The study comes from the UBC Sauder School of Business (Vancouver, Canada), and it has assessed the security levels of some 1,200 Pan-Asian companies. This was to determine if increased awareness of security levels within the firm leads to better defense levels being put in place to combat cybercrime. Such assessments are important if businesses are to remain robust against cyberattacks, which are steadily increasing according to data compiled by the Online Trust Alliance.
The researchers discovered that when cyberattacks are less likely to directly harm a company, then the response by companies do not generally lead the improvements with internal security. Furthermore, companies were found to be more inclined to address issues linked to spam emails that originate from their compromised computers; however, companies generally fail to respond when they were found to host phishing websites on their servers.
Data for the study was drawn from companies located in Hong Kong, China, Singapore, Macau, Malaysia and Taiwan. The researchers reviewed data relating to each company’s preparedness against two different cybersecurity issues. The first issue was spam emissions; the second was phishing website hosting. Spam relates to unsolicited bulk messages sent out by compromised computers; and phishing relates to the act of fraudulently obtaining sensitive information like passwords or credit card details.
According to researcher Gene Moo Lee: ““For companies hosting phishing websites, there were fewer incentives to crack down on the sites since they were operated by paying customers and the sites failed to negatively impact the company itself.”
The study findings – “Information Disclosure and Security Policy Design: A Large-Scale Randomization Experiment in Pan-Asia” – were recently presented at the Workshop on Economics of Information Security.
