4 ms·

> Any idea why these models aren't huge already? People have looked at stock price impact from breaches & vulnerability disclosure before and found only very m

by Eridrus 10y ago

> Any idea why these models aren't huge already? People have looked at stock price impact from breaches & vulnerability disclosure before and found only very mild connections that revert themselves quickly. The only reason it seems to be working now is concentrated media attention, which doesn't seem like a repeatable strategy when the whole medical device sector is a tire fire when it comes to security. After the first few times the stock market should stop reacting to this sort of news.

jhchen 10y ago
Is there a study you can point to? I'd be curious to know the severity of the vulnerabilities. In the past companies have also been able to successfully cover up breaches. The media attention as you point out makes this more challenging, but in the post-Snowden era people are more aware and and concerned about security and privacy and researchers are getting better at explaining/marketing their discoveries (ex. Heartbleed). I can see breaches continue enjoying heightened attention across industries.
dsfyu404ed 10y ago
Tire fire as in it won't stop burning or tire fire as in nobody bothers trying to put it out?
blazespin 10y ago
If they are options expiry it just has to be short term to,make large, leveraged gains. The risk is the business uses capital to acquire stock and defend against these attacks which is the right tactical thing to do. The real danger though is hackers making secret deals with nefarious hedge funds to attack hard so the company can't defend. Can you imagine if someone made a wide scale assault against a company who's revenue was based purely on its cloud revenue?
- pliny 10y ago
  >The risk is the business uses capital to acquire stock and defend against these attacks which is the right tactical thing to do. The right tactical thing to do is for the company to manipulate it's own share price, so that after news breaks that they're selling defective products their share price won't go down? >The real danger though is hackers making secret deals with nefarious hedge funds to attack hard so the company can't defend. Can you imagine if someone made a wide scale assault against a company who's revenue was based purely on its cloud revenue? That might be 'a' real danger, but what you're describing is already illegal and it also doesn't require a hedge fund, you can just demand money directly from the company because you're already committing a crime. What happened in this case is that a hedge fund made a deal with a firm that did research into a company's products and found that they were defective, the disclosure and the impact of the disclosure on the share price is the best possible outcome.
  - blazespin 10y ago
    Wow, no. Of course a company will buy its shares if it sees it irrationally going down. Especially in terms of a vuln which could impact its rep. Finally you want to discourage hackers from profiting off,of,this nonsense. Blackmailing a company directly is near impossible. Secret deals with a hedge fund are hard to track.
    - jessaustin 10y ago
      Of course a company will buy its shares if it sees it irrationally going down. Well maybe if they have a load of extra cash laying around. If they're in the midst of a big recall while trying to keep the rest of the business going, that may not be the case.
- deleted 10y ago
  [deleted]
SCHiM 10y ago
It don't think it will work this way. The difference is because medical devices that contain known vulnerabilities can't just remain operating like a movie studio or cheat-dating-site can. Therefore publishing truly critical vulnerabilities will always have an effect on the company's stock, because more than just reputation is on the line.
- tptacek 10y ago
  Three things I can think of that make medical device vulnerabilities more costly than in other verticals: 1. The market is already geared to punish recalls. 2. Recalls, in some limited cases, can be very costly (for instance: in the very few cases in which hardware must be replaced, you may directly incur nosebleed-expensive medical bills). 3. The tort liability that comes from directly hurting people. But mitigating these points: 1. Hack-and-short is only really interesting if it can be applied repeatedly. Routinizing the kinds of recalls needed to fix vulnerabilities will probably recondition the markets away from punishing these kinds of recalls. 2. Most vulnerabilities, even the most serious ones, don't incur hardware-replacing vulnerabilities. 3. In most (but not all) cases, a human death from a software flaw in a medical device will require deliberate action from, well, a murderer. Which is to say: these kinds of torts are unlikely to be common. Not that I believe that, were a button made available to 8chan that would enable them to kill people on a whim, it wouldn't be pushed regularly! Rather: it's very unlikely such a button will be created at all.
- SixSigma 10y ago
  Have a read through this year's http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/ucm480134.htm http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/ucm48...

by Eridrus 10y ago

jhchen 10y ago

Is there a study you can point to? I'd be curious to know the severity of the vulnerabilities. In the past companies have also been able to successfully cover up breaches. The media attention as you point out makes this more challenging, but in the post-Snowden era people are more aware and and concerned about security and privacy and researchers are getting better at explaining/marketing their discoveries (ex. Heartbleed). I can see breaches continue enjoying heightened attention across industries.

dsfyu404ed 10y ago

Tire fire as in it won't stop burning or tire fire as in nobody bothers trying to put it out?

blazespin 10y ago

If they are options expiry it just has to be short term to,make large, leveraged gains. The risk is the business uses capital to acquire stock and defend against these attacks which is the right tactical thing to do. The real danger though is hackers making secret deals with nefarious hedge funds to attack hard so the company can't defend. Can you imagine if someone made a wide scale assault against a company who's revenue was based purely on its cloud revenue?

pliny 10y ago
>The risk is the business uses capital to acquire stock and defend against these attacks which is the right tactical thing to do. The right tactical thing to do is for the company to manipulate it's own share price, so that after news breaks that they're selling defective products their share price won't go down? >The real danger though is hackers making secret deals with nefarious hedge funds to attack hard so the company can't defend. Can you imagine if someone made a wide scale assault against a company who's revenue was based purely on its cloud revenue? That might be 'a' real danger, but what you're describing is already illegal and it also doesn't require a hedge fund, you can just demand money directly from the company because you're already committing a crime. What happened in this case is that a hedge fund made a deal with a firm that did research into a company's products and found that they were defective, the disclosure and the impact of the disclosure on the share price is the best possible outcome.
- blazespin 10y ago
  Wow, no. Of course a company will buy its shares if it sees it irrationally going down. Especially in terms of a vuln which could impact its rep. Finally you want to discourage hackers from profiting off,of,this nonsense. Blackmailing a company directly is near impossible. Secret deals with a hedge fund are hard to track.
  - jessaustin 10y ago
    Of course a company will buy its shares if it sees it irrationally going down. Well maybe if they have a load of extra cash laying around. If they're in the midst of a big recall while trying to keep the rest of the business going, that may not be the case.
deleted 10y ago
[deleted]

SCHiM 10y ago

It don't think it will work this way. The difference is because medical devices that contain known vulnerabilities can't just remain operating like a movie studio or cheat-dating-site can. Therefore publishing truly critical vulnerabilities will always have an effect on the company's stock, because more than just reputation is on the line.

tptacek 10y ago
Three things I can think of that make medical device vulnerabilities more costly than in other verticals: 1. The market is already geared to punish recalls. 2. Recalls, in some limited cases, can be very costly (for instance: in the very few cases in which hardware must be replaced, you may directly incur nosebleed-expensive medical bills). 3. The tort liability that comes from directly hurting people. But mitigating these points: 1. Hack-and-short is only really interesting if it can be applied repeatedly. Routinizing the kinds of recalls needed to fix vulnerabilities will probably recondition the markets away from punishing these kinds of recalls. 2. Most vulnerabilities, even the most serious ones, don't incur hardware-replacing vulnerabilities. 3. In most (but not all) cases, a human death from a software flaw in a medical device will require deliberate action from, well, a murderer. Which is to say: these kinds of torts are unlikely to be common. Not that I believe that, were a button made available to 8chan that would enable them to kill people on a whim, it wouldn't be pushed regularly! Rather: it's very unlikely such a button will be created at all.
SixSigma 10y ago
Have a read through this year's http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/ucm480134.htm http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/ucm48...