The effect of competition intensity on cybersecurity

Transcription

1 The effect of competition intensity on cybersecurity An empirical analysis of security patch release on the web browser market Telecom ParisTech CRESSE 2016 July 2016

2 A market at the heart of cybersecurity issues A web browser is the principal window of the World Wide Web: the most widely used application to access to web resource. Security issues are all the more important. Ex) Heartbleed SSL vulnerability Its principal component is the rendering engine: a component used by every Web application that displays web resource.

3 The web browser market (1/2) 3 different periods in the Web browser history 1990: Invention of the Web browser : Dominance of Microsoft Internet Explorer Period after 2004: creation of Mozilla Firefox, new browsers and new features, open source rendering engines... From: an application dependent to operation systems Business strategies evolve also: To: a central platform to communicate on the Web Integrated services (ex. Login to Google account when using Chrome) Central role of the rendering engine Influence to the Web standards Bundling and lock-in strategy Ñ Open source strategy Web browsers are subsidized by search engine revenues

4 The web browser market (2/2) Browser Firefox Safari Chrome Internet Explorer Publisher Mozilla Apple Google Microsoft Rendering engine Gecko Webkit Blink (fork of Webkit) Trident License Open source (MPL) Open source rendering engine (GNU LPGL) Open source rendering engine (GNU LPGL) & open source version of browser (Chromium) Proprietary Business model Built-in search engine royalties (ą 90% of all revenues,»100m$) and donations 1B$ of built-in search engine royalties from Google (in 2014) Vertically integrated 90% of ABC(Google) s revenue come from search related ad. Vertically integrated

5 Patching time as a proxy of the security quality Vulnerability life cycle Patching T is a measure of the security quality q V user U f ` U s pqq P and Π publisher Gpqq C f C s pqq with U f, utility from quality of other aspects than security (functionalities, rendering performance..) U s, utilify from security quality P 0 C f, Cost of quality of other aspects than security C f, Cost to provide a security quality q dv user {dq du s {dq ă 0

6 Some theorical framework For a market with n web browsers, V user U f ` U s pqq c t pqq Π publisher Gpq, aq C f Cpqq In a market with a number n of web browsers competing, what is the security quality q the web browser publishers will choose?

7 The empirical model OLS regression We use the number of days to deliver a patch (Patching T ) as a measure of the security quality. One observation = one pair of vulnerability & web browser publisher Explanatory variable of interest: Competition intensity 1 HHI (Herfindahl Index) Control variables: characteristics specific to the vulnerability, to the software and the vendor, information disclosure, time effect. Patching T β 0 ` β 1 Comp ` β2vuln char ` β 3 V &Soft char ` β 4 User ext ` β 5 T effect ` ɛ Patching T β 0 ` β 1a Comp ` β 1b Comp 2 ` β 2 Vuln char ` β 3 V &Soft char ` β 4 User ext ` β 5 T effect ` ɛ Market considered: 1 the web browser market 2 the rendering engine market Variant: browser s market share as main explanatory variable

8 1 Main result: our data supports the idea that concentration and security investment have a positive relationship 2 Independently of competition intensity, some interesting insight on security investment of software editors: Positive effect of the number of users Positive effect of an earlier public disclosure of the vulnerability Web browsers with an open source core (the rendering engine) are patched more quickly

9 Main data 521 vulnerabilities affecting Web browsers, reported from January 2006 to December 2015 from 3 different projects: 10 vulnerabilities from Google Project Zero 454 vulnerabilities from Zero Day Initiative 63 vulnerabilities from idefense Limited the study to the four principal browsers during the last 10 years: Internet Explorer, Safari, Firefox, Chrome. Limited to vulnerabilities assigned to web browser publishers Collected information: Reported date to the vendor, vulnerability details, information about affected browsers and versions Enrichment with other databases: NVD & MITRE: released date on NVD (public disclosure date), severity of the vulnerability, type of vulnerability From each vendor: version release date, vulnerability patching date Statcounter.com: evolution of market share ITU ICT Indicators database : evolution of number of internet users

10 Description of variables Variable Description Dependent variable Patching time (Patching T ) patching time Time spent by the editor to release a patch (unit: number of days) Explanatory variables Competition intensity (Comp) comp intensity 1 - Herfindahl-Hirschman Index, measured by each browser market share at the vulnerability discovery date Market share (M share) market share Market share of each browser at the date when the vulnerability was reported to the vendor Vulnerability specific effects (Vuln char) vulnerability severity Level of severity of the vulnerability (CVSS base score from 1 to 10) vulnerability type Classification of the type of weakness the vulnerability is subject to, such as cross site scripting, SQL injection, Information leak. 12 types of weaknesses. Software and vendor specific effects (V &Soft char) software age Maturity of the software at the time when the vulnerability is discovered (unit: number of days) vendor dummies Dummies for each vendors : Google, Apple, Mozilla, Microsoft (dummies) opensource 1 if the affected web browser engine is open source, 0 if not (dummy) User related externalities (User ext) n users Number of users of the browser on the date on which the vulnerability was reported. (Market share of the browser * number of Internet user) earlier disclosure 1 if the vulnerability was publicly disclosed earlier than the conventional period of time of 90 days, after being notified to the vendor, 0 if not. (dummy) Time effect (T effect) time effect The date on which the vulnerability was reported to the editor (unit: quarterly date)

11 of OLS Regressions Web browser market Rendering eng. market Market share as main var. VARIABLES Linear Quadratic Linear Quadratic Linear Quadratic Competition intensity (Comp) comp intensity 197.2*** 1,486*** 98.48** 1,727** (48.29) (412.5) (45.78) (735.6) pcompetition intensityq 2-1,010*** -1,345** (315.1) (601.3) market share ** (58.44) (306.9) pmarket shareq (234.1) Vulnerability specific effect (Vuln char) vulnerability severity Yes Yes Yes Yes Yes Yes vulnerability type dummies Yes Yes Yes Yes Yes Yes Soft. and vendor specific effect (V &Soft char) (software age, vendor dummies, opensource) Yes Yes Yes Yes Yes Yes User related externalities (User ext) (n users,earlier disclosure) Yes Yes Yes Yes Yes Yes Time effect (T effect) Yes Yes Yes Yes Yes Yes Observations R-squared x-coordinate of Maximum ( β 2 {2β 1 ) N.A.735 N.A.64 N.A N.A Curvature ( β 1 ) N.A 1010 N.A 1344 N.A N.A Robust Standard errors in parentheses *** p ă 0.01, ** p ă 0.05, * p ă 0.1

12 of OLS Regressions Web browser market Rendering eng. market Market share as main var. VARIABLES Linear Quadratic Linear Quadratic Linear Quadratic Competition intensity (Comp) comp intensity 197.2*** 1,486*** 98.48** 1,727** (48.29) (412.5) (45.78) (735.6) pcompetition intensityq 2-1,010*** -1,345** (315.1) (601.3) market share ** (58.44) (306.9) pmarket shareq (234.1) Vulnerability specific effect (Vuln char) vulnerability severity Yes Yes Yes Yes Yes Yes vulnerability type dummies Yes Yes Yes Yes Yes Yes Soft. and vendor specific effect (V &Soft char) (software age, vendor dummies, opensource) Yes Yes Yes Yes Yes Yes User related externalities (User ext) (n users,earlier disclosure) Yes Yes Yes Yes Yes Yes Time effect (T effect) Yes Yes Yes Yes Yes Yes Observations R-squared x-coordinate of Maximum ( β 2 {2β 1 ) N.A.735 N.A.64 N.A N.A Curvature ( β 1 ) N.A 1010 N.A 1344 N.A N.A Robust Standard errors in parentheses *** p ă 0.01, ** p ă 0.05, * p ă 0.1

13 for OLS Regressions, quadratic model VARIABLES Web browser market Rendering eng. market Competition intensity (Comp) comp intensity 1,486*** 1,727** (412.5) (735.6) pcompetition intensityq 2-1,010*** -1,345** (315.1) (601.3) Vulnerability specific effect (Vuln char) vulnerability severity Yes Yes vulnerability type dummies Yes Yes Soft. and vendor specific effect (V &Soft char) (software age, vendor dummies, opensource) Yes Yes User related externalities (User ext) (n users,earlier disclosure) Yes Yes Time effect (T effect) Yes Yes Observations R-squared x-coordinate of Maximum ( β 2 {2β 1 ) Curvature ( β 1 ) Robust Standard errors in parentheses *** p ă 0.01, ** p ă 0.05, * p ă 0.1 Fitting curve for quadratic regressions

14 of OLS Regressions, open source & disclosure variables VARIABLES (1) (2) (3) (4) (5) (6) (7) Competition intensity (Comp) comp intensity 197.2*** 193.7*** 195.1*** 1,486*** 1,492*** 1,741*** 940.5*** (48.29) (48.21) (55.68) (412.5) (413.9) (474.1) (349.1) pcomp intensityq 2-1,010*** -1,017*** -1,212*** *** (315.1) (316.4) (360.9) (295.6) Vulnerability specific effect (Vuln char) Yes Yes Yes Yes Yes Yes Yes Software and vendor specific effect (V &Soft char) software age & vendor dummies Yes Yes Yes Yes Yes Yes Yes open source *** *** *** *** ** (16.78) (19.02) (16.12) (18.28) (15.10) User related externalities (User ext) n users Yes Yes Yes Yes Yes Yes Yes earlier disclosure *** *** *** *** *** (4.199) (4.193) (4.002) (3.995) (4.272) Time effect (T effect) Yes Yes Yes Yes Yes Yes Yes Observations R-squared Robust Standard errors in parentheses *** p ă 0.01, ** p ă 0.05, * p ă 0.1

15 Existing literature The economics of information security Impact of competition intensity on security investment Gal-Or & Ghose. (2005). The economic incentives for sharing security information. Information Systems Research. Arora, Forman, Nandkumar, & Telang. (2010). Competition and patching of security vulnerabilities: An empirical analysis. Information Economics and Policy. Competition and innovation Aghion, Bloom, Blundell, Griffith & Howitt. (2005). Competition and Innovation: An Inverted-U Relationship. The Quarterly Journal of Economics. Competition and quality Waterman. (1989). Diversity and quality of information products in a monopolistically competitive industry. Information Economics and Policy. Further study: first of all, find a analytical model consistent with the empirical results

16 Thank you!