Empirically Evaluating the Effect of Security Precautions on Cyber Incidents

Neil Gandal, Tyler Moore, Michael Riordan and Noa Barnir

No 17605, CEPR Discussion Papers from C.E.P.R. Discussion Papers

Abstract: To the best of our knowledge, there is no econometric evidence to show that firm investment in cybersecurity defenses reduces the likelihood of a cyber incident. Instead, the available data often exhibits a positive correlation between investment in security precautions and incidents. This is because many such investments are made ex post, i.e., after a firm has suffered a cyber incident. The Israel National Cyber Directorate (INCD) and the Israeli Central Bureau of Statistics (CBS) recently surveyed Israeli firms about their ICT operations including cyber defenses and cyber incidents. We overcome the endogeneity “obstacle†using an instrumental variable drawn from questions about a cybersecurity directive. The resulting regressions enable us to examine the causal relationship between security precautions potentially undertaken by enterprises and the likelihood of experiencing a cyber incident. Once suitably instrumented, we find robust evidence that increased adoption of security controls does in fact reduce the likelihood of experiencing a cyber incident or breach.

Keywords: Empirical (search for similar items in EconPapers)
JEL-codes: D22 (search for similar items in EconPapers)
Date: 2022-10
References: Add references at CitEc
Citations:

Downloads: (external link)
https://cepr.org/publications/DP17605 (application/pdf)
CEPR Discussion Papers are free to download for our researchers, subscribers and members. If you fall into one of these categories but have trouble downloading our papers, please contact us at subscribers@cepr.org

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:cpr:ceprdp:17605

Ordering information: This working paper can be ordered from
https://cepr.org/publications/DP17605

Access Statistics for this paper

More papers in CEPR Discussion Papers from C.E.P.R. Discussion Papers Centre for Economic Policy Research, 33 Great Sutton Street, London EC1V 0DX.
Bibliographic data for series maintained by ().