The Effect of a Surveillance Banner in an Attacked Computer System

Abstract

Objectives: Test whether the presence of a surveillance message on an attacked computer system influences system trespassers’ active engagement with the compromised system (i.e., entering computer commands). The hypothesized restrictive deterrent effect is tested both in the context of a first system trespassing incident and in the progression of repeated trespassing incidents in an attacked computer system. Methods: We designed a randomized controlled trial and deployed a series of virtual target computers with known vulnerabilities into the computer network of a large public university in the United States. The target computers were set to either display or not display a surveillance banner once system trespassers infiltrated them. Results: We find that the presence of a surveillance banner in the attacked computer systems reduced the probability of commands being typed in the system during longer first system trespassing incidents. Further, we find that the probability of commands being typed during subsequent system trespassing incidents (on the same target computer) is conditioned by the presence of a surveillance banner and by whether commands have been entered during previous trespassing incidents. Conclusions: These findings offer modest support for the application of restrictive deterrence in the study of system trespassing.

Don’t shoot the messenger! A criminological and computer science perspective on coordinated vulnerability disclosure

“…Another option based on situational crime prevention models would be to provide easy access to positive alternatives in the event of identifying a vulnerability to remove offender excuses for not reporting. For example, just as studies that use banners to inform potential system trespassers about the negative consequences of system trespassing (Maimon et al 2014;Testa et al 2017;Wilson et al 2015), clear and eye-catching information about a website's CVD policy could help a person understand there are rules and guidelines to report a vulnerability. Additionally, it would be advisable to keep the threshold for reporting low, to make sure that the potential costs of CVD are as low as possible.…”

Restrictive Deterrence in Drug Offenses: A Systematic Review and Meta-Synthesis of Mixed Studies

“…A growing body of research has highlighted the importance of risk perception in the decision making of offenders (Cherbonneau and Copes, 2006;Beauregard and Bouchard, 2010;Gallupe et al, 2011;Jacobs and Cherbonneau, 2014Maimon et al, 2014;Wilson et al, 2015;Moeller et al, 2016). Perception of risk (subjective risk of punishment) is an extension of actual risk (objective risk of punishment).…”

“…Since Gibbs (1975, p. 33) introduced the concept of restrictive deterrence, it has been substantively explored on samples of drug offenders (Jacobs, 1993(Jacobs, , 1996a. Originally based on research concerning drug offenders, restrictive deterrence was also gradually extended to a broader range of criminals, such as auto thieves, sex workers, sexual offenders, and computer hackers, among others (Jacobs and Miller, 1998;Cherbonneau and Copes, 2006;Beauregard and Bouchard, 2010;Gallupe et al, 2011;Jacobs and Cherbonneau, 2014;Maimon et al, 2014;Wilson et al, 2015).…”

Assessing the Factors Associated With the Detection of Juvenile Hacking Behaviors

“…Various studies have examined opportunity factors and cybercrime offending with varying results. For one, Maimon et al (2014) investigated the influence of a warning banner on the frequency and duration of hacking incidents directed at computer systems online (see also Wilson et al, 2015). The study found that while the use of warning banners did not lead to an immediate discontinuation of the hacking incident, it reduced the duration of each hacking incident.…”