Finance & Cyber Security: Uncovering major non-obvious financial gains and losses associated with corporate cyber security events

我在牛津大学的博士研究项目“金融与网络安全：揭示与企业网络安全事件相关的重大非显而易见的财务收益和损失”，旨在探索企业网络安全事件产生的隐藏成本。我探讨了网络安全投资的公司价值影响，安全漏洞后资本成本的变化，以及企业内部人员对安全漏洞和漏洞的了解和利用。具体来说，我分析了信息安全投资对股市的影响，重点是安全标准。这些投资不仅有可能减少与数据泄露相关的财务处罚和损失，而且还有助于提高声誉，赢得新业务并改善业务流程。我发现，根据英国的网络基本计划的认证与重大和积极的市场反应系统相关。然而，符合ISO/IEC 27001标准会导致显著的负异常股票回报率。此外，我还确定了安全漏洞与股本成本的统计和经济显著增加有关。通过分析一个以美国为重点的严重安全漏洞样本，我发现资本市场参与者将更高的风险（以贝塔系数衡量）归因于违规公司。此外，在安全漏洞发生后，下行贝塔系数特别增加，这表明当市场产生负回报时，违规公司特别容易受到股本成本增加的影响。这一发现对企业的资本成本（即从外部资本提供者获得资金的成本）具有重要意义。我的研究成果已被信息安全经济学研讨会（WEIS）等备受推崇的机构发表。该研究项目与学术界和从业人员具有高度相关性，因为以前的研究主要集中在与网络安全相关的明显成本上，从而忽略了对企业和整个社会的非明显损失。我研究的目的是建立一个更全面的观点，对网络（不）安全造成的损失。我的分析结果将为有关信息安全投资的学术框架和行政决策提供信息。我的研究方法的新奇源于（a）网络安全成本的新视角;（B）使用的数据集;（c）应用于网络安全的财务方法。首先，我介绍了与网络安全（违规）相关的利益和损失会计的新观点。通过强调与网络安全相关的不明显的经济影响，学者和从业人员可以对网络安全成本和收益形成更复杂的观点。我的研究可以为新的框架提供信息，以帮助指导信息安全投资工作。其次，我分析了以前未使用的（金融）数据集，为信息安全决策提供信息。将新的经验证据引入新兴的网络安全投资领域具有高度相关性，因为数据是该研究领域的稀缺经济资源。第三，我使用金融经济学文献中成熟的分析方法来分析网络安全现象。例如，在安全漏洞之后建立双贝塔系统风险模型的变化对信息安全经济学文献来说是新颖的。该项目福尔斯属于EPSRC数字经济研究领域。其中一个子研究项目涉及使用伦敦资产管理公司提供的数据。此外，我经常与一家国际风险管理和保险公司的高级员工进行讨论，他们对我的研究感兴趣，并将研究结果应用于他们的业务活动。

My DPhil research project "Finance & Cyber Security: Uncovering major non-obvious financial gains and losses associated with corporate cyber security events" at the University of Oxford sets out to explore hidden costs stemming from firms' cyber security events. I explore firm value implications of investments in cyber security, changes in cost of capital following security breaches, and corporate insiders' knowledge and exploitation of security breaches and vulnerabilities. Specifically, I analysed the stock market impact of information security investments focusing on security standards. Such investments do not only have the potential to reduce financial penalties and losses associated with data breaches, but may also help to enhance reputation, win new business, and improve business processes. I found that certifications according to the UK's Cyber Essentials scheme are systematically associated with significant and positive market reactions. Becoming ISO/IEC 27001 compliant, however, elicits significant negative abnormal stock returns.Furthermore, I established that security breaches are associated with a statistically and economically significant increase in cost of equity. Analysing a large US-focused sample of severe security breaches I found that capital market participants ascribe a higher risk, measured in terms of beta factors, to breached companies. Additionally, downside betas particularly increase following a security breach, which indicates that when markets yield negative returns, breached firms are particularly susceptible to increases costs of equity. The findings carry important implications for firms' cost of capital, that is, the costs of obtaining funding from external capital providers.My research has been published by highly regarded outlets such as the Workshop on the Economics of Information Security (WEIS). The research project is of high relevance to academia and practitioners as previous research has focused mainly on obvious costs associated with cyber security and thereby neglected non-obvious losses to firms and society at large. The aim of my research is to establish a more holistic view on losses stemming from cyber (in-)security. The outcomes of my analyses will inform academic frameworks and executive decision making regarding information security investments.The novelty of my research methodology stems from the novel (a) perspective on cyber security costs; (b) datasets used; and (c) financial methodologies applied to cyber security. First, I introduce new perspectives on accounting for benefits and losses associated with cyber security (breaches). By highlighting non-obvious economic implications associated with cyber security, academics and practitioners can form a more sophisticated view on cyber security costs and benefits. My research can inform novel frameworks to help guiding information security investment endeavours. Second, I analyse previously-unused (financial) datasets to inform information security decision making. Introducing novel empirical evidence to the nascent field of cyber security investments is of high relevance as data is a scarce economic resource in this area of research. Third, I use well-established analytical methods from the financial economics literature to analyse cyber security phenomena. For instance, establishing changes in dual-beta systematic risk models following security breaches is novel to the information security economics literature. This project falls within the EPSRC Digital Economy research area.One sub-research project involves using data provided by a London-based asset management firm. Furthermore, I am in frequent discussions with senior employees at an international risk management and insurance firm, who are interested in my research and apply findings to their business activities.