An Empirical Analysis of Software Vendors' Patch Release Behavior: Impact of Vulnerability Disclosure.

Author List: Arora, Ashish; Krishnan, Ramayya; Telang, Rahul; Yang, Yubao;
Information Systems Research, 2010, Volume 21, Issue 1, Page 115-132.
A key aspect of better and more secure software is timely patch release by software vendors for the vulnerabilities in their products. Software vulnerability disclosure, which refers to the publication of vulnerability information, has generated intense debate. An important consideration in this debate is the behavior of software vendors. How quickly do vendors patch vulnerabilities and how does disclosure affect patch release time? This paper compiles a unique data set from the Computer Emergency Response Team/Coordination Center (CERT) and SecurityFocus to answer this question. Our results suggest that disclosure accelerates patch release. The instantaneous probability of releasing the patch rises by nearly two and a half times because of disclosure. Open source vendors release patches more quickly than closed source vendors. Vendors are more responsive to more severe vulnerabilities. We also find that vendors respond more slowly to vulnerabilities not disclosed by CERT. We verify our results by using another publicly available data set and find that results are consistent. We also show how our estimates can aid policy makers in their decision making.
Keywords: disclosure policy; hazard model; information security; open source vendors; patch release time; security vulnerability; software vendors
Algorithm:

List of Topics

#22 0.448 software vendors vendor saas patch cloud release model vulnerabilities time patching overall quality delivery software-as-a-service high need security vulnerability actually
#133 0.091 data predictive analytics sharing big using modeling set power inference behavior explanatory related prediction statistical generated substantially novel building million
#262 0.091 impact data effect set propensity potential unique increase matching use selection score results self-selection heterogeneity evidence measure associated estimate leads
#186 0.083 security information compliance policy organizations breach disclosure policies deterrence breaches incidents results study abuse managed isp violations based comply protection
#273 0.083 source open software oss development developers projects developer proprietary community success openness impact paper project associated activity phenomenon peripheral variety
#225 0.075 information environment provide analysis paper overall better relationships outcomes increasingly useful valuable available increasing greater regarding levels decisions viewed relative
#8 0.056 decision making decisions decision-making makers use quality improve performance managers process better results time managerial task significantly help indicate maker