Information Disclosure and Security Vulnerability Awareness: A Large-Scale Randomized Field Experiment in Pan-Asia

Date
2020-01-07
Authors
Zhuang, Yunhui
Choi, Yunsik
He, Shu
Leung, Alvin Chung-Man
Lee, Gene Moo
Whinston, Andrew
Contributor
Advisor
Department
Instructor
Depositor
Speaker
Researcher
Consultant
Interviewer
Journal Title
Journal ISSN
Volume Title
Publisher
Volume
Number/Issue
Starting Page
Ending Page
Alternative Title
Abstract
This paper investigates how the disclosure of a security vulnerability index based on outgoing spams and phishing website hosting which may serve as an indicator of a firm’s inadequate security controls affects companies’ security protection strategy. Our core objective is to study whether firms improve their security when they become aware of their vulnerabilities and such information is publicized. To achieve this goal, we conduct a randomized field experiment on 1,262 firms in six Pan-Asian countries and regions. Among 631 treatment firms, we alert them of their security vulnerability index and ranking over time, and their relative performance compared to their peers via emails and a public advisory website. Compared with control firms without being informed of their security vulnerability index, treatment firms improve their security over time, with a significant reduction of outgoing spam volume. A marginally significant improvement in reducing phishing hosting websites is also observed among non-web hosting treatment firms. The security improvement may be attributed to firms’ proactive reaction to the public security vulnerability information. Our study provides cybersecurity policy makers with useful insights to motivate firms to adopt better security measures.
Description
Keywords
Strategy, Information, Technology, Economics and Society (SITES), cybersecurity, externality, policy design, spam, phishing, botnet, information security index, organizational security, randomized field experiment
Citation
Extent
10 pages
Format
Geographic Location
Time Period
Related To
Proceedings of the 53rd Hawaii International Conference on System Sciences
Rights
Attribution-NonCommercial-NoDerivatives 4.0 International
Rights Holder
Email libraryada-l@lists.hawaii.edu if you need this content in ADA-compliant format.