Risk Management and Insurance Review · 2003 · 246 citations · 38 references
BusinessCybersecurityInsuranceComputer SecurityInformation Security ManagementSecurity PolicyCyber RiskCybersecurity ManagementEnterprise Risk ManagementFinancial RiskInsurance CompaniesSecurity ManagementFinancial Impact AnalysisFinancial Performance ImpactInformation AssetsInformation Security RiskSecurity MispricingSecurity Risk ManagementShareholder Value AnalysisShareholder Value Management
The rise in security breaches and the need to insure information assets has heightened interest in information risk, yet the financial impact of such breaches remains poorly understood. The study examines how announcements of Denial‑of‑Service attacks affect firm market values over a 4.5‑year period. An event‑study methodology was used to analyze market reactions to DOS attack announcements. The market generally does not penalize firms after a DOS attack, but Internet‑specific firms face greater penalties, and large non‑Internet firms may overreact to media hype, allocating resources to a problem with marginal impact on shareholder value.
Abstract The increase in security breaches in the last few years and the need to insure information assets has created an intensified interest in information risk within organizations and for insurance companies. Risk assessment is an important component in the establishment of security policies. However, very little is known of the financial impact and the risk associated with security breaches. This article reports the impact of Denial‐of‐Service (DOS) attack announcements on the market over a period of 4.5 years. The study was conducted using event study methodology. The results show that in general the market does not penalize companies that experience such an attack. However, there is an indication that the market penalizes “Internet‐specific” companies more than other companies. Our results indicate that large companies who are not “Internet‐specific” might be overreacting to the media hype and may be investing resources to prevent a problem that has marginal impact on their shareholder value.
38
Role-based access control models
Ravi Sandhu, Edward J. Coyne, H.L. Feinstein et al. · Computer · 1996 · 5.8K citations
The Adjustment of Stock Prices to New Information
Eugene F. Fama, Lawrence Fisher, Michael C. Jensen et al. · International Economic Review · 1969 · 3.6K citations
The Adjustment of Stock Prices to New Information
Eugene F. Fama, Lawrence Fisher, Michael C. Jensen et al. · SSRN Electronic Journal · 2003 · 3.1K citations · Full text