LotusDomino.com - The BEST links for IBM Lotus Domino and Notes (Workplace, Websphere Portal, Quickplace, Sametime)

Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation

Telang, Rahul and Wattal, Sunil, "Impact of Software Vulnerability Announcements on the Market Value of Software Vendors - An Empirical Investigation" (February 2005). Available at SSRN:


    Researchers in the area of information security have mainly been concerned with tools, techniques and policies that firms can use to protect themselves against security breaches. However, information security is as much about security software as it is about secure software. Software is not secure when it has defects or flaws which can be exploited by hackers to cause attacks such as unauthorized intrusion or denial of service attacks. Any public announcement makes about a software defect is termed as 'vulnerability disclosure'.

    Although research in software economics have studied firms' incentive to improve overall quality, there have been no studies to show that software vendors have an incentive to invest in building more secure software. In this paper, we use the event study methodology to examine software vendors' incentives to build more secure software. We collect data from leading national newspapers and industry sources like CERT by searching for reports on published software vulnerabilities. We show that vulnerability disclosures lead to a negative and significant change in market value for a software vendor. On average, a vendor loses around 0.6% value in stock price when a vulnerability is reported. This is equivalent to a loss in market capitalization values of $0.86 billion per vulnerability announcement. To provide further insight, we use the information content of the disclosure announcement to classify vulnerabilities into various types. We find that the change in stock price is more negative if the vendor fails to provide a patch at the time of disclosure. Moreover, vulnerabilities which cause a confidentiality related breach cause a greater decline in the market value for a vendor than the vulnerabilities which cause non-confidentiality related breaches. Also, more severe flaws have a significantly greater impact than flaws with low or moderate severity. Finally, we find that the markets do not punish a software vendor more severely if a third party discovers a flaw in its product than if the vendor itself discovers the flaw. Our analysis provides many interesting implications for software vendors as well as policy makers.

Go to article

Click here to see more on this topic.

Previous visitors have searched for information on crm domino lotus, lotus notes database and lotus notes pda. We do collect this information to update our site to your needs.

Lotus Notes is used by more than 100.000 people world wide. Other e-mail clients are: FastTrack Mail , FastTrack Mail and RoundCube Webmail and other personal information manager software are: Hula , MyInfo (Windows) and Kontact .

Products or trademarks named are used for reference, without any implied endorsement by their holders and
without intent to infringe. Disclaimer. Copyright 2005 - feedback hulsman @t h0tmail