Breaching Together: A Data Science Approach on Firms’ Correlated Risk in Information Security
Rahul Dwivedi, Sridhar Nerur, Jingguo Wang · Journal of the Association for Information Systems · 2018
This study develops a data science approach to measuring business relatedness of firms, with a view to assessing how this measure (of business proximity) is associated with correlated risk of firms experiencing information security breaches.We analyze textual business descriptions and security risk factors from SEC 10-K filing reports of 33 public firms that were breached at the same time in the last 10 years (2008 -2017).Specifically, we use text analysis and topic modeling to come up with a measure of breach proximity.The Quadratic Assignment Procedure (QAP), a well-known technique in social network analysis, was used to test for significance of statistical relationships among the various similarity matrices.In preliminary investigations, we found that dyadic relationships between public firms based on their business descriptions and security risk factors from their 10-K filings is significantly correlated with the dyads based on information security breaches for these public firms.We also found geographic proximity and industry type based on two digits SIC code for industry classification to be significantly correlated with the propensity of firms to be breached together.