Jackie Rees

Market Reactions to Information Security Breach Announcements: An Empirical Analysis

Losses due to information security breaches are notoriously difficult to measure. An event study of the effect of such breaches on financial performance found that they do not earn significantly negative abnormal returns. To verify whether this finding resulted from the aggregation of data across different characteristics (e.g., the nature of the breaches, the types of firms, the time periods of the study) the impact of each characteristic was analyzed. Again the results were not significantly negative. The study found that a negative bias followed the events of September 11, 2001. It also found that there was a difference in investor reactions to events during the dot-com era, when firms earned higher negative abnormal returns, and after the dot-com era. The implications are discussed.

PFIRES: a policy framework for information security

Creating and maintaining effective security strategy and policy for software applications.

Matching information security vulnerabilities to organizational security profiles: a genetic algorithm approach

Organizations are making substantial investments in information security to reduce the risk presented by vulnerabilities in their information technology (IT) infrastructure. However, each security technology only addresses specific vulnerabilities and potentially creates additional vulnerabilities. The objective of this research is to present and evaluate a Genetic Algorithm (GA)-based approach enabling organizations to choose the minimal-cost security profile providing the maximal vulnerability coverage. This approach is compared to an enumerative approach for a given test set. The GA-based approach provides favorable results, eventually leading to improved tools for supporting information security investment decisions.

Simulating sellers in online exchanges

Business-to-business (B2B) exchanges are expected to bring about lower prices for buyers through reverse auctions. Analysis of such settings for seller pricing behavior often points to mixed-strategy equilibria. In real life, it is plausible that managers learn this complex ideal behavior over time. We modeled the two-seller game in a synthetic environment, where two agents use a reinforcement learning (RL) algorithm to change their pricing strategy over time. We find that the agents do indeed converge towards the theoretical Nash equilibrium. The results are promising enough to consider the use of artificial learning mechanisms in electronic marketplace transactions.

Learning genetic algorithm parameters using hidden Markov models

Abstract Genetic algorithms (GAs) are routinely used to search problem spaces of interest. A lesser known but growing group of applications of GAs is the modeling of so-called “evolutionary processes”, for example, organizational learning and group decision-making. Given such an application, we show it is possible to compute the likely GA parameter settings given observed populations of such an evolutionary process. We examine the parameter estimation process using estimation procedures for learning hidden Markov models, with mathematical models that exactly capture expected GA behavior. We then explore the sampling distributions relevant to this estimation problem using an experimental approach.

Reverse Auctions with Multiple Reinforcement Learning Agents

Reverse auctions in business-to-business (B2B) exchanges provide numerous benefits to participants. Arguably the most notable benefit is that of lowered prices driven by increased competition in such auctions. The competition between sellers in reverse auctions has been analyzed using a game-theoretic framework and equilibria have been established for several scenarios. One finding of note is that, in a setting in which sellers can meet total demand with the highest-bidding seller being able to sell only a fraction of the total capacity, the sellers resort to a mixed-strategy equilibrium. Although price randomization in industrial bidding is an accepted norm, one might argue that in reality managers do not utilize advanced game theory calculations in placing bids. More likely, managers adopt simple learning strategies. In this situation, it remains an open question as to whether the bid prices converge to the theoretical equilibrium over time. To address this question, we model reverse-auction bidding behavior by artificial agents as both two-player and n-player games in a simulation environment. The agents begin the game with a minimal understanding of the environment but over time analyze wins and losses for use in determining future bids. To test for convergence, the agents explore the price space and exploit prices where profits are higher, given varying cost and capacity scenarios. In the two-player case, the agents do indeed converge toward the theoretical equilibrium. The n-player case provides results that reinforce our understanding of the theoretical equilibria. These results are promising enough to further consider the use of artificial learning mechanisms in reverse auctions and other electronic market transactions, especially as more sophisticated mechanisms are developed to tackle real-life complexities. We also develop the analytical results when one agent does not behave strategically while the other agent does and show that our simulations for this environment also result in convergence toward the theoretical equilibrium. Because the nature of the best response in the new setting is very different (pure strategy as opposed to mixed), it indicates the robustness of the devised algorithm. The use of artificial agents can also overcome the limitations in rationality demonstrated by human managers. The results thus have interesting implications for designing artificial agents in automating bid responses for large numbers of bids where human intervention might not always be possible.

The State of Risk Assessment Practices in Information Security: An Exploratory Investigation

Risk in Information Systems Security can be defined as a function of a given threat sources exercising a particular vulnerability and the resulting impact of that adverse event on the organization. Risk management is the process of identifying and assessing risk and taking steps to reduce it to an acceptable level given the costs involved in doing so. The major activity within risk management is the risk assessment process. The objective of this research is to assess the current state of practice in conducting risk assessments for information security policy management. Results from an exploratory survey of U.S. headquartered firms indicate that increased frequency of conducting risk assessments, the use of quantitative measures of likelihood of loss, and more complete asset inventories correspond with higher levels of user satisfaction and perceived usefulness, although many companies choose not to engage in this level of practice or to only go part way. Additionally, respondents reported substantial difficulty in identifying threats and estimating loss, indicating that much can be done to improve the current state of practice.

An Investigation of GA Performance Results for Different Cardinality Alphabets

Theoretical and empirical results give mixed advice for choosing the cardinality for GA representation. Using GA models that capture the exact expected behavior of both the binary and higher cardinality cases, the determination of which representation is best for a given GA can be made. De Jong et al. and Spears and De Jong presented how the exact model for the binary genetic algorithm can give important insights to transient GA behavior. This paper uses a similar approach to study the impact of different cardinalities using the Koehler-Bhattacharyya-Vose general cardinality model.

The problem of highly constrained tasks in group decision support systems

Abstract Most experimental uses of group decision support systems (GDSS) are associated with relatively unrestricted domains, for example, idea generation and preference specification, where few restrictions on potential solutions exist. However, an important GDSS task is that of resource allocation across functional areas of the organization, including supply chain applications. These types of tasks, such as budget planning and production planning, are typically highly constrained and difficult to solve optimally, necessitating the use of decision aids, such as those found in GDSS. We use a model based on adaptive search of a genetic algorithm as the analogy for the group decision making process. We apply this model to experimental data gathered from GDSS groups solving a production planning task. The results indicate very low estimated crossover rates in the experimental data. We also run computational experiments based on adaptive search to mimic the GDSS data and find that the low estimated crossover rate might be due to the highly constrained search space explored by the decision making groups. The results suggest further investigation into the presumed beneficial effects of group interaction in such highly constrained task domains, as it appears very little true information exchange occurs between group members in such an environment. Furthermore, the simulation technique can be used to help predict certain GDSS behaviors, thus improving the entire GDSS process.

Brainstorming, negotiating and learning in group decision support systems: an evolutionary approach

Certain tasks undertaken by groups using Group Decision Support Systems (GDSS) can be viewed as search problems. These tasks involve arriving at a solution or decision where the problem is complex enough to warrant the use of computerized decision support tools. Also, the task or situation must require more than one person to adequately address the problem. For these types of GDSS tasks, we propose to model the brainstorming, negotiating and learning processes undertaken by the group as a simple genetic algorithm. The simple genetic algorithm is a generalized search technique that is based on the principles of evolution and natural selection. Simply put, the best points in the search space are more likely to be selected and combined through genetic operators to determine new points. We propose that groups using GDSS to address certain tasks behave like a simple genetic algorithm in the manner in which possible solutions are generated, enhanced and altered in attempting to reach a decision or consensus.