Impact of Vulnerability Disclosure and Patch Availability - An Empirical Analysis (2004)
| Venue: | In Third Workshop on the Economics of Information Security |
| Citations: | 14 - 0 self |
BibTeX
@INPROCEEDINGS{Arora04impactof,
author = {Ashish Arora and Ramayya Krishnan and Rahul Telang and Yubao Yang},
title = {Impact of Vulnerability Disclosure and Patch Availability - An Empirical Analysis},
booktitle = {In Third Workshop on the Economics of Information Security},
year = {2004}
}
Years of Citing Articles
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
Vulnerability disclosure is an area of public policy that has been subject to considerable debate, particularly between proponents of full and instant disclosure, and those of limited or no disclosure. This paper is an attempt to empirically test the impact of vulnerability information disclosure and availability of patches on attackers ’ tendency to exploit vulnerabilities on one hand and on the vendors ’ tendency to release patches on the other. Our results suggest that while vendors are quick to respond to instant disclosure, vulnerability disclosure also increases the frequency of attacks. However, the frequency of attacks decreases over time. We also find that open source vendors patch more quickly than closed source vendors and that large vendors are more responsive.
Citations
No citations identified.
