The Effect of a Surveillance Banner in an Attacked Computer System: Additional Evidence for the Relevance of Restrictive Deterrence in Cyberspace

Theodore Wilson, University of Maryland at College Park
David Maimon, Georgia State University
Bertrand Sobesto, University of Maryland at College Park
Michel Cukier, University of Maryland at College Park

To learn more about the Andrew Young School of Policy Studies and Evidence-Based Cybersecurity Reaserch visit https://aysps.gsu.edu/ and https://ebcs.gsu.edu/.

Abstract

Objectives: Test whether the presence of a surveillance message on an attacked computer system influences system trespassers’ active engagement with the compromised system (i.e., entering computer commands). The hypothesized restrictive deterrent effect is tested both in the context of a first system trespassing incident and in the progression of repeated trespassing incidents in an attacked computer system. Methods: We designed a randomized controlled trial and deployed a series of virtual target computers with known vulnerabilities into the computer network of a large public university in the United States. The target computers were set to either display or not display a surveillance banner once system trespassers infiltrated them. Results: We find that the presence of a surveillance banner in the attacked computer systems reduced the probability of commands being typed in the system during longer first system trespassing incidents. Further, we find that the probability of commands being typed during subsequent system trespassing incidents (on the same target computer) is conditioned by the presence of a surveillance banner and by whether commands have been entered during previous trespassing incidents. Conclusions: These findings offer modest support for the application of restrictive deterrence in the study of system trespassing.