Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation

Abstract

Researchers in the area of information security have mainly been concerned with tools, techniques and policies that firms can use to protect themselves against security breaches.However, information security is as much about security software as it is about secure software.Software is not secure when it has defects or flaws which can be exploited by hackers to cause attacks such as unauthorized intrusion or denial of service attacks. Any public announcement about a software defect is termed as 'vulnerability disclosure'.Although research in software economics have studied firms' incentive to improve overall quality, there have been no studies to show that software vendors have an incentive to invest in building more secure software. In this paper, we use the event study methodology to examine the role that financial markets play in determining software vendors' incentives to build more secure software. We collect data from leading national newspapers and industry sources like CERT by searching for reports on published software vulnerabilities. We show that vulnerability disclosures lead to a negative and significant change in market value for a software vendor. On average, a vendor loses around 0.6% value in stock price when a vulnerability is reported. This is equivalent to a loss in market capitalization values of $0.86 billion per vulnerability announcement. To provide further insight, we use the information content of the disclosure announcement to classify vulnerabilities into various types. We find that the change in stock price is more negative if the vendor fails to provide a patch at the time of disclosure. Moreover, vulnerabilities which cause a confidentiality related breach cause a greater decline in the market value for a vendor than the vulnerabilities which cause non-confidentiality related breaches. Also, more severe flaws have a significantly greater impact than flaws with low or moderate severity. Finally, we find that the markets do not punish a software vendor more severely if a third party discovers a flaw in its product than if the vendor itself discovers the flaw. Our analysis provides many interesting implications for software vendors as well as policy makers.

Competition and patching of security vulnerabilities: An empirical analysis

“…Arora et al (2008) use a dataset assembled from CERT/CC's vulnerability notes and SecurityFocus database to show that early disclosure leads to faster patch release times. Telang and Wattal (2007) use an event study methodology to show that vulnerability disclosure leads to a loss of market value. Li and Rao (2007) empirically examined the role of private intermediaries on the timing of patch release by vendors and found that the presence of private intermediaries decreases vendors' incentive to deliver timely patches.…”

The Use of Impression Management Strategies to Manage Stock Market Reactions to IT Failures

“…We contribute to a wide literature on financial market reactions to IT failure (Bharadwaj et al, 2009;Cavusoglu, Mishra, & Raghunathan, 2004;Gordon et al, 2010;Telang & Wattal, 2005). We bring an important innovation to this literature: an actionable solution that managers can pursue.…”

Securing Legacy Code with the TRACER Platform

“…damage to an organization [3]. Whereas a software bug can cause a software artifact to fail, a security bug can allow a malicious user to alter the execution of the entire application for his or her own gain.…”