Tim:

You're headed in the right direction on this, I think.

The question of data loss leading to a reputational hit and subsequent decrease in share price has been looked at a few times by academics.
The current view seems to be that the damage is real, but short-lived.

However, the entire literature rests on publicly-reported breaches. From an economic perspective this makes sense, particularly if you believe (and it is dogma in some circles) that in a competitive market prices reflect all relevant information about a good.

From an infosec practitioner's standpoint, reliance on current data is unsatisfying, because those data may not (I would say almost certainly do not) represent the actual population of breaches. Thus, we hear only of the more "newsworthy" breaches. It is obvious that the definition of "newsworthy" changes over time, making analysis of trends extremely problematic methodologically.

Cost of recovery, cost of notification, and reputational damage (leading to decreased expected profits and hence a lower share price) all matter analytically, but it's hard for me to get excited about recovery costs unless the means of exposure was such that a zillion endpoints need to be touched to fix it (which I would hope is a rarity). Direct notification costs I have seen estimated at $2 per person (http://www.infopolicy.org/pdf/data-breach.pdf).

I don't know who the main buyers of whole disc encryption gear are, but the "one loss can ruin you" thing makes sense for certain specific cases, like Apple having the iPhone business plan and specs stolen. However, I would argue that instances of that kind of info being handled recklessly are 1) rare and 2) appropriately punished by the market.

The whole "reputational risk" angle misses a rather important point. Sure, if Nokia loses a laptop with a new phone design on it then their shareholders lose. Seems fair to me. However, when a data aggregator loses info about hundreds of thousands of people, those people suffer the injury. The costs of this economic externality need to be accounted for in order for the market to effectively handle this issue. There's a powerful argument to be made that this isn't happening. One reason for that is that we really have no idea how much actual damage the exposure of, say, my SSN and so on, cause me. Maybe my risk of ID theft is increased, but by how much? Nobody really knows, and the information which would help us find out is in private hands. Moreover, it might be embarrassing to reveal it, so it stays locked up.

Sorry for the longwinded comment.

Excellent points Chris, and no need to apologize for the length of the comment.

You said "[I]f Nokia loses a laptop with a new phone design on it then their shareholders lose," but I'm not sure that's a given. To your point, solid data about the conversion of loss to compromise is hard to come by. In fact, something as specific as a phone design would be less likely to move from loss to compromise than a large chunk of SSNs, I would think. The avenues for use of the data would be much more specific and limited.

It's worth mentioning that I think the value of whole disk encryption stands without the specious argument of reputational loss. As you point out, there are cases where specific data is of particular value, but more interesting to me is the potential to recover data from supposedly cleared drives. Perhaps this makes it more important for home users who are less likely to adequately destroy used media.

Imprecise wording on my part. I should have said "at most, their shareholders lose".

Great post, Tim. I had been looking at evaluating a stock's beta before and after a breach as a way to measure the change in a company's weighted-average-cost-of-capital, but found the data inconclusive (and too time consuming ;). Your post made me think: well, a stock can be down only 1.8%, but that means nothing unless you compare it to the market. And that got me thinking about using stock price/sales to show that the companies have to work harder to keep their stock price up, which is somewhat of a proxy for a higher WACC.

I have posted more on my blog: http://www.wikidsystems.com/WiKIDBlog/brand-damage-stock-prices/. (If the trackback worked, then you know this already.)

Nick

A paper presented at FC about 5 years back measured breach v. market prices and concluded that the cost was around 3-4% of the stock price ... but it rebounded shortly after that and the actual cost as measured by the long run stock price was zero. (This from memory...)

Which makes sense. The breach punishment is about perception; once the market assesses the actual likelihood of losses, it realises that they are very low (to the company). So the price rebounds after the initial kerfuffle.

Still, that said, even if we can show the reputational loss as no more than a chimera, there is another force working here in the market for silver bullets: as the only substantial force directing security expenditure is the public perception and reputational punishment of the market, this force drives the internal security model of the company.

In the absence of any good knowledge or analytical tools for security expenditure, on the side of buyers or sellers, then the industry cooperates to create a basket of standard goods. Once the basket is implemented, this grants a status to CSOs of "as good as others."

Hence, the market for silver bullets is characterised by a basket known as best practices which has less to do with own security, and more to do with CYA.

Adam points to a 2006 paper by Acquisti, Friedman, and Telang that says the same thing as my earlier comment on market prices.