Information Disclosure and Security Vulnerability Awareness: A Large-Scale Randomized Field Experiment in Pan-Asia Zhuang, Yunhui Choi, Yunsik He, Shu Leung, Alvin Chung-Man Lee, Gene Moo Whinston, Andrew 2020-01-04T08:26:16Z 2020-01-04T08:26:16Z 2020-01-07
dc.description.abstract This paper investigates how the disclosure of a security vulnerability index based on outgoing spams and phishing website hosting which may serve as an indicator of a firm’s inadequate security controls affects companies’ security protection strategy. Our core objective is to study whether firms improve their security when they become aware of their vulnerabilities and such information is publicized. To achieve this goal, we conduct a randomized field experiment on 1,262 firms in six Pan-Asian countries and regions. Among 631 treatment firms, we alert them of their security vulnerability index and ranking over time, and their relative performance compared to their peers via emails and a public advisory website. Compared with control firms without being informed of their security vulnerability index, treatment firms improve their security over time, with a significant reduction of outgoing spam volume. A marginally significant improvement in reducing phishing hosting websites is also observed among non-web hosting treatment firms. The security improvement may be attributed to firms’ proactive reaction to the public security vulnerability information. Our study provides cybersecurity policy makers with useful insights to motivate firms to adopt better security measures.
dc.format.extent 10 pages
dc.identifier.doi 10.24251/HICSS.2020.739
dc.identifier.isbn 978-0-9981331-3-3
dc.language.iso eng
dc.relation.ispartof Proceedings of the 53rd Hawaii International Conference on System Sciences
dc.rights Attribution-NonCommercial-NoDerivatives 4.0 International
dc.subject Strategy, Information, Technology, Economics and Society (SITES)
dc.subject cybersecurity
dc.subject externality
dc.subject policy design
dc.subject spam
dc.subject phishing
dc.subject botnet
dc.subject information security index
dc.subject organizational security
dc.subject randomized field experiment
dc.title Information Disclosure and Security Vulnerability Awareness: A Large-Scale Randomized Field Experiment in Pan-Asia
dc.type Conference Paper
dc.type.dcmi Text
Original bundle
Now showing 1 - 1 of 1
No Thumbnail Available
478.81 KB
Adobe Portable Document Format