Anand Nandkumar

Does information security attack frequency increase with vulnerability disclosure? An empirical analysis

Research in information security, risk management and investment has grown in importance over the last few years. However, without reliable estimates on attack probabilities, risk management is difficult to do in practice. Using a novel data set, we provide estimates on attack propensity and how it changes with disclosure and patching of vulnerabilities. Disclosure of software vulnerability has been controversial. On one hand are those who propose full and instant disclosure whether the patch is available or not and on the other hand are those who argue for limited or no disclosure. Which of the two policies is socially optimal depends critically on how attack frequency changes with disclosure and patching. In this paper, we empirically explore the impact of vulnerability information disclosure and availability of patches on attacks targeting the vulnerability. Our results suggest that on an average both secret (non-published) and published (published and not patched) vulnerabilities attract fewer attacks than patched (published and patched) vulnerabilities. When we control for time since publication and patches, we find that patching an already known vulnerability decreases the number of attacks, although attacks gradually increase with time after patch release. Patching an unknown vulnerability, however, causes a spike in attacks, which then gradually decline after patch release. Attacks on secret vulnerabilities slowly increase with time until the vulnerability is published and then attacks rapidly decrease with time after publication.

Competition and patching of security vulnerabilities: An empirical analysis

We empirically estimate the effect of competition on vendor patching of software defects by exploiting variation in number of vendors that share a common flaw or common vulnerabilities. We distinguish between two effects: the direct competition effect when vendors in the same market share a vulnerability, and the indirect effect, which operates through non-rivals that operate in different markets but nonetheless share the same vulnerability. Using time to patch as our measure of quality, we find empirical support for both direct and indirect effects of competition. Our results show that ex-post product quality in software markets is not only conditioned by rivals that operate in the same product market, but by also non-rivals that share the same common flaw.

Securing Their Future? Entry and Survival in the Information Security Industry

In this paper we study how the existence of a functioning market for technology differentially conditions the entry strategy and survival of different types of entrants, and the role of scale, marketing ability and technical assets. Markets for technology facilitate entry of firms that lack proprietary technology and increase vertical specialization. However, they also increase the relative advantage of downstream capabilities, which is reflected in the relatively improved performance of incumbent Information and Communication Technologies (ICT) firms compared to startups. We find that diversifying entrants perform better relative to startups. Contrary to earlier studies, we find that spin-offs do not perform any better than other startups. Moreover, firms founded by serious hobbyists and tinkerers, whom we call hackers, perform markedly better than other startups. These findings reflect the non-manufacturing setting of this study, as well as the distinctive nature of software technology.

Right Person at the Right Place: How IPR at the Host Location Influences the Internal Division of Innovative Labor in Multinational Enterprises

The internationalization of R&D activity by multinational enterprises (MNEs) is increasing, with a recent big push towards emerging economies. Understanding how MNEs organize collaborative R&D across geographies is therefore an important area of scholarship. However, little attention has been paid towards understanding the factors that influence the division of innovative labor within an MNE across geographies – the internal division of innovative labor. Drawing on the literature that shows that strong protection for intellectual property (IP) is important for the efficient division of innovative labor between firms, we argue and show that differences in effectiveness of IP protection between international locations significantly influences the internal division of innovative labor, especially for R&D aimed at the host market when compared to R&D aimed at the home market.

Licensing-in technology markets: How the strength of patents influence firm strategies and competition? Empirical evidence from the 2004 Indian Patent Reforms

The TRIPs mandate that seeks to harmonize patent laws the world over has been heavily debated especially by developing countries on the basis that stronger patents are likely to increase market concentration and prices. Contrary to this notion, using the recently initiated patent reforms in India, we show that stronger patents can actually increase competition. Building on the literature on Markets for Technology (MFT) we build model that identifies conditions under which stronger patents can actually stimulate competition as opposed to retarding it. We show that stronger patents increase entry by firms that do not have the ability to produce proprietary technology because stronger patents facilitate entry by in-licensing. On the other hand for firms, that do not have complementary capability but can generate proprietary technology, stronger patents makes it more attractive to out-license rather than entering product markets. Assuming that multinationals have high technical capability and relatively low complementary capability and that domestic firms have low technical and high complementary capability, we hypothesize that stronger patents should facilitate licensing between multinationals and domestic firms, especially to those that are incapable of producing proprietary technology. Our empirical results bear out the intuition that on an average, patenting activity increases with stronger patents and by more for multinationals relative to domestic firms and also by more in disembodied industries relative to embodied markets. Also, as a consequence we show that licensing activity and competition increases with stronger patents and by more in disembodied industries while licensing activity increases with stronger patents and by more in disembodied industries.