+1 (208) 254-6996 [email protected]
  

RESTRICTIVE DETERRENT EFFECTS OF A WARNING 47

Figure 2. Time to System Trespassing Incident Termination— Experiment 2

Don't use plagiarized sources. Get Your Custom Essay on
RESTRICTIVE DETERRENT EFFECTS OF A WARNING 47
Just from $13/Page
Order Essay

0 .2

.4 .6

P ro

po rt

io n

S ur

vi vi

ng

0 10,000 20,000 30,000 Duration

Warning = 0 Warning = 1

0 .2

.4 .6

0 10,000 20,000 30,000 Duration

Warning = 0 Warning = 1

P ro

po rt

io n

S ur

vi vi

ng

(a)

(b)

(a) First trespassing incidents (n = 502) (b) All trespassing incidents (N = 3,768)

target computers. To explore the impact of a warning banner on the hazard of trespassing incident termination, we generated a dummy variable indicating whether a system tres- passing incident was recorded on a warning or no-warning target computer (1 = warning). We then used this measure to estimate its effect on incident survival time using a Cox proportional-hazard regression. The results from this analysis are presented in table 2,

 

 

48 MAIMON ET AL.

Table 2. First System Trespassing Incidents Duration Regressed over Computer System Configurations (Experiment 2, N = 502)

Variables Model 1 Model 2 Model 3

Coefficient Hazard Coefficient Hazard Coefficient Hazard (SE) Ratio (SE) Ratio (SE) Ratio

Warning .20∗ 1.22 .28† 1.32 .32∗ 1.38 (.10) (.14) (.15)

Memory size — — .26 1.30 — — (.14)

Bandwidth size — — — — .14 1.14 (.15)

Warning × Memory — — −.19 .82 — — (.20)

Warning × Bandwidth — — — — −.25 .78 (.20)

Log likelihood −1,928.62∗∗ −1,926.93∗∗ −1,927.88∗∗

ABBREVIATION: SE = standard error. †p < .10 (two-tailed); ∗p < .05 (two-tailed); ∗∗p < .01 (two-tailed).

model 1. As indicated in model 1, our findings confirm that a warning banner in the target computer is positively associated with system trespassing incident termination. Specifi- cally, the hazard ratio estimate of the warning indicator suggests that a warning banner increases the rate of first trespassing incident termination by 22 percent. These findings reaffirm our second research hypothesis and demonstrate that a warning banner reduces the duration of system trespassing incidents on the target computer. Nevertheless, note that the size of the warning effect shrinks considerably in this model and only just reaches statistical significance (p = .05).

Turning to our final research hypothesis, we explore whether computing environments moderate the effect of a warning banner on the hazard of system trespassing incident ter- mination. We first create two dummy measures indicating whether a trespassing incident was recorded on a low- or high-memory target computer (high memory = 1) and whether an incident was recorded on low- or high-bandwidth-connectivity computer (high band- width = 1). We then run two separate Cox models to test for the presence of significant interactive effects between our deterrence (i.e., warning) and computing environment (i.e., memory size and bandwidth capacity) measures on the hazard rate of system tres- passing termination. The results from these analyses are reported in table 2, models 2 and 3. As indicated in model 2, the Cox model estimates reveal an insignificant interactive effect between the warning and memory size on the hazard of first system trespassing in- cidents. Similarly, model 3 reveals that the interaction between the warning banner and the bandwidth size is insignificant on the hazard rate of first trespassing incident termina- tion. These findings stand in contrast to our theoretical expectations and suggest that the effect of a warning banner on the hazard of first system trespassing incident termination is not conditioned by the computing configurations of the target computer.

All Trespassing Incidents

In an effort to estimate the effect of a warning banner on the frequency of re- peated trespassing incidents, as well as assess whether the patterns observed in our

 

 

RESTRICTIVE DETERRENT EFFECTS OF A WARNING 49

Table 3. All System Trespassing Incidents Duration Regressed over Computer System Configurations (Experiment 2, N = 3,768)

Variables Model 1 Model 2 Model 3

Coefficient Hazard Coefficient Hazard Coefficient Hazard (SE) Ratio (SE) Ratio (SE) Ratio

Warning .13† 1.14 .12 1.13 .27∗∗ 1.30 (.07) (.10) (.10)

Memory size — — .11 1.11 — — (.10)

Bandwidth size — — — — .20∗ 1.22 (.10)

Warning × Memory — — .01 1.01 — — (.14)

Warning × Bandwidth — — — — −.29∗ 1.33 (.14)

Theta .23∗∗∗ .23∗∗ .23∗∗ Log Likelihood −16,876.10∗∗ −16,874.60∗∗ −16,873.72∗∗

ABBREVIATION: SE = standard error. †p < .10 (two-tailed); ∗p < .05 (two-tailed); ∗∗p < .01 (two-tailed).

analyses of first trespassing incidents hold across the entire poll of trespassing inci- dents, we rerun our analyses using information from the full sample of trespassing in- cidents collected in the second experiment. Again, we start by determining any significant differences between the number of repeated trespassing incidents recorded on the warn- ing and no-warning computers. The results from a t test for comparing the means of two groups reveal an insignificant difference between the averages of these groups (t = –1.11, p > .05). Specifically, the average number of trespassing incidents that was recorded on the warning and no-warning target computers is almost identical (7.79 on the warn- ing target computers vs. 7.19 on the no-warning computers). Consistent with the find- ings reported in the first experiment, we find no evidence that the presence of a warn- ing banner reduces the frequency of repeated system trespassing incidents on the target computer.

Next, we examine whether warning banners influence the duration of trespassing in- cidents by comparing the survival distributions of all trespassing incidents recorded on the warning and no-warning target computers throughout the experimental pe- riod. Figure 2b presents results from this comparison. At first glance, it seems as though the survival distributions of system trespassing incidents observed on the warn- ing and no-warning target computers are indistinguishable. Nevertheless, across all time points, the proportion of trespassing incidents that survived longer periods of time is smaller on the treatment (warning) than on the control (no-warning) target computers.

To assess the magnitude of a warning banner on the hazard rate of trespassing inci- dent termination, we next estimate a shared-frailty model that accounts for the frailty shared among all repeated trespassing incidents originating on the same target computer. The findings from this analysis are presented in table 3, model 1. As noted in model 1, the presence of a warning banner in the target computer is positively associated with trespassing incident termination. Specifically, the hazard ratio estimate of the warning in- dicator suggests that a warning banner increases the rate of system trespassing incident

 

 

50 MAIMON ET AL.

termination by 14 percent. Nevertheless, the effect of warning is only marginally signifi- cant (p < .10) in this model.

Finally, we employ shared-frailty models to test whether different system configura- tions condition the effect of a warning banner on the hazard rate of system trespassing incident termination. The results from these analyses are presented in table 3, models 2 and 3.9 In model 2, we test the hypothesis that RAM size conditions the effect of a warn- ing banner on the hazard of system trespassing incident survival. As shown in table 3, the interaction between these two measures is insignificant in the model. This finding stands in contrast to our theoretical expectations and suggests that the effect of a warning banner on the hazard of system trespassing incident termination is not conditioned by the RAM size of the target computer.

In model 3, we examine the interactive effect of a warning and bandwidth capacity on the hazard rate of system trespassing incident termination. In line with our research hy- pothesis, the results from this analysis reveal a significant interaction between these two measures (b = –.29, p < .05). Specifically, this finding suggests that the presence of a warn- ing banner in the target computer leads to a slower decay of system trespassing incidents on high-bandwidth-capacity computers than on low-bandwidth-capacity computers. To il- lustrate this point, we calculate the hazard rate of system trespassing incident termination for each possible combination (target computers with no warning and a low bandwidth capacity serve as a reference group), and we plot our results in figure 3. As indicated in the figure, the hazard rate of trespassing incident termination on a low-bandwidth target com- puter with a warning banner is 31 percent. In contrast, the hazard rate of system trespass- ing incident termination on a high-bandwidth-capacity target computer with a warning banner is only 19 percent. These findings indicate that a warning banner produces more deterrence and shorter duration of system trespassing incidents on target computers with a low bandwidth capacity.

DISCUSSION

The heavy reliance of contemporary societies on computers and the Internet has facilitated fertile ground for the development of computer-focused crimes like sys- tem trespassing (Furnell, 2002). Unfortunately, although extensive research has ex- plored technological aspects of system trespassing (Alata et al., 2006; Berthier and Cukier, 2009; Salles-Loustau et al., 2011), until now, only scant attention has been given in the criminological field to the effectiveness of existing cybersecurity measures in deterring unauthorized access to computer systems by system trespassers. Address- ing these theoretical and empirical gaps, we drew on the restrictive deterrence liter- ature (Gibbs, 1975; Jacobs, 2010) and raised hypotheses regarding the effectiveness of a warning message (Geerken and Gove, 1975) in preventing the progression and duration of system trespassing incidents. Four research hypotheses were examined.

9. We also constructed a binary measure indicating whether a trespassing incident was recorded on a low- or high-disk-space target computer (high disk space = 1), and we tested for the presence of significant interactive effects between warning and disk space size on the hazard of system tres- passing incident termination. The first test used information from the first incident only, and the second used info from all trespassing incidents recorded on our systems. The results from these analyses indicated an insignificant interactive effect between these measures on the hazard rate of system trespassing incident termination.

 

 

RESTRICTIVE DETERRENT EFFECTS OF A WARNING 51

Figure 3. Proportional Differences in Hazard Rate of Trespassing Session Termination Relative to No-Warning and Low-Bandwidth Target Computers

1.05

1.15

1.25

1.3

1.35

1

1.1

1.2

Warning

No Warning High Bandwidth

Low Bandwidth

High Bandwidth Low Bandwidth

First, we hypothesized that a warning banner in the target computer could prevent, encourage, or have no effect on the progress of the first system trespassing incident (from a given trespasser) recorded on a target computer. Second, we suspected that the presence of a sanction threat in a target computer would reduce the frequency of repeated system trespassing incidents against the computer. Third, we predicted that the presence of a warning banner in the target computer would decrease the duration of both first and repeated system trespassing incidents. Finally, we hypothesized that large RAM size and high bandwidth capacity on the target computer attenuate the effect of a warning banner on the duration of system trespassing incidents. To test these hypotheses, we employed 1) a large set of target computers built for the sole purpose of being attacked and 2) two randomized experimental designs. The findings from these two independent experiments revealed several consistent and important insights.

Order your essay today and save 10% with the discount code ESSAYHELP