The Association Between the Disclosure and the Realization of Information Security Risk Factors

Abstract

Firms often disclose information security risk factors in public filings such as 10-K reports.The internal information associated with disclosures may be positive or negative. In this paper, we are interested in evaluating how the nature of security risk factors disclosed, which is believed to represent the internal information regarding information security, is associated with future breach announcements. For this purpose, we build a decision tree model, which classifies the occurrence of future security breaches based on the textual contents of the disclosed security risk factors. The model is able to accurately associate disclosure characteristics with breach announcements about 77% of the time. We further explore the contents of the security risk factors using text mining techniques to provide a richer interpretation of the results. The results show that the security risk factors with action-oriented terms and phrases are less likely to be related to future incidents. We also conduct a cross-sectional analysis to study how the market interprets the nature of information security risk factors in annual reports at different time points.We find that the market reaction following the security breach announcement is different depending on the nature of disclosure. Thus, our paper contributes to the literature in information security and sheds light on how market participants can better interpret security risk factors disclosed in financial reports at the time when financial reports are released.

Individual information security, user behaviour and cyber victimisation: An empirical study of social networking users

“…3. Unfortunately, at times there is a tendency to downplay security breaches in the corporate sector, despite evidence that openness and disclosure generally results in a lower likelihood of future breaches (Wang et al, 2013). While, to our knowledge, there has been no studies looking at disclosure (or lack of) of victimisation incidents in a social media context, there are good reasons to speculate -both from the extant literature and the research presented in this paper -that this would be detrimental to lowering risks.…”

The influence of a good relationship between the internal audit and information security functions on information security outcomes

“…given that the disclosure of information security risk factors, governance policies, and information security breaches can significantly impact firm value (Gordon, Loeb, & Sohail, 2010;Higgs, Pinsker, Smith, & Young, 2016;Wang, Kannan, & Ulmer, 2013). In addition, cybercrime poses "a different focal point of concern [and] a different 'subject' of risk", (Power, 2013, p. 538), because perpetrators are often unknown agents outside the organization.…”

How Bad is it? – A Branching Activity Model to Estimate the Impact of Information Security Breaches

“…• Disincentives to Disclose -There have been many studies (Bodeau 1992, Cavusoglu et al 2004, Lambert 1993, Rees 2009, Sohail 2006, Wang et al 2008 showing that companies and individuals are reluctant to disclose information related to security breaches.…”