Stories
Slash Boxes
Comments

SoylentNews is people

posted by Fnord666 on Friday February 16 2018, @11:19AM   Printer-friendly
from the ups-and-downs dept.

Picked this on Bruce Schneier's CRYPTO-GRAM latest issue, under the very terse description of

Interesting research: "Long-term market implications of data breaches, not," by Russell Lange and Eric W. Burger. The market isn't going to fix this. If we want better security, we need to regulate the market.

The "Long term implications..." link is paywalled, but there are two other recent(ish) academic papers linked.

The first one, "Market Implications of Data Breaches" by Russell Lange and Eric W. Burger (21 PDF pages, title page, ToC and references included). The "executive summary/key findings":

  • While the difference in stock price between the sampled breached companies and their peers was negative (-1.13%) in the first three days following announcement of a breach, by the 14th day the return difference had rebounded to +0.05%, and on average remained positive through the period assessed.
  • For the differences in the breached companies' betas and the beta of their peer sets, the differences in the means of 8 months pre-breach versus post-breach was not meaningful at 90, 180, and 360-day post-breach periods.
  • For the differences in the breached companies' beta correlations against the peer indices pre- and post-breach, the difference in the means of the rolling 60-day correlation 8 months pre-breach versus post-breach was not meaningful at 90, 180, and 360-day post-breach periods.
  • In regression analysis, use of the number of accessed records, date, data sensitivity, and malicious versus accidental leak as variables failed to yield an R2 greater than 16.15% for response variables of 3, 14, 60, and 90-day return differential, excess beta differential, and rolling beta correlation differential, indicating
    that the financial impact on breached companies was highly idiosyncratic.
  • Based on returns, the most impacted industries at the 3-day post-breach date were U.S Financial Services, Transportation, and Global Telecom.
    At the 90-day post-breach date, the 3 most impacted industries were U.S. Financial Services, U.S. Healthcare, and Global Telecom.

The second-linked FA, "How does cyber crime affect firms? The effect of information security breaches on stock returns", by Maria Cristina Arcuri, Marina Brogi and Gino
Gandolfi (Parma and Roma Universities):

This paper investigates the impact of information security breaches on stock returns.
Using event-study methodology, we provide empirical evidence on the effect of announcements of cyber attacks on
the market value of firms from 1995 to 2015.
We show that substantial negative market returns occur following announcements of cyber attacks. We find that financial entities often suffer greater negative effects than other companies. We also find that non-confidential cyber attacks are the most dangerous, especially for the financial sector.
Our results seem to show a link between cyber crime and insider trading.

Hang on, what's happening here? The first FA says "No long term effect on stocks", the second says "substantial negative market returns"? Well the second FA looks only on the short term - at most +10 days after the breach; but some of the findings are telling an interesting story. PDF-page-8, in the "Results" section:

The event windows (-5;5) and (-3;3) show mean CARs of -1.26% and -1.19% respectively. This means that significant negative market returns occur on the days prior to and after the announcement of information security breaches. Moreover, the official announcement of a cyber attack is often partly anticipated by a few days: the asymmetric event windows (-10;-1), (-5;-1) and (-3;-1) display a statistical significance at the
90% confidence level or above. Specifically, they show mean CARs of -1.08%, -0.87% and -0.90% respectively.
These results imply that cyber criminals are in fact implicated in insider trading.

Ummm... can we really exclude the scenario in which the upper-management hide the breach for some days to arrange their affairs and then announce the breach? Still insider-trading, but not necessary carried on by the hackers.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 3, Insightful) by Thexalon on Friday February 16 2018, @02:59PM (6 children)

    by Thexalon (636) on Friday February 16 2018, @02:59PM (#638820)

    Those two factors are precisely why when major corporations experience a data breach, they view it entirely as a public relations problem, not a technical problem. And the PR response will invariably make the following statements:
    1. These kinds of things have happened to many other firms before.
    2. Such breaches are essentially inevitable. There was absolutely nothing the firm could have done to prevent it.
    3. Nevertheless, we're making some technical changes that will prevent it. (this directly contradicts the previous point, but consistency is the antithesis of PR)
    4. If you go through a convoluted rigamarole, we'll give you a nice cheap identity theft insurance policy (that's only good for 1 year, and nigh-impossible to actually get, and may not pay out once the media attention has gone away).

    And if they do that well enough, their bottom line is barely affected, and thus their stock price is barely affected. And if you need further proof of that, consider that Equifax is still in business and doing just fine.

    --
    The only thing that stops a bad guy with a compiler is a good guy with a compiler.
    Starting Score:    1  point
    Moderation   +1  
       Insightful=1, Total=1
    Extra 'Insightful' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   3  
  • (Score: 3, Insightful) by krishnoid on Friday February 16 2018, @08:00PM (5 children)

    by krishnoid (1156) on Friday February 16 2018, @08:00PM (#638996)

    If you go through a convoluted rigamarole, we'll give you a nice cheap identity theft insurance policy (that's only good for 1 year, and nigh-impossible to actually get, and may not pay out once the media attention has gone away).

    Identity theft, data breaches, all that stuff might be mumbo-jumbo to people outside the computing field. But talk to them about data breach insurance just like any other type of insurance, and they'll probably understand somewhat better.

    Get it into the CFO's head that better customer data security means a discount on insurance (or insurability in the first place), and get it into the investors' heads that insurance is about risk management, and maybe the idea will pick up speed on its own?

    • (Score: 3, Insightful) by Thexalon on Friday February 16 2018, @08:32PM (4 children)

      by Thexalon (636) on Friday February 16 2018, @08:32PM (#639017)

      Here's the problem: Right now, companies don't actually insure against that risk until it's already happened. It's cheaper to take the risk, go through this PR dance when that risk-taking fails, and as noted in TFA ultimately have no consequences whatsoever for your bottom line or the career of anybody in management (they'll instead fire some junior tech staffer who had no say in any of the decisions that led to the data breach).

      If I were in a position to push legislation to deal with this, I would in fact demand that all companies that store customer data carry insurance against data breaches, for all the reasons you mentioned. The insurance companies would then do what they do best, namely determining risks and pricing them appropriately while offering discounts for reducing that risk.

      --
      The only thing that stops a bad guy with a compiler is a good guy with a compiler.
      • (Score: 2) by krishnoid on Friday February 16 2018, @09:16PM

        by krishnoid (1156) on Friday February 16 2018, @09:16PM (#639043)

        I'm tempted to ask the next credit card/financial/pretty much any company I sign up with, not what their data security practices are (which can be talked around), but whether they have data breach insurance, through who, and what does it pay out to affected users in the event of a breach. Maybe if more people did that, it would lead to regulating these kinds of things and eventually suck all the fun out of the wild wild west of the Internet.

      • (Score: 0) by Anonymous Coward on Friday February 16 2018, @09:27PM (2 children)

        by Anonymous Coward on Friday February 16 2018, @09:27PM (#639051)

        If I were in a position to push legislation to deal with this, I would in fact demand that all companies that store customer data carry insurance against data breaches, for all the reasons you mentioned. The insurance companies would then do what they do best, namely determining risks and pricing them appropriately while offering discounts for reducing that risk.

        What damages would this hypothetical "data breach insurance" cover? Who would be eligible to make claims? How will damages be assessed?

        These data breaches don't cost the company anything worth mentioning. The insurance provider will pay out approximately $0, and premiums will be set accordingly...

        • (Score: 2) by Thexalon on Friday February 16 2018, @10:17PM (1 child)

          by Thexalon (636) on Friday February 16 2018, @10:17PM (#639082)

          What damages would this hypothetical "data breach insurance" cover? Who would be eligible to make claims? How will damages be assessed?

          Who would be eligible to make claims: All people affected by the breach. How would damages be assessed: Presumably, since these folks are offering some kind of identity protection program after these breaches, they've already priced that in.

          Part of the point of doing all this is that by forcing the insurance payment, you create a financial incentive to:
          - Not collect personally identifying customer information at all, or delete old information. Does a big-box store really need to know how frequently somebody identified by zip code and the last 4 digits of their credit card bought paper towels in 2014? Because right now they do know that kind of thing, even though it's completely useless for them to know it.
          - Improve the security of information systems. Right now, techies arguing for this basically can say "Because otherwise there might be a data breach". That's nowhere near as powerful to a business as "For X number of hours from our IT staff, you'll save $Y on insurance every year".

          --
          The only thing that stops a bad guy with a compiler is a good guy with a compiler.
          • (Score: 2) by krishnoid on Saturday February 17 2018, @02:04AM

            by krishnoid (1156) on Saturday February 17 2018, @02:04AM (#639168)

            Does a big-box store really need to know how frequently somebody identified by zip code and the last 4 digits of their credit card bought paper towels in 2014? Because right now they do know that kind of thing, even though it's completely useless for them to know it.

            Target may have your number [businessinsider.com] on this one. In this example, maybe the 2014 data isn't currently relevant, but age everyone forward 4 years, and match buying needs accordingly.