Brand Damage, Stock Price and Cockroaches

Yesterday, Tim Erlin had an interesting and very thought provoking post about breach and brand damage.. Tim rightly takes offense at the idea of the infinite "brand damage" often used to sell information security products. With as little as infosec geeks know about marketing, it's probably best to avoid that phrase altogether. A "brand" is a nebulous idea at best and security probably does not matter at all in most brands. I think it is also hard to try to tie stock performance to brand value. There a lots of great stocks that sell commodity goods. If Exxon/Mobil had a security breach when oil was at $30/barrel, how would you measure the impact of the breach as oil goes to $60?

My theory is that information security breaches are an indicator of a lack of management competence. Moreover, as discussed previously, information security breaches are like cockroaches, they rarely travel alone and seeing one guarantees there are more that can't be seen. The question becomes: does the bad security mean bad security, or bad management?

The impact of information security breaches on stock prices should also vary by industry. Choicepoint's business depends on its network and ability to securely deliver data. Ameriprise needs to convince users that it is as secure as talking to broker. For TJX, purchasing, marketing and inventory turnover are probably more important. Still just looking at the stock price is not enough. You need to look at what it takes the company to maintain that stock price and you need to compare the stock to the return you could have had in the less-risky stock market (in this case the S&P500).

Looking at Tim's data again in this light points out a few things. While ADP's stock was up 2.72% in the 6 month's after the breach, the market was up 7.69% and it took ADP 8% more revenue to get that 2.72% rise in stock price. Choicepoint's stock was only down 1.8%, but the market was up 4.23% in the same period - and CPS's revenue was up 2% in that period (roughly that period, I used the quarterly report numbers). Looking the stock/revenue numbers shows the extra effort needed to maintain stock price.

Tim's post struck a chord with me because it was something I was chewing on for a while. I had done some digging to see if a stock's beta, which is supposed to represent its riskiness relative to the market was a good way to see if a security breach raised the weighted average cost of capital for a company, but beta is problematic in a number of ways. I think Tim would agree that this handful of stocks does not a study make. I would also point out that I really didn't have time to dig too far into this. The revenue numbers are quarterly numbers from MSN finance and I just choose the quarter in which the month fell. This also does not include added investment. For example, if a company has to invest additional capital to secure itself and that results in no additional revenue, that is not reflected here.