Physical Sciences and Mathematics Commons^™

Does Reputational Sanctions Deter Negligence In Information Security Management? A Field Quasi-Experiment, Qian Tang, Andrew B. Whinston

Research Collection School Of Computing and Information Systems

Security negligence, a major cause of data breaches, occurs when an organization’s information technology management fails to adequately address security vulnerabilities. By conducting a field quasi-experiment using outgoing spam as a focal security issue, this study investigates the effectiveness of reputational sanctions in reducing security negligence in a global context. In the quasi-experiment, a reputational sanction mechanism based on outgoing spam was established for four countries, and for each country, reputational sanctions were imposed on the 10 organizations with the largest outgoing spam volumes—that is, these organizations were listed publicly. We find that because of our reputational sanction mechanism, organizations …