Binghamton University researcher Ali Yayla looks at companies’ announcements regarding IT security breaches and how these announcements affect their stock price. “In the past, these announcements used to have a more negative effect,” says Yayla, an assistant professor in the School of Management. “Now, the public is getting used to these security breaches. It’s just another normal part of business. Organizations lose data.”

Still, such attacks are far more widespread than customers generally believe, Yayla says. For one thing, companies themselves sometimes don’t know they’ve been attacked. Others are aware of a security breach but choose not to announce it, although this trend is changing slowly for two reasons: First, consider how tough it would be to keep an attack a secret if it results in a bank issuing new account numbers to a million customers. Second, while there isn’t any rule that says they must announce every attack, new regulations mandate that companies disclose any breach of confidential data to affected parties.

There are, of course, different kinds of breaches: A hacker may gain access to customer information, steal proprietary information or attack a website. The worst, Yayla has found, is a so-called “denial of service” attack, in which a website is shut down and customers are unable to access to the website for some period of time. They’re far more public and disruptive than other attacks. If the company doesn’t do a lot of business online, a denial of service attack may not be a huge problem. For e-commerce firms such as Amazon or eBay, however, even a short amount of downtime is a significant problem.

Calculating the costs of these attacks is difficult, when you consider the potential for damaged reputations and loss of customer loyalty. That’s why Yayla’s research has focused on changes in market value. As investors become less sensitive to such attacks, however, he’s looking for new ways to quantify the impact of information security issues.

In Yayla’s latest work, he tries to establish whether companies that experience security breaches are less successful than those that do not. Instinctively, it would seem that having secure IT is a competitive advantage, he says.

Yayla, who’s from Istanbul, Turkey, earned his doctorate in management information systems from Florida Atlantic University and received a master’s degree from Duquesne University. He did his undergraduate work at Istanbul Technical University. In addition to information security, his research interests include strategic use of IT in companies, mostly focusing on the alignment of IT strategy with business strategy, as well as designing appropriate compensation for chief information officers.

The next few years will see new types of IT security breaches, Yayla says, citing concerns about mobile banking and “social engineering” attacks in which someone is manipulated into disclosing sensitive information.

“Basically, the more information we store, the more we have to lose,” he says. “With smart phones, we are even more open to attacks. Mobile applications are not as secure. In the near future, we’ll be paying for products and services with our phones. What happens when we lose a smart phone that has direct access to our bank?”

Doctoral student Tomas Filler and visiting scholar Jan Judas, under the guidance of Jessica Fridrich, professor of electrical and computer engineering in the Thomas J. Watson School of Engineering and Applied Science, earned the top spot for their paper. According to the alliance, it demonstrated the highest level of originality, creativity, clarity and potential impact on the field of watermarking.

Announced at the IS&T/SPIE Electronic Imaging Conference held Jan. 23 – 27, the winning team received a cash prize of $1,500, and their paper will be publicized in this year’s conference proceedings.

The Binghamton University team’s winning paper, titled “Minimizing Embedding Impact in Steganography using Trellis-Coded Quantization,” proposed and developed a practical algorithm to minimize the average embedding distortion in steganography.

Serving as a modern-day version of writing with invisible ink, steganography enables additional hidden information to be exchanged during regular communication without anyone knowing. In today’s world of technology, this means hiding secret communication data in digital media files.

“A digital picture of a dog may contain an entire PDF document even though the image itself may look completely innocuous to most people,” said Fridrich. “I like to call this research a ‘Swiss-Army Knife’ for steganographers. It’s a very general and elegant framework to build stego systems that work in the best possible way and hide the maximum amount of information, without creating any artifacts that someone might use to find out that secret communication is taking place.”

Fridrich said the research also extends to what is referred to as a “lossy” compression of data, an example of which is the commonly used JPEG image format. Lossy allows a user to store an image in a compact size at the price of slightly distorting it.

“Our paper describes a method that could be used to optimally encode the image so that we could get the smallest sized file possible,” Fridrich said. “And the way to do that is by allowing each pixel in the image to be distorted by a specified amount.”

A leading authority in the field of steganography, Fridrich credits Filler for helping the team achieve this honor. “The research was conceived by Tomas and he deserves all the accolades,” Fridrich said. “He is an unbelievably brilliant student who has made numerous contributions and revolutionized the field.”

This is the second time Fridrich and Filler have received the alliance’s top recognition. They were both members of the 2009 Best Paper award-winning team that was honored for theoretical work on secure capacity of practical stego systems.