Drivers of information security search behavior: An investigation of network attacks and vulnerability disclosures

Abstract

More and more people use search engines to seek for various information. This study investigates the search behavior that drives the search for information security knowledge via a search engine. Based on theories in information search and information security behavior we examine the effects of network attacks and vulnerability disclosures on search for information security knowledge by ordinary users. We construct a unique dataset from publicly available sources, and use a dynamic regression model to test the hypotheses empirically. We find that network attacks of current day and one day prior significantly impact the search, while vulnerability disclosure does not significantly affect the search. Implications of the study are discussed.

References

1. Anderson, C. L. and Agarwal, R. 2006. Practicing safe computing: Message framing, self-view, and home computer user security behavior intentions. In Proceedings of the 27th International Conference on Information Systems.
2. Anderson, C. L. and Agarwal, R. 2010. Practicing safe computing: A multimethod empirical examination of home computer user security behavioral Intentions. MIS Quart. 34, 3, 613--643.
3. Anscombe, F. J. 1960. Rejection of outliers. Technomet. 2, 2, 123--147.
4. Armstrong, H. L. and Forde, P. J. 2003. Internet anonymity practices in computer crime. Inform. Manag. Comput. Secur. 11, 5, 209--215.
5. Arora, A., Krishnan, R., Telang, R., and Yang, Y. 2010. An empirical analysis of software vendors' patch release behavior: Impact of vulnerability disclosure. Inf. Syst. Res. 21, 1, 115--132.
6. Arora, A., Nandkumar, A., and Telang, R. 2006. Does information security attack frequency increase with vulnerability disclosure? An empirical analysis. Inf. Syst. Frontiers 8, 5, 350--362.
7. Barron, F. H. and Barrett, B. E. 1996. Decision quality using ranked attribute weights. Manag. Sci. 42, 11, 1515--1523.
8. Battelle, J. 2005. The Search. Penguin Books, New York.
9. Box, G. E. P., Jenkins, G. M., and Reinsel, G. C. 1994. Time Series Analysis: Forecasting and Control, Prentice Hall, Englewood Cliffs, NJ.
10. Brouwers, M. C. and Sorrentino, R. M. 1993. Uncertainty orientation and protection motivation theory: The role of individual differences in health compliance. J. Person. Social Psych. 65, 1, 102--112.
11. Brown, S. J. and Warner, J. B. 1985. Using daily stock returns the case of event studies. J. Finan. Econ. 14, 3--31.
12. Browne, G. J., Pitts, M. G., and Wetherbe, J. C. 2007. Cognitive stopping rules for terminating information search in online tasks. MIS Quart. 31, 1, 89--104.
13. Campbell, J. Y., Lo, A. W., and Mackinlay, A. C. 1996. The Econometrics of Financial Markets, Princeton University Press, Princeton, NJ.
14. Cavusoglu, H., Cavusoglu, H., and Raghunathan, S. 2007. Efficiency of vulnerability disclosure mechanisms to disseminate vulnerability knowledge. IEEE Trans. Softw. Engin. 33, 3, 171--185.
15. Chantler, A. N. 1995. Risk: The profile of a computer hacker. Tech. rep., Curtin University, Perth.
16. Chau, M., Fang, X., and Sheng, O. R. L. 2007. What are people searching on government web sites? Comm. ACM 50, 4, 87--92
17. Chou, P. H. B. and Wister, A. V. 2005. From cues to action: Information seeking and exercise self-care among older adults managing chronic illness. Canad. J. Aging 24, 4, 395--408.
18. Cooper, C. P., Mallon, K. P., Leadbetter, S., Pollack, L. A., and Peipins, L. A. 2005. Cancer Internet search activity on a major search engine, United States 2001--2003. J. Med. Internet Res. 7, 3, e6.
19. Dervin, B. 1983. An overview of sense-making research: Concepts, methods and results to date. In Proceedings of the International Communications Association Annual Meeting.
20. Dickey, D. and Fuller, W. 1979. Distribution of the estimators for autoregressive time series with a unit root. J. Amer. Statist. Assoc. 74, 427--431.
21. Dickey, D. and Fuller, W. 1981. Likelihood ratio tests for autoregressive time series with a unit root. Econometr. 49, 4, 1057--1072.
22. Dowland, P. S., Furnelll, S. M., Illingworth, H. M., and Reynolds, P. L. 1999. Computer crime and abuse: A survey of public attitudes and awareness. Comput. Secur. 18, 8, 715--729.
23. Eppright, D. R., John F. Tanner, J., and Hunt, J. B. 1994. Knowledge and the ordered protection motivation model: Tools for preventing AIDS. J. Bus. Res. 30, 1, 13--24.
24. Ettredge, M., Gerdes, J., and Karuga, G. 2005. Using web-based search data to predict macroeconomic statistics. Comm. ACM 48, 11, 87--92
25. Floyd, D. L., Prentice-Dunn, S., and Rogers, R. W. 2000. A meta-analysis of research on protection motivation theory. J. Appl. Soc. Psych. 30, 2, 407--429.
26. Furnell, S. M., Jusoh, A., and Katsabas, D. 2006. The challenges of understanding and using security: A survey of end-users. Comput. Secur. 25, 1, 27--35.
27. Ginsberg, J., Mohebbi, M. H., Patel, R. S., Brammer, L., Smolinski, M. S., and Brilliant, L. 2008. Detecting influenza epidemics using search engine query data. Nature 457, 19, 1012--1014.
28. Griffin, R. J., Dunwoody, S., and Neuwirth, K. 1999. Proposed model of the relationship of risk information seeking and processing to the development of preventive behaviors. Environ. Res. 80, 2, S230--S245.
29. Herath, T. and Rao, H. R. 2009a. Encouraging information security behaviors in organizations: Role of penalties, pressures and perceived effectiveness. Decis. Support Syst. 47, 2, 154--165.
30. Herath, T. and Rao, H. R. 2009b. Protection motivation and deterrence: A framework for security policy compliance in organisations. Euro. J. Inf. Syst. 18, 2, 106--125.
31. Hussain, A., Heidemann, J., and Papadopoulos, C. 2003. A framework for classifying denial of service attacks. In Proceedings of the Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications. 99--110.
32. Jansen, B. J. 2007. The comparative effectiveness of sponsored and nonsponsored links for web E-commerce queries. ACM Trans. Web 1, 1, 3-es.
33. Karnow, C. E. A. 2007. Counterstrike. In Cybercrime: Digital Cops in A Networked Environment, J. M. Balkin, K. Eddan, J. Grimmelmann, N. Kozlovski, S. Wagman and T. Zarsky, Eds. NYU Press, New York.
34. Kephart, J. O. and White, S. R. 1993. Measuring and modeling computer virus prevalence. In Proceedings of the IEEE Symposium on Security and Privacy. 2--14.
35. Kumar, N., Mohan, K., and Holowczak, R. 2008. Locking the door but leaving the computer vulnerable: Factors inhibiting home users' adoption of software firewalls. Decis. Support Syst. 46, 1, 254--264.
36. Li, P. and Rao, H. R. 2007. An examination of private intermediaries' roles in software vulnerabilities disclosure. Inf. Syst. Frontiers 9, 5, 531--539.
37. Liang, H., and Xue, Y. 2009. Avoidance of information technology threats: A theoretical perspective. MIS Quart. 33, 1, 71--90.
38. Manikopoulos, C. and Papavassiliou, S. 2002. Network intrusion and fault detection: A statistical anomaly approach. IEEE Comm. Mag. 40, 10, 76--82.
39. Mcqueen, M. A., Mcqueen, T. A., Boyer, W. F., and Chaffin, M. R. 2009. Empirical estimates and observations of 0 day vulnerabilities. In Proceedings of the 42nd Hawaii International Conference on System Sciences.
40. Mcwilliams, A. and Siegel, D. 1997. Event studies in management research: Theoretical and empirical issues Acad. Manag. J. 40, 3, 626--657.
41. Mell, P., Scarfone, K., and Romanosky, S. 2007. A Complete Guide to The Common Vulnerability Scoring System Version 2.0, Forum of Incident Response and Security Teams.
42. Miller, G. A. 1983. Informavores. In The Study of Information: Iterdisciplinary Messages, F. Machlup and U. Mansfield, Eds. Wiley, New York, 111--113.
43. Moore, T. and Clayton, R. 2009. Evil searching: Compromise and recompromise of Internet hosts for phishing. In Proceedings of the 13th International Conference on Financial Cryptography and Data Security.
44. Neuwirth, K., Dunwoody, S., and Griffin, R. J. 2000. Protection motivation and risk communication. Risk Anal. 20, 5, 721--734.
45. Ng, B.-Y., Kankanhalli, A., and Xu, Y. C. 2009. Studying users' computer security behavior: A health belief perspective. Decis. Support Syst. 46, 4, 815--825.
46. Pankratz, A. 1991. Forecasting with Dynamic Regression Models. John Wiley & Sons, New York.
47. Pass, G., Chowdhury, A., and Torgeson, C. 2006. A picture of search. In Proceedings of the the 1st International Conference on Scalable Information Systems (InfoScale '06).
48. Png, I., Wang, C., and Wang, Q. 2008. The deterrent and displacement effects of information security enforcement: International evidence. J. Manag. Inf. Syst. 25, 2, 125--144.
49. Radianti, J., Gonzalez, J. J., and Rich, E. 2009a. A quest for a framework to improve software security: Vulnerability black markets scenario. In Proceedings of the the 27th International Conference of the System Dynamics Society.
50. Radianti, J., Rich, E., and Gonzalez, J. J. 2009b. Vulnerability black markets: Empirical evidence and scenario simulation. In Proceedings of the 42nd Hawaii International Conference on System Sciences.
51. Richardson, M. 2008a. Learning about the world through long-term query logs. ACM Trans. Web 2, 4, Article 21.
52. Richardson, R. 2008b. CSI Computer Crime & Security Survey. Computer Security Institute.
53. Rippetoe, P. A., and Rogers, R. W. 1987. Effects of components of protection-motivation theory on adaptive and maladaptive coping with a health threat. J. Person. Social Psych. 52, 3, 596--604.
54. Rogers, G. O. 1997. The dynamics of risk perception: How does perceived risk respond to risk events? Risk Anal. 17, 6, 745--757.
55. Rogers, R. W. 1975. A protection motivation theory of fear appeals and attitude change. J. Psych. 91, 1, 93--114.
56. Rose, D. E. and Levinson, D. 2004. Understanding user goals in web search. In Proceedings of the International World Wide Web Conference.
57. Severtson, D. J., Baumann, L. C., and Brown, R. L. 2006. Applying a health behavior theory to explore the influence of information and experience on arsenic risk representations, policy beliefs, and protective behavior. Risk Anal. 26, 2, 353--368.
58. Smith, V. K., Desvousges, W. H., and Payne, J. W. 1995. Do risk information programs promote mitigating behavior? J. Risk Uncert. 10, 3, 203--221.
59. Srinivasan, N. and Ratchford, B. T. 1991. An empirical test of a model of external search for automobiles. J. Consum. Res. 18, 233--242.
60. Tancer, B. 2008. Click: What Millions of People Are Doing Online and Why It Matters. Hyperion, New York.
61. Venkatsubramanyan, S. and Kwan, S. K. 2008. A web search model for strategic decision making. AIMS Int. J. Manag. 2, 3, 197--214.
62. Woon, I. M. Y., Tan, G. W. and Low, R. T. 2005. A protection motivation theory approach to home wireless security. In Proceedings of the 25th International Conference on Information Systems.
63. Workman, M., Bommer, W. H., and Straub, D. 2008. Security lapses and the omission of information security measures: A threat control model and empirical test. Comput. Hum. Behav. 24, 6, 2799--2816.
64. Ybarra, M. L. and Sumanb, M. 2006. Help seeking behavior and the Internet: A national survey. Int. J. Med. Inf. 75, 1, 29--41.

Index Terms

• Information systems

  • Information retrieval

    • Information retrieval query processing