Drivers of information security search behavior: An investigation of network attacks and vulnerability disclosures

ACM Transactions on Management Information Systems

Volumn 1, Issue 1, 2010, Pages

  Wang, Jingguo ^a   Xiao, Nan ^b   Rao, H Raghav ^b  

^a UNIVERSITY OF TEXAS AT ARLINGTON   (United States)

^b UNIVERSITY AT BUFFALO   (United States)

Author keywords

Dynamic regression; Information search behavior; Information security; Information systems; Network attacks; Search engine; Vulnerability disclosures

Indexed keywords

DATA SETS; DYNAMIC REGRESSION MODELS; INFORMATION SEARCH; INFORMATION SEARCH BEHAVIOR; NETWORK ATTACK; SEARCH BEHAVIOR; VULNERABILITY DISCLOSURE;

COMPUTER CRIME; INFORMATION RETRIEVAL; INFORMATION SYSTEMS; REGRESSION ANALYSIS; SEARCH ENGINES; SECURITY OF DATA; STATISTICAL TESTS;

NETWORK SECURITY;

EID: 82255171897     PISSN: 2158656X     EISSN: 21586578     Source Type: Journal    
DOI: 10.1145/1877725.1877728     Document Type: Article

References (64)

1. ANDERSON, C. L. AND AGARWAL, R. 2006. Practicing safe computing: Message framing, self-view, and home computer user security behavior intentions. In Proceedings of the 27th International Conference on Information Systems.
2. ANDERSON, C. L. AND AGARWAL, R. 2010. Practicing safe computing: A multimethod empirical examination of home computer user security behavioral Intentions. MIS Quart. 34, 3, 613-643.
3. ANSCOMBE, F. J. 1960. Rejection of outliers. Technomet. 2, 2, 123-147.
4. ARMSTRONG, H. L. AND FORDE, P. J. 2003. Internet anonymity practices in computer crime. Inform. Manag. Comput. Secur. 11, 5, 209-215.
5. ARORA, A.,KRISHNAN, R.,TELANG, R., AND YANG, Y. 2010. An empirical analysis of software vendors' patch release behavior: Impact of vulnerability disclosure. Inf. Syst. Res. 21, 1, 115-132.
6. ARORA, A., NANDKUMAR, A., AND TELANG, R. 2006. Does information security attack frequency increase with vulnerability disclosure? An empirical analysis. Inf. Syst. Frontiers 8, 5, 350-362. (Pubitemid 46088509)
7. BARRON, F. H. AND BARRETT, B. E. 1996. Decision quality using ranked attribute weights. Manag. Sci. 42, 11, 1515-1523. (Pubitemid 126590218)
8. BATTELLE, J. 2005. The Search. Penguin Books, New York.
9. BOX, G.E. P., JENKINS, G. M., AND REINSEL, G. C. 1994. Time Series Analysis: Forecasting and Control, Prentice Hall, Englewood Cliffs, NJ.
10. BROUWERS, M. C. AND SORRENTINO, R. M. 1993. Uncertainty orientation and protection motivation theory: The role of individual differences in health compliance. J. Person. Social Psych. 65, 1, 102-112.
11. BROWN, S. J. ANDWARNER, J. B. 1985. Using daily stock returns the case of event studies. J. Finan. Econ. 14, 3-31.
12. BROWNE, G. J., PITTS, M. G., AND WETHERBE, J. C. 2007. Cognitive stopping rules for terminating information search in online tasks. MIS Quart. 31, 1, 89-104. (Pubitemid 46382519)
13. CAMPBELL, J. Y., LO, A. W., AND MACKINLAY, A. C. 1996. The Econometrics of Financial Markets, Princeton University Press, Princeton, NJ.
14. CAVUSOGLU, H., CAVUSOGLU, H., AND RAGHUNATHAN, S. 2007. Efficiency of vulnerability disclosure mechanisms to disseminate vulnerability knowledge. IEEE Trans. Softw. Engin. 33, 3, 171-185. (Pubitemid 46443998)
15. CHANTLER, A. N. 1995. Risk: The profile of a computer hacker. Tech. rep., Curtin University, Perth.
16. CHAU, M.,FANG, X., AND SHENG, O.R.L. 2007. What are people searching on government web sites? Comm. ACM 50, 4, 87-92 (Pubitemid 46494533)
17. CHOU, P. H. B. AND WISTER, A. V. 2005. From cues to action: Information seeking and exercise self-care among older adults managing chronic illness. Canad. J. Aging 24, 4, 395-408.
18. COOPER, C. P.,MALLON, K. P., LEADBETTER, S., POLLACK, L. A., AND PEIPINS, L. A. 2005. Cancer Internet search activity on a major search engine, United States 2001-2003. J. Med. Internet Res. 7, 3, e6.
19. DERVIN, B. 1983. An overview of sense-making research: Concepts, methods and results to date. In Proceedings of the International Communications Association Annual Meeting.
20. DICKEY, D. AND FULLER, W. 1979. Distribution of the estimators for autoregressive time series with a unit root. J. Amer. Statist. Assoc. 74, 427-431.
21. DICKEY, D. AND FULLER, W. 1981. Likelihood ratio tests for autoregressive time series with a unit root. Econometr. 49, 4, 1057-1072.
22. DOWLAND, P. S., FURNELLL, S. M., ILLINGWORTH, H. M., AND REYNOLDS, P. L. 1999. Computer crime and abuse: A survey of public attitudes and awareness. Comput. Secur. 18, 8, 715-729.
23. EPPRIGHT, D. R., JOHN F. TANNER, J., AND HUNT, J. B. 1994. Knowledge and the ordered protection motivation model: Tools for preventing AIDS. J. Bus. Res. 30, 1, 13-24.
24. ETTREDGE, M., GERDES, J., AND KARUGA, G. 2005. Using web-based search data to predict macroeconomic statistics. Comm. ACM 48, 11, 87-92 (Pubitemid 43906448)
25. FLOYD, D. L., PRENTICE-DUNN, S., AND ROGERS, R. W. 2000. A meta-analysis of research on protection motivation theory. J. Appl. Soc. Psych. 30, 2, 407-429.
26. FURNELL, S. M., JUSOH, A., AND KATSABAS, D. 2006. The challenges of understanding and using security: A survey of end-users. Comput. Secur. 25, 1, 27-35. (Pubitemid 43227229)
27. GINSBERG, J., MOHEBBI, M. H., PATEL, R.S., BRAMMER, L., SMOLINSKI, M.S., AND BRILLIANT, L. 2008. Detecting influenza epidemics using search engine query data. Nature 457, 19, 1012-1014.
28. GRIFFIN, R. J., DUNWOODY, S., AND NEUWIRTH, K. 1999. Proposed model of the relationship of risk information seeking and processing to the development of preventive behaviors. Environ. Res. 80, 2, S230-S245. (Pubitemid 29143250)
29. HERATH, T. AND RAO, H. R. 2009a. Encouraging information security behaviors in organizations: Role of penalties, pressures and perceived effectiveness. Decis. Support Syst. 47, 2, 154-165.
30. HERATH, T. AND RAO,H. R. 2009b. Protection motivation and deterrence: A framework for security policy compliance in organisations. Euro. J. Inf. Syst. 18, 2, 106-125.
31. HUSSAIN, A., HEIDEMANN, J., AND PAPADOPOULOS, C. 2003. A framework for classifying denial of service attacks. In Proceedings of the Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications. 99-110.
32. JANSEN, B. J. 2007. The comparative effectiveness of sponsored and nonsponsored links for web E-commerce queries. ACM Trans. Web 1, 1, 3-es.
33. KARNOW, C. E. A. 2007. Counterstrike. In Cybercrime: Digital Cops in A Networked Environment, J.M. Balkin, K. Eddan, J. Grimmelmann, N. Kozlovski, S. Wagman and T. Zarsky, Eds. NYU Press, New York.
34. KEPHART, J. O. AND WHITE, S. R. 1993. Measuring and modeling computer virus prevalence. In Proceedings of the IEEE Symposium on Security and Privacy. 2-14.
35. KUMAR, N., MOHAN, K., AND HOLOWCZAK, R. 2008. Locking the door but leaving the computer vulnerable: Factors inhibiting home users' adoption of software firewalls. Decis. Support Syst. 46, 1, 254-264.
36. LI, P. AND RAO, H. R. 2007. An examination of private intermediaries' roles in software vulnerabilities disclosure. Inf. Syst. Frontiers 9, 5, 531-539. (Pubitemid 350007347)
37. LIANG, H., AND XUE, Y. 2009. Avoidance of information technology threats: A theoretical perspective. MIS Quart. 33, 1, 71-90.
38. MANIKOPOULOS, C. AND PAPAVASSILIOU, S. 2002. Network intrusion and fault detection: A statistical anomaly approach. IEEE Comm. Mag. 40, 10, 76-82. (Pubitemid 35311949)
39. MCQUEEN, M. A.,MCQUEEN, T. A., BOYER, W. F., AND CHAFFIN, M. R. 2009. Empirical estimates and observations of 0day vulnerabilities. In Proceedings of the 42nd Hawaii International Conference on System Sciences.
40. MCWILLIAMS, A. AND SIEGEL, D. 1997. Event studies in management research: Theoretical and empirical issues Acad. Manag. J. 40, 3, 626-657.
41. MELL, P., SCARFONE, K., AND ROMANOSKY, S. 2007. A Complete Guide to The Common Vulnerability Scoring System Version 2.0, Forum of Incident Response and Security Teams.
42. MILLER, G. A. 1983. Informavores. In The Study of Information: Iterdisciplinary Messages, F. Machlup and U. Mansfield, Eds. Wiley, New York, 111-113.
43. MOORE, T. AND CLAYTON, R. 2009. Evil searching: Compromise and recompromise of Internet hosts for phishing. In Proceedings of the 13th International Conference on Financial Cryptography and Data Security.
44. NEUWIRTH, K., DUNWOODY, S., AND GRIFFIN, R. J. 2000. Protection motivation and risk communication. Risk Anal. 20, 5, 721-734.
45. NG, B.-Y., KANKANHALLI, A., AND XU, Y. C. 2009. Studying users' computer security behavior: A health belief perspective. Decis. Support Syst. 46, 4, 815-825.
46. PANKRATZ, A. 1991. Forecasting with Dynamic Regression Models. JohnWiley & Sons, New York.
47. PASS, G., CHOWDHURY, A., AND TORGESON, C. 2006. A picture of search. In Proceedings of the the 1st International Conference on Scalable Information Systems (InfoScale '06).
48. PNG, I., WANG, C., AND WANG, Q. 2008. The deterrent and displacement effects of information security enforcement: International evidence. J. Manag. Inf. Syst. 25, 2, 125-144.
49. RADIANTI, J., GONZALEZ, J. J., AND RICH, E. 2009a. A quest for a framework to improve software security: Vulnerability black markets scenario. In Proceedings of the the 27th International Conference of the System Dynamics Society.
50. RADIANTI, J.,RICH, E., AND GONZALEZ, J. J. 2009b. Vulnerability black markets: Empirical evidence and scenario simulation. In Proceedings of the 42nd Hawaii International Conference on System Sciences.
51. RICHARDSON,M. 2008a. Learning about the world through long-term query logs. ACMTrans.Web 2, 4, Article 21.
52. RICHARDSON, R. 2008b. CSI Computer Crime & Security Survey. Computer Security Institute.
53. RIPPETOE, P. A., AND ROGERS, R.W. 1987. Effects of components of protection-motivation theory on adaptive and maladaptive coping with a health threat. J. Person. Social Psych. 52, 3, 596-604.
54. ROGERS, G. O. 1997. The dynamics of risk perception: How does perceived risk respond to risk events? Risk Anal. 17, 6, 745-757. (Pubitemid 28123857)
55. ROGERS, R.W. 1975. A protectionmotivation theory of fear appeals and attitude change. J. Psych. 91, 1, 93-114.
56. ROSE, D. E. AND LEVINSON, D. 2004. Understanding user goals in web search. In Proceedings of the International World Wide Web Conference.
57. SEVERTSON, D. J., BAUMANN, L. C., AND BROWN, R.L. 2006. Applying a health behavior theory to explore the influence of information and experience on arsenic risk representations, policy beliefs, and protective behavior. Risk Anal. 26, 2, 353-368.
58. SMITH, V. K., DESVOUSGES, W. H., AND PAYNE, J. W. 1995. Do risk information programs promote mitigating behavior? J. Risk Uncert. 10, 3, 203-221.
59. SRINIVASAN, N. AND RATCHFORD, B. T. 1991. An empirical test of a model of external search for automobiles. J. Consum. Res. 18, 233-242.
60. TANCER, B. 2008. Click: What Millions of People Are Doing Online and Why It Matters. Hyperion, New York.
61. VENKATSUBRAMANYAN, S. AND KWAN, S. K. 2008. A web search model for strategic decision making. AIMS Int. J. Manag. 2, 3, 197-214.
62. WOON, I. M. Y., TAN, G. W. AND LOW, R. T. 2005. A protection motivation theory approach to home wireless security. In Proceedings of the 25th International Conference on Information Systems.
63. WORKMAN, M., BOMMER, W. H., AND STRAUB, D. 2008. Security lapses and the omission of information security measures: A threat control model and empirical test. Comput. Hum. Behav. 24, 6, 2799-2816.
64. YBARRA, M. L. AND SUMANB, M. 2006. Help seeking behavior and the Internet: A national survey. Int. J. Med. Inf. 75, 1, 29-41. (Pubitemid 43075560)