The vulnerability patch R&D has become an important part of information security governance. An effective collaboration with software vendors in patch R&D is of great significance to reduce the existence time of information security risks. This works aims to explore the relationship between vulnerability information disclosure and patch R&D of software vendors. The data regarding the vulnerability and software vendors is gathered from third-party vulnerability sharing platforms, including (China’s national information security vulnerability database, CNNVD) and Tianyacha.com. Based on the theory of organizational information processing, linear regression model and Cox proportional risk regression model are built for appropriately addressing the research questions. The results show that the vulnerability disclosure of the third-party sharing platform can improve the patch R&D probability of software vendors. The information processing requirements, such as vulnerability information attention, vulnerability score and whether vulnerabilities are disclosed in advance accelerate the vulnerability patch R&D. The enterprise information processing capability indicators, including the industry dependence of software product customers and the staff size of software vendors accelerate the patch R&D. The number of products affected by the vulnerabilities and the number of software copyrights of software vendors have no significant impact on patch R&D.
ShostackA., Quantifying patch management, Secure Business Quarterly2 (2003), 1–4.
2.
CavusogluH., CavusogluH. and RaghunathanS., Efficiency of vulnerability disclosure mechanisms to disseminate vulnerability knowledge, IEEE Transactions on Software Engineering3 (2007), 171–185.
3.
DaceyR.F. Information Security: Effective Patch Management is Critical to Mitigating Software Vulnerabilities, Gao Reports. 2003.
4.
CavusogluH., CavusogluH. and ZhangJ., Security patch management: share the burden or share the damage, Management Science4 (2008), 657–670.
5.
LaaksoM., TakanenA., RöningJ. The vulnerability process: A tiger team approach to resolving vulnerability cases, Proceeding of 11th First Conf, Computer Security Incident Handling and Response. 1999.
6.
TangM., AlazabM., LuoY. Exploiting vulnerability disclosures: statistical framework and case study, Proceeding of Cybersecurity and Cyberforensics Conference (CCC). 2016, 117–122.
7.
RescorlaE., Is finding security holes a good idea, IEEE Security & Privacy3 (2005), 14–19.
8.
AlhazmiO.H., MalaiyaY.K. Quantitative vulnerability assessment of systems software, Proceeding of Annual Reliability and Maintainability Symposium 2005, 615–620.
9.
ShrivastavaA.K., SharmaR., KapurP.K. Vulnerability discovery model for a software system using stochastic differential equation, Proceeding of International Conference on Futuristic trend on Computational Analysis and Knowledge Management 2015, 199–205.
10.
SoodA.K. From vulnerability to patch: the window of exposure, Network Security 2009, 14–16.
11.
BeattieS., ArnoldS., CowanC., WagleP. and WrightC., Timing the application of security patches for optimal uptime, LISA2 (2002), 233–242.
12.
KannanK. and TelangR., Market for software vulnerabilities? think again, Management Science5 (2005), 726–740.
13.
TelangR. and WattalS., An empirical analysis of the impact of software vulnerability announcements on firm stock price, IEEE Transactions on Software Engineering8 (2007), 544–557.
14.
OkamuraH., TokuzaneM., DohiT. Optimal security patch release timing under non-homogeneous vulnerabilitydiscovery processes, 2009 20th International Symposium on Software Reliability Engineering 2009, 16–19.
15.
KansalY. Assessing optimal patch release time for vulnerable software systems, Proceeding of 2016 International Conference on Innovation and Challenges in Cyber Security (ICICCS-INBUSH) 2016, 308–314.
16.
AroraA., KrishnanR., TelangR. and YubaoY., An empirical analysis of software vendors’ patch release behavior: impact of vulnerability disclosure, Information Systems Research1 (2010), 115–132.
17.
AroraA. and TelangR., Economics of software vulnerability disclosure, IEEE Security & Privacy1 (2005), 20–25.
18.
JohnsonP., GortonD., LagerströmR. and EkstedtM., Time between vulnerability disclosures: A measure of software product vulnerability, Computers & Security62 (2016), 278–295.
19.
KansalY., KapurP.K. and KumarU., Coverage-based vulnerability discovery modeling to optimize disclosure time using multiattribute approach, Quality & Reliability Engineering International1 (2019), 62–73.
20.
RuohonenJ., HyrynsalmiS. and LeppänenV., A mixed methods probe into the direct disclosure of software vulnerabilities, Computers in Human Behavior103 (2020), 161–173.
21.
PremkumarG., RamamurthyK. and SaundersC.S., Information processing view of organizations: an exploratory examination of fit in the context of interorganizational relationships, Journal of Management Information Systems1 (2005), 257–294.
22.
ManiD., BaruaA. and WhinstonA., An empirical analysis of the impact of information capabilities design on business process outsourcing performance, Mis Quarterly1 (2010), 39–62.
23.
TushmanM.L. and NadlerD.A., Information Processing as an Integrating Concept in Organizational Design, Academy of Management Review3 (1978), 613–624.
24.
BeckersK., CôtéI. and Faßbender,S., A pattern-based method for establishing a cloud—specific information security management system, Requirements Engineering4 (2013), 343–395.
25.
SinhaM. and GilliesA., Improving the quality of information security management systems with ISO27000, The TQM Journal4 (2011), 367–376.
26.
ManiD., BaruaA. and WhinstonA., An empirical analysis of the impact of information capabilities design on business process outsourcing performance, MIS Quarterly1 (2010), 39–62.
27.
DeyD., LahiriA. and GuoyingZ., Optimal policies for security patch management, INFORMS Journal on Computing3 (2015), 462–477.
28.
TakanenA., VuorijaerviP. and LaaksoM., Agents of responsibility in software vulnerability processes, Ethics and Information Technology6 (2004), 93–110.
29.
RansbothamS., MitraS. and RamseyJ., Are markets for vulnerabilities effective?Mis Quarterly1 (2008), 43–64.
30.
ChenP., KatariaG. and KrishnanR., Correlated failures, diversification, and information security risk management, MIS Quarterly2 (2011), 397–397.
31.
AmatyaA., Review: understanding open source software development, ITNOW1 (2018), 31.
32.
GarciaA. and ShenJ., Dynamic platform competition with malicious users, Dynamic Games Appl4 (2014), 290–308.
33.
GordonL.A., LoebM.P. and SohailT., Market value of voluntary disclosures concerning information security, MIS Quarterly3 (2010), 562–567.
34.
AhmedA., DeokarA. and LeeH.C.B., Vulnerability disclosure mechanisms: A synthesis and framework for market-based and non-market-based disclosures, Decision Support Systems1 (2021), 1–13.
35.
AroraA., TelangR. and HaoX., Optimal policy for software vulnerability disclosure, Management Science4 (2008), 642–656.
36.
FengG., ZhengM., WenJ. and ZhangC., What determines the Chinese firms’ technological innovation——A re-empirical investigation based on the previous empirical literature of nine chinese economics top journals and a-share listed company data, China Industrial Economics1 (2021), 17–35.
37.
LeeC.Y., Firm density and industry R&D intensity: theory and evidence, Review of Industrial Organization2 (2003), 139–158.
38.
HardingR., Evolution, path dependence, learning and innovation: a review of four recent books, Minerva3 (2002), 289–299.
39.
BooyensI., Are small, medium- and micro-sized enterprises engines of innovation? the reality in South Africa, Science & Public Policy (SPP)1 (2011), 67–78.
40.
ZhangJ. and LuoS., Impact of the components of open business model on two-stage innovation performance of financial technology enterprises, R&D Management6 (2020), 152–164.
41.
TelangR. and WattalS., An empirical analysis of the impact of software vulnerability announcements on firm stock price, IEEE Transactions on Software Engineering3 (2007), 544–557.
42.
AroraA., KrishnanR. and TelangR., An empirical analysis of software vendors’ patch release behavior: impact of vulnerability disclosure, Information Systems Research1 (2010), 115–132.
43.
PremkumarG., RamamurthyK. and SaundersC.S., Information processing view of organizations: an exploratory examination of fit in the context of interorganizational relationships, Journal of Management Information Systems22 (2005), 257–294.
44.
AroraA. and TelangR., Economics of software vulnerability disclosure, IEEE Security & Privacy1 (2005), 20–25.
45.
AroraA., NandkumarA. and TelangR., Does information security attack frequency increase with vulnerability disclosure? An empirical analysis, Information Systems Frontiers5 (2006), 350–362.
46.
AllodiL. and MassacciF., Comparing vulnerability severity and exploits using case-control studies, Acm Transactions on Information & System Security1 (2014), 1–20.
47.
LimD.E. and KimT.S., Modeling discovery and removal of security vulnerabilities in software system using priority queueing models, Journal of Computer Virology & Hacking Techniques2 (2014), 109–114.
48.
LiuB., LiangS., CaiZ. et al., Software vulnerability discovery techniques: a survey, IEEE (2012), 152–156.
49.
MassacciF. and NguyenV.H., An empirical methodology to evaluate vulnerability discovery models, Software Engineering IEEE Transactions on12 (2014), 1147–1162.
