Does information security attack frequency increase with vulnerability disclosure? An empirical analysis

摘要: Research in information security, risk management and investment has grown importance over the last few years. However, without reliable estimates on attack probabilities, is difficult to do practice. Using a novel data set, we provide propensity how it changes with disclosure patching of vulnerabilities. Disclosure software vulnerability been controversial. On one hand are those who propose full instant whether patch available or not other argue for limited no disclosure. Which two policies socially optimal depends critically frequency patching. In this paper, empirically explore impact availability patches attacks targeting vulnerability. Our results suggest that an average both secret (non-published) published (published patched) vulnerabilities attract fewer than patched When control time since publication patches, find already known decreases number attacks, although gradually increase after release. Patching unknown vulnerability, however, causes spike which then decline Attacks slowly until rapidly decrease publication.