Does Information Security Attack Frequency Increase With Vulnerability Disclosure - An Empirical Analysis: Difference between revisions
mNo edit summary |
No edit summary |
||
| (8 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
== | ==Full Title of Reference== | ||
Ashish Arora, Anand Nandkumar and Rahul Telang, ''Does Information Security Attack Frequency Increase With Vulnerability Disclosure?'', 8 | Does Information Security Attack Frequency Increase With Vulnerability Disclosure? An Empirical Analysis | ||
==Full Citation== | |||
Ashish Arora, Anand Nandkumar and Rahul Telang, ''Does Information Security Attack Frequency Increase With Vulnerability Disclosure? An Empirical Analysis'', 8 Info. Sys. Frontier 5 (2006). | |||
[http://www.heinz.cmu.edu/~rtelang/vuln_freq_ISF.pdf ''Web''] | [http://www.heinz.cmu.edu/~rtelang/vuln_freq_ISF.pdf ''Web''] | ||
[http://cyber.law.harvard.edu/cybersecurity/?title=Special | |||
[http://cyber.law.harvard.edu/cybersecurity/Special:Bibliography?f=wikibiblio.bib&title=Special%3ABibliography&view=detailed&action=&keyword=Arora_Nandkumar_Telang%3A2006 ''BibTeX''] | |||
==Categorization== | ==Categorization== | ||
* Issues: [[Information Sharing/Disclosure]]; | * Issues: [[Information Sharing/Disclosure]]; [[Risk Management and Investment]] | ||
[[Risk Management and Investment]] | |||
==Key Words== | ==Key Words== | ||
[computer emergency response team], | [http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Computer_Emergency_Response_Team computer emergency response team], | ||
[disclosure policy], | [http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy disclosure policy], | ||
[exploit], | [http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Zero-Day_Exploit zero-day exploit], | ||
[honeypot], | [http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Honeypot honeypot], | ||
[patching], | [http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Patching patching], | ||
[software vulnerability] | [http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Software_Vulnerability software vulnerability] | ||
==Synopsis== | ==Synopsis== | ||
| Line 26: | Line 30: | ||
* Focuses on attacker behavior; | * Focuses on attacker behavior; | ||
* Concludes that theoretical frameworks regarding the effect of patching on cybersecurity are inconclusive, and that the impact of disclosure and patching upon the time trends in the number of attacks is an empirical issue; | * Concludes that theoretical frameworks regarding the effect of patching on cybersecurity are inconclusive, and that the impact of disclosure and patching upon the time trends in the number of attacks is an empirical issue; | ||
* Suggests areas for future research. | * Suggests areas for future research (need for new and better data sources). | ||
Latest revision as of 15:18, 23 June 2010
Full Title of Reference
Does Information Security Attack Frequency Increase With Vulnerability Disclosure? An Empirical Analysis
Full Citation
Ashish Arora, Anand Nandkumar and Rahul Telang, Does Information Security Attack Frequency Increase With Vulnerability Disclosure? An Empirical Analysis, 8 Info. Sys. Frontier 5 (2006). Web
Categorization
Key Words
computer emergency response team, disclosure policy, zero-day exploit, honeypot, patching, software vulnerability
Synopsis
Research in information security, risk management and investment has grown in importance over the last few years. However, without reliable estimates on attack probabilities, risk management is difficult to do in practice. Using a novel data set, we provide estimates on attack propensity and how it changes with disclosure and patching of vulnerabilities. Disclosure of software vulnerability has been controversial. On one hand are those who propose full and instant disclosure whether the patch is available or not and on the other hand are those who argue for limited or no disclosure. Which of the two policies is socially optimal depends critically on how attack frequency changes with disclosure and patching. In this paper, we empirically explore the impact of vulnerability information disclosure and availability of patches on attacks targeting the vulnerability. Our results suggest that on an average both secret (non-published) and published (published and not patched) vulnerabilities attract fewer attacks than patched (published and patched) vulnerabilities. When we control for time since publication and patches, we find that patching an already known vulnerability decreases the number of attacks, although attacks gradually increase with time after patch release. Patching an unknown vulnerability, however, causes a spike in attacks, which then gradually decline after patch release. Attacks on secret vulnerabilities slowly increase with time until the vulnerability is published and then attacks rapidly decrease with time after publication.
Additional Notes and Highlights
- Focuses on attacker behavior;
- Concludes that theoretical frameworks regarding the effect of patching on cybersecurity are inconclusive, and that the impact of disclosure and patching upon the time trends in the number of attacks is an empirical issue;
- Suggests areas for future research (need for new and better data sources).
Outline:
1. Introduction 2. Literature 3. An Economic Framework 4. Data 4.1. Extracting attack data 4.2. Vulnerability data 5. Empirical Estimates 5.1. Average effect of patching and publishing: Results from non parametric analysis 5.2. Vulnerability characteristics vs. vulnerability "fixed effects": Regression results 5.3. Impact of elapsed patch and publish months—results of Tobit specification 6. Discussion and conclusion