac.uk/ rja14/Papers/econ.pdf.
3. F.K. Andoh-Baidoo and K.M. Osei-Bryson, Exploring the characteristics of Internet security breaches that impact the market value of breached firms, Expert Systems with Applications 32 (2007), 703-725. (Pubitemid 44750609)
4. J.H. Anthony, W. Choi and S. Grabski, Market reaction to e-commerce impairments evidenced by website outages, International Journal of Accounting Information Systems 7 (2006), 60-78. (Pubitemid 44004829)
5. G.A. Benesh and J.A. Clark, The value of indirect investment advice: stock recommendations in Barron's, Journal of Financial and Strategic Decisions 7 (1994), 35-43.
6. A. Brav, C. Geczy and P.A. Gompers, Is the abnormal return following equity issuances anomalous?, Journal of Financial Economics 56 (2000), 209-249.
7. R.A. Brealey and S.C. Myers, Principles of Corporate Finance, MacGraw-Hill, Boston, MA, 2000.
8. S.J. Brown and J.B.Warner, Measuring security price performance, Journal of Financial Economics 8 (1980), 205-258.
9. K. Campbell, L.A. Gordon, M.P. Loeb and L. Zhou, The economic cost of publicly announced information security breaches: empirical evidence from the stock market, Journal of Computer Security 11 (2003), 431-448.
10. M.M. Carhart, On persistence in mutual fund performance, Journal of Finance 52 (1997), 57-82.
11. H. Cavusoglu, B. Mishra and S. Raghunathan, The effect of Internet security breach announcements on market value: capital market reactions for breached firms and Internet security developers, International Journal of Electronic Commerce 9 (2004), 69-104. (Pubitemid 39444049)
12. M.J. Cooper, H. Gulen and P.R. Rau, Changing names with style: mutual fund name changes and their effects on fund flows, Journal of Finance 60 (2005), 2825-2857.
13. T.E. Daniels and E.H. Spafford, Identification of host audit data to detect attacks on low-level IP vulnerabilities, Journal of Computer Security 7 (1999), 3-36.
14. B.L. Dos Santos, G.K. Peffers and D.C. Mauer, The impact of information technology investment announcements on the market value of the firm, Information Systems Research 4 (1993), 1-23.
15. M.L. Ettredge and V.J. Richardson, Information transfer among Internet firms: the case of hacker attacks, Journal of Information Systems 17 (2003), 71-82.
16. E.F. Fama and K.R. French, The cross-section of expected stock returns, Journal of Finance 47 (1992), 427-465.
17. E.F. Fama and K.R. French, Common risk factors in the returns on stocks and bonds, Journal of Financial Economics 33 (1993), 3-56.
18. E.F. Fama and K.R. French, Multifactor explanations of asset pricing anomalies, Journal of Finance 51 (1996), 55-84.
19. A. Garg, J. Curtis and H. Halper, Quantifying the financial impact of IT security breaches, Information Management and Computer Security 11 (2003), 74-83.
20. K. Gatzlaff and K.A. McCullough, The effect of data breaches on shareholder wealth, Working paper, Florida State University, 2008.
21. A. Genusa, Conspiracy of silence, CIO 14 (2001), 92-96.
22. L.A. Gordon and M.P. Loeb, The economics of information security Investment, ACM Transactions on Information and System Security 5 (2002), 438-457.
23. L.A. Gordon, M.P. Loeb, W. Lucyshyn and R. Richardson, CSI/FBI computer crime and security survey, 2006.
24. A. Hovav and J. D'arcy, The impact of denial-of-service attack announcements on the market value of firm, Risk Management and Insurance Review 6 (2003), 97-121.
25. A. Hovav and J. D'arcy, The impact of virus attack announcements on the market value of firms, Information Security Journal: A Global Perspective 13 (2004), 32-40. (Pubitemid 39101930)
26. C. Iheagwara, A. Blyth and M. Singhal, Cost effective management frameworks for intrusion detection systems, Journal of Computer Security 12 (2004), 777-798. (Pubitemid 41652789)
27. M. Ishiguro, H. Tanaka, K. Matsuura and I. Murase, The effect of information security incidents on corporate values in the Japanese stock market, in: Workshop on the Economics of Securing the Information Infrastructure, Arlington, VA, 2006, available at: http://www.mri.co.jp/PUBLICITY/ PAPER/2006/20061023-si304.pdf.
28. A. Kannan, J. Rees and S. Sridhar, Market reactions to information security breach announcements: an empirical analysis, International Journal of Electronic Commerce 12 (2007), 69-91.
29. F. Kerschbaum, E.H. Spafford and D. Zamboni, Embedded sensors and detectors for intrusion detection, Journal of Computer Security 10 (2002), 23-70. (Pubitemid 34531412)
30. S.P. Kothari and J.B. Warner, Econometrics of event studies, in: Handbook in Corporate Finance, B. Espen Eckbo, ed., Empirical Corporate Finance, Vol. 1, North-Holland, Amsterdam, 2007, pp. 3- 36, Chapter 1.
31. B. Krebs, Data breaches up almost 50 percent, affecting records of 35.7 million people, The Washington Post (2009), January 6, D02.
32. A.C. MacKinlay, Event studies in economics and finance, Journal of Economic Literature 35 (1997), 13-39. (Pubitemid 127461268)
33. J.J. McConnell and C.J. Muscarella, Corporate capital expenditure decisions and the market value of the firm, Journal of Financial Economics 13 (1985), 399-422.
34. P. Peng, S. Jajodia and X.S. Wang, Abstraction-based intrusion detection in distributed environments, ACM Transactions on Information and System Security 4 (2001), 407-452.
35. C. Pfleeger and S.L. Pfleeger, Security in Computing, 3rd edn, Pearson Education, Upper Saddle River, NJ, USA, 2007.
36. R. Power, CSI/FBI, computer crime and security survey, Computer Security Issues and Trends 18 (2002), 7-30. (Pubitemid 34725543)
37. R. Richardson, 2008 CSI computer crime and security survey, available at: http://i.cmpnet.com/ v2.gocsi.com/pdf/CSIsurvey2008.pdf.
38. R. Sandhu, V. Bhamidipati and Q. Munawer, The ARBAC97 model for role-based administration of roles, ACM Transactions on Information and System Security 2 (1999), 105-135.
39. J.K. Tanimura and E.W. Wehrly, The market value and reputational effects from lost confidential information, Working paper, San Diego State University and University of Washington, 2008.
40. R. Telang and S. Wattal, Impact of software vulnerability announcements on the market value of software vendors - an empirical investigation, IEEE Transactions on Software Engineering 33 (2007), 544-557. (Pubitemid 47098724)
41. G. Vigna and R.A. Kemmerer, NetSTAT: a network-based intrusion detection system, Journal of Computer Security 7 (1999), 37-71.