Measuring the Cost of Software Vulnerabilities

Anwar, Afsah and Khormali, Aminollah and Choi, Jinchun and Alasmary, Hisham and Choi, Sung and Salem, Saeed and Nyang, DaeHun and Mohaisen, David (2020) Measuring the Cost of Software Vulnerabilities. EAI Endorsed Transactions on Security and Safety, 7 (23). e1. ISSN 2032-9393

[thumbnail of eai.13-7-2018.164551.pdf]
Available under License Creative Commons Attribution No Derivatives.

Download (2MB) | Preview


Enterprises are increasingly considering security as an added cost, making it necessary for those enterprises to see a tangible incentive in adopting security measures. Despite data breach laws, prior studies have suggested that only 4% of reported data breach incidents have resulted in litigation in federal courts, showing the limited legal ramifications of security breaches and vulnerabilities. In this paper, we study the hidden cost of software vulnerabilities reported in the National Vulnerability Database (NVD) through stock price analysis. We perform a high-fidelity data augmentation to ensure data reliability and to estimate vulnerability disclosure dates as a baseline for estimating the implication of software vulnerabilities. We further build a model for stock price prediction using the nonlinear autoregressive neural network with exogenous factors (NARX) Neural Network model to estimate the effect of vulnerability disclosure on the stock price. Compared to prior work, which relies on linear regression models, our approach is shown to provide better prediction performance. Our analysis also shows that the effect of vulnerabilities on vendors varies, and greatly depends on the specific software industry. Whereas some industries are shown statistically to be affected negatively by the release of software vulnerabilities, even when those vulnerabilities are not broadly covered by the media, some others were not affected at all.

Item Type: Article
Uncontrolled Keywords: Vulnerability Economics, Stock Return Prediction, NVD
Subjects: H Social Sciences > H Social Sciences (General)
Q Science > QA Mathematics > QA75 Electronic computers. Computer science
QA75 Electronic computers. Computer science
Depositing User: EAI Editor IV
Date Deposited: 26 Mar 2021 14:02
Last Modified: 26 Mar 2021 14:02

Actions (login required)

View Item
View Item