An examination of private intermediaries’ roles in software vulnerabilities disclosure

Abstract

Software vulnerability disclosure has generated much interest and debate. Recently some private intermediaries have entered this market. This paper examines the effects of such private intermediaries on optimal timing of disclosure policy made by public intermediaries and vendors' reactions. Our analysis of private intermediaries' role suggests that public intermediary's optimal disclosure time does not change with private intermediary's participation. However, a vendor's patch time increases when the probability of information leakage is low, if not non-existent. In other words, private intermediaries' service decreases a vendor's willingness to deliver quick patches. Empirical evidence with 1493 vulnerability observations from CERT/ CC and other 326 different vulnerability observations from iDefense provided support for our analytical results.

Competition and patching of security vulnerabilities: An empirical analysis

“…Our research makes a significant contribution to our understanding of vendor's investment in software quality, in particular recent work in the information security literature that has examined vendor patch release behavior (Arora et al, forthcoming;Cavusoglu et al, 2005;Choi et al, 2005;Li and Rao, 2007). To our knowledge our research is the first to demonstrate how increases in disclosure threats from rivals and non-rivals influences investments in information security and software quality.…”

“…Telang and Wattal (2007) use an event study methodology to show that vulnerability disclosure leads to a loss of market value. Li and Rao (2007) empirically examined the role of private intermediaries on the timing of patch release by vendors and found that the presence of private intermediaries decreases vendors' incentive to deliver timely patches. Our research is similar to prior work in that we examine the economic outcomes from vulnerability disclosure.…”

Drivers of information security search behavior: An investigation of network attacks and vulnerability disclosures

“…A vulnerability could either be disclosed immediately with full details after it is discovered, or be disclosed after a certain period of time with limited details to allow the vendors to develop and release the patch [Li and Rao 2007]. Vulnerability disclosures have conflicting effects.…”

Do Data Breach Disclosure Laws Reduce Identity Theft?

“…They find that software vendors wait longer than is socially optimal to release a patch and threat of disclosure can force the vendors the release the patch early. See Li and Rao (2007) for a detailed discussion on vulnerability disclosure policies.…”