Empirically Evaluating the Effect of Security Precautions on Cyber Incidents

Neil Gandal, Tyler Moore, Michael Riordan and Noa Barnir

No 17605, CEPR Discussion Papers from Centre for Economic Policy Research

Abstract: To the best of our knowledge, there is no econometric evidence to show that firm investment in cybersecurity defenses reduces the likelihood of a cyber incident. Instead, the available data often exhibits a positive correlation between investment in security precautions and incidents. This is because many such investments are made ex post, i.e., after a firm has suffered a cyber incident. The Israel National Cyber Directorate (INCD) and the Israeli Central Bureau of Statistics (CBS) recently surveyed Israeli firms about their ICT operations including cyber defenses and cyber incidents. We overcome the endogeneity “obstacle†using an instrumental variable drawn from questions about a cybersecurity directive. The resulting regressions enable us to examine the causal relationship between security precautions potentially undertaken by enterprises and the likelihood of experiencing a cyber incident. Once suitably instrumented, we find robust evidence that increased adoption of security controls does in fact reduce the likelihood of experiencing a cyber incident or breach.

Keywords: Empirical (search for similar items in EconPapers)
JEL-codes: D22 (search for similar items in EconPapers)
Date: 2022-10
References: Add references at CitEc
Citations:

Downloads: (external link)
https://cepr.org/publications/DP17605 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:cpr:ceprdp:17605

Ordering information: This working paper can be ordered from
https://cepr.org/publications/DP17605

Access Statistics for this paper

More papers in CEPR Discussion Papers from Centre for Economic Policy Research 33 Great Sutton Street, London EC1V 0DX, UK.
Bibliographic data for series maintained by CEPR ().