Young People s Security Behavior Intentions regarding Cloud Service Use: Suggestions

Transcription

1 Young People s Security Behavior Intentions regarding Cloud Service Use: Suggestions for Better Cloud Services P.I.M. Kamphuis pim.kamphuis@gmail.com P.I.M. Kamphuis (BA in Communication, Fontys, Tilburg the Netherlands 2015) is a graduate student at the Department of Interaction Science, Sungkyunkwan University, South Korea and currently working as a freelance cloud consultant (CoCreatures, 2014). His research interests include cloud computing, cloud security and global collaboration networks and platforms. He is currently involved with living labs - collaboration projects connecting universities, local governments and companies in South Korea and the Netherlands. Jang Hyun Kim jangkimuh@gmail.com Dr. Jang Hyun Kim (Ph.D. in Communication, State University of New York at Buffalo, 2007) is an Associate Professor and Department Chair of Department of Interaction Science, Sungkyunkwan University, South Korea. His research interests include data science, social and semantic network analysis, Internet of things, and other advanced technologies and, in particular, their impact on society. He also teaches user experiences and media management, media contents analysis using big data analysis, and other courses. 1

2 Abstract The purpose of this study is to measure intended security behaviors of university students using personal cloud services in Korea and the Netherlands, to examine what attitudinal factors influence these intentions and to find out if there is a difference in security intentions between Korean and Dutch students. The Theory of Planned Behavior (TPB) model is combined with external constructs from the Security Behavior Intention Scale (SeBIS) about security intentions of students cloud access devices. A questionnaire set comprising three TPB factors and four SeBIS factors was applied to a sample of 226 higher education students in Korea and the Netherlands. Results show that the students intention on securing cloud access devices (CADs) is found and that the two groups differ in terms of the TPB constructs and the actual security intention are significant. Key words: Cloud services, cross-cultural research, Theory of Planned Behavior, Security Behavior Intention Scale, user analysis, survey. 2

3 Introduction Emerging cloud services have been changing the ways in which people store, access and share their personal information. It also changed the way of communicating with each other; shifting from device storage based messaging techniques such as SMS and , to cloud-based messaging services like Facebook messenger, KakaoTalk, Gmail, and Telegram. Most cloud messaging service like Gmail, Outlook.com, and Naver offer free access to a cloud storage pool where users can store files including documents, pictures, and movies. In addition to free cloud storage that is offered by cloud messaging services, the popularity of dedicated cloud storage services like Dropbox and Mega keeps increasing. According to Gartner (2012), users will store over 36% of their personal data in the cloud in Students take a big share in worldwide users of personal cloud services (Hunsinger & Corley, 2012). They store and share their personal data using a cloud access device and often prefer to use their personal cloud storage account over the use of storage and sharing services that are provided by universities (Stantchev, Colomo-Palacios, Soto-Acosta, & Misra, 2014). To keep their data safe and confidential, users should take care of their credentials and devices. It is however questionable to what extend students intent to do so. In this study, we will examine students intention on securing their personal cloud accounts and cloud access devices and apply the Theory of Planned Behavior to see what factors influence this intention. The paper is structured as follows. The next section presents the literature and theories that form the framework for the study. Following that, the method for sampling and data collection is discussed. Finally, this paper ends/concludes with an analysis on the results and a discussion on the research findings. 3

4 Theoretical Approaches to Cloud Use Personal Cloud Services Personal cloud services facilitate highly scalable storage for end-users on demand, which is accessible globally at any time. Using cloud storage increases usability, since users do not have to drag and drop files to and from physical storage media (like USB flash drives); decreases the amount of data/bandwidth used when sharing media (a link to the shared cloud storage location will do); increases accessibility (files can be stored and accessed from anywhere as long as connected to the internet); can be used for disaster-recovery (no files will be lost in case of a stolen, broken or crashed device); and can save users costs for local storage since cloud storage is available from 3 cents per gigabyte and does not require local power to store information remotely (NT, 2014). One of the reasons for the rapid growth in availability and popularity of personal cloud services is the emergence of (smart) devices that provide access to personal cloud storage and services. Mobile devices that enable access to cloud services (e.g. laptops, tablets, and smartphones) became an essential part of modern life and are effective communication tools that are not bounded by time and place. However, the smaller and more portable the form factor, the less resources (e.g. battery capacity, cpu power and storage) it provides. Personal cloud services help users overcome these limitations, including (1) extending battery lifetime, (2) improving battery power, and (3) battery reliability. Battery life is one of the biggest concerns of smart phone users. Personal cloud services provide a variety of computation offloading techniques to use less CPU power, which results in longer battery life. In addition, improving data storage capacity and processing power is another way to enhance usability. Personal cloud services enable users to store and access a large amount of data in the cloud. The latest development in mobile devices includes the embedding and improvement of 4

5 camera modules and thus increases the demand for storage of high quality media such as video and pictures. Uploading media to the cloud right after the moment of capturing saves users a considerable amount of battery power and local storage, and they may access all media from any device instantly. Improving reliability is possible because personal cloud services store data on a spread grid of computers and take care of back-ups. Users can improve the reliability of their files and media by uploading their date to the cloud. This reduces the chances of loss of valuable personal data like pictures, videos, documents and other data in case of broken, lost or infected CADs (Dinh, Lee, Niyato, & Wang, 2013). To use a personal cloud services, users usually have to go through an identification and authentication process to gain access to their account or to create a session for an app (or apps) for easy and permanent use through CAD. The most common authentication mechanism is the use of credentials in the form of a combination of user ID and password. While most websites automatically end the session (log out) after closing the web browser or tab, dedicated cloud service apps installed on smartphones and tablets keep a session active/open until the user logs out or disables/uninstalls the application (Bang, Lee, Bae, & Ahn, 2012). Because of software to has the tendency to save credentials in web browsers and the emergence of apps that serve a permanent connection, special attention is required to securing cloud access devices in order to keep personal data safe and confidential. Security Intention Previous research on securing personal cloud services has focused on a wide range of technical aspects and concerns. Access security measures are generally considered in three steps: Authentication, Authorization, and Encryption (Yahya, 2015). However, Bang et al. (2012) suggest that cloud security is not merely a technical issue but also involves the behavior 5

6 of end-users, which are mostly users with a non-technical background and therefore low technical knowledge. Many scholars try to understand users security related behaviors or emphasize on security-enhancing actions, mostly in work environment settings. However, unlike employees, students are usually not provided with training or protection by an ITdepartment regarding the security of their online accounts. And despite the plethora of advice by all usable security and privacy communities, much of the advice stays unnoticed or ignored by the majority of the personal cloud service users (Das, 2016). In this paper, the intentions of students on securing their personal cloud service accounts are measured using the Security Intention Behavior Scale, and studied by applying the Theory of Planned Behavior in order to find out what attitudinal factors influence these intentions. Theory of planned behavior (TPB) According to the Theory of Planned Behavior, attitudes towards intention derive from behavioral beliefs that people hold (Ajzen, 1985;1991). The TBP suggests that behaviors with a desirable outcome are valued with a positive attitude, while negative attitudes address undesirable behaviors. The TPB model suggests three major factors that determine behavioral intentions (see figure 1): Attitudes: beliefs about consequences of the behavior and the corresponding judgments about these consequences. Simply put, students judgement that performing the behavior is good or bad. Subjective norms: beliefs about how other people, who are considered important to the person, would like them to behave and the motivation to comply with those normative beliefs. 6

7 Perceived behavior control: beliefs about factors that make it ease or difficult to perform the behavior and the corresponding power of these factors to influence the behavior (Ajzen, 1991). FIGURE 1 SIMPLIFIED ILLUSTRATION OF TPB MODEL AND SEBIS IMPLICATION Figure 1 illustrates the model for this paper and shows a simplified model of TPB and SeBIS. The TPB is devoted to identifying barriers and enablers to behavioral intentions and therefore an useful approach on explaining students security intentions. The theory can help to explain why students have high or low intentions on securing their cloud access devices, because it offers a clearly defined structure/model that allows the investigation of attitudinal factors. In addition, knowledge alone is not effective in changing behavior. When we understand the predictors of students security intention we can fine-tune campaigns to aim at attitudes, subjective norms or perceived behavior control in order to raise security on students cloud access devices. A review by East (1997) has indicated that, in recent years, the TPB has been applied to a wide variety of topics (e.g. physical activities, quitting cigarette smoking, blood donation, complaining, Internet use etc.) and that the model has provided reliable estimates. 7

8 The study focuses particularly upon the case of university students in Korea and the Netherlands, these countries are one of the most advanced countries with respect to the adoption and use of new communication technologies (Park, Kim, Shon, & Shin, 2013). According to Statista (2016), both Korea and the Netherlands top the list of countries with the largest share of high broadband connectivity and the list of countries with the highest average internet connection speed. This makes the use of personal cloud services enjoyably fast and a convenient way for students to safely store, share and collaborate on their personal and academic documents (Stantchev, Colomo-Palacios, Soto-Acosta, & Misra, 2014). Research question and hypotheses This study aims to examine the following research questions: RQ 1. What is the student s intention on securing their cloud access devices? RQ2. What factors influence students intention on securing their cloud access devices? H1. Students attitude influence intention on securing CADs. H2. Students subjective norms influence intention on securing CADs. H3. Students perceived behavior control influence intention on securing CADs. RQ3. Is there a significant difference between Korean and Dutch students on their intention to secure cloud access devices? The questions and hypotheses above are addressed in the following sections. Method and procedures The sample for this study consists of 226 students (n = 226), of which 120 were studying at a Korean university (53%) while the other 106 were studying in the Netherlands (47%). Most respondents are in the age between 21 and 26 (74.8%). A minority of the students 8

9 was younger than 21 (8%) and 39 respondents were older than 26 (17.3%). The sample included 139 women (61.5%) and 87 men (38.5%). An on-line survey was operationalized using Google Forms and administered via a short notice with hyperlink on both universities students portal. In the survey, respondents were asked questions which operationalized the Theory of Planned Behavior and items as applied to the Security Behavior Intention Scale. Recorded on a scale, their answers represent the salient believes answered about attitude, subjective norms and perceived behavior control and intentional behavior on device securement, password generation, proactive awareness and software updating. All questions were marked as required and the form could not be submitted without incomplete answers. Because of this, the dataset with responses does not include any invalid or uncomplete records. This was all done during the end of fall semester of The responses were collected during a one-week period. After this, the raw data from the questionnaires was exported from Google Forms, coded in Microsoft Excel and then analyzed using IBM SPSS. While this sampling strategy has clear advantages in terms of time- and cost-savings, as suggested by Margaryan, Littlejohn, and Vojt (2011), it does not account for the total number of potential participants, although it can be considered with enough statistical power given the total sample size. Security Intention Behavior Scale In 2015 Egelman and Peer developed the Security Intention Behavior Scale (SeBIS), a tool to measure security behaviors of end-users. In short, the scale measures users selfreported adherence to computer security advice and consists of 16 items that measure 4 underlying constructs: 9

10 Awareness: Do users pay attention to contextual cues, such as the web browser URL bar or various security iconography? Passwords: Do users create unique passwords that exceed minimum requirements and are therefore difficult to crack? Updating: Do users apply software security updates in a timely manner? Securement: Do users secure their devices with secret codes, such as using smartphone secure lock screens (i.e., requiring a PIN) or password-protected screen savers on desktops and laptops? To test if the measured intentions indeed correlate with actual behavior Egelman, Harbach and Peer performed three experiments to identify correlations between the four subscales of their measurement scale and actual security related behavior (2016). The results indicate that SeBIS predicts certain computer security behaviors and that it is a reliable and valid tool that should be used in future research. This paper adapts the SeBIS to measures students intention on securing their cloud access devices. The Theory of Planned Behavior is adapted to measure attitudinal factors that influence the security intentions. Measures Attitude Attitude towards securing CAD is a construct of TPB and was directly measured using four statements. Students were asked to indicate their level of desirability on a 5-point Likert scale (undesirable desirable) with each of the following statements: Att1. Making sure that my laptop/smart device is locked when I don t use it is Att2. Using a different and strong password for all my on-line accounts is Att3. Checking if forms I use and links I click on the internet are safe and secure is 10

11 Att4. Running the latest version of the software and apps that I use is Device security Device security is a construct of the SeBIS and was directly measured using four statements. Students were asked to indicate their level of agreement on a 5-point Likert scale (totally disagree totally agree) with each of the following statements: Ds1. I set my computer screen to automatically lock if I don t use it for a prolonged period of time. Ds2. I always use a password/passcode to unlock my laptop or tablet. Ds3. I manually lock my computer screen when I step away from it. Ds4. I use a PIN, fingerprint, or passcode to unlock my mobile phone. Subjective norms Subjective norms regarding securing CAD are a construct of TPB and was directly measured using four statements. Students were asked to indicate their level of desirability on a 5-point Likert scale (undesirable desirable) with each of the following statements: Sn1. My friends/family want me to secure my devices really well. Sn2. My friends/family expect me to use strong and different passwords for my accounts. Sn3. It is expected of me that I check if websites and links are safe before use. Sn4. It is expected of me that my apps and software are up-to-date. Password generation 11

12 Password generation is a construct of the SeBIS and was directly measured using four statements. Students were asked to indicate their level of agreement on a 5-point Likert scale (totally disagree totally agree) with each of the following statements: Pg1. I do not change my passwords, unless I have to. Pg2. I use different passwords for different accounts that I have. Pg3. When I create a new online account, I try to use a password that goes beyond the site s minimum requirements. Pg4. I do not include special characters in my password if it s not required. Perceived behavior control Perceived behavior control of securing CAD are a construct of TPB and was directly measured using five statements. Students were asked to indicate their level of desirability on a 5-point Likert scale (undesirable desirable) with each of the following statements: Bc1. It is difficult to remember a different password for every account. Bc2. It is easy to come up with a long password, consisting of small/caps letters, numbers and special characters. Bc3. It is difficult to remember to log out on a PC after using my on-line account. Bc4. I think it is hard to tell if some link is safe to click. Bc5. I think it is hard to determine if the used website/service is safe. Proactive awareness Proactive awareness is a construct of the SeBIS and was directly measured using four statements. Students were asked to indicate their level of agreement on a 5-point Likert scale (totally disagree totally agree) with each of the following statements: 12

13 Pa1. When someone sends me a link, I open it without first verifying where it goes. Pa2. I know what website I m visiting based on its look and feel, rather than by looking at the URL bar. Pa3. I submit file/information to cloud services without first verifying that it will be sent securely (e.g., SSL, a lock icon). Pa4. If I discover a security problem, I continue what I was doing because I assume someone else will fix it. Software updates Software updates is a construct of the SeBIS and was directly measured using three statements. Students were asked to indicate their level of agreement on a 5-point Likert scale (totally disagree totally agree) with each of the following statements: Su1. When I m prompted about a software update, I install it right away. Su2. I try to make sure that the apps and software I use are up-to-date. Su3. I verify that my anti-virus software has been regularly updating itself. Cronbach s alpha was used to measure the internal reliability of each construct. The calculated alphas of the SeBIS constructs meet the minimum acceptable value of.7, while only the subjective norm construct from the TPB section meets this threshold. BC2 and BC3 were excluded from the analysis in order to increase reliability of the perceived behavior control composite scale. Both attitude and pbc could not meet the reliability minimum. Table 1 shows an overview of the results for Cronbach Alpha of each construct. 13

14 TABLE 1 INTERNAL RELIABILITY OF THE 7 MEASURED COMPOSITE SCALES Cronbach s Alpha N of items Device Security Password Generation Proactive Awareness Software Updates Attitude Subjective Norm Perceived Behavior Control After calculating the reliability of the composite scales, an index was made for each construct by summing up the values of its items and divide the total by the number of items. An extra index was calculated by combining the 4 dimensions of the Security Behavior Intention Scale into one variable (SeBIS). Results To examine RQ1, frequency tables were used to see the means of the four dimensions of the Security Behavior Intention Scale. TABLE 2 MEANS OF THE 4 MEASURED SEBIS COMPOSITE SCALES N Valid Missing Mean Median Mode Std. Deviation Device Security ,7058 4,0000 4,00,96766 Password Generation ,6903 2,5000 2,00,77980 Proactive Awareness ,9502 3,0000 2,75,79268 Software Updates ,1121 3,0000 3,33,

15 From table 2 we can find that students have low behavior intentions on password generation (M=2.69), proactive awareness (M=2.95) and device updating (M=3.11). Students seem to have higher intentions on device securement (M=3.71). Linear regression was employed to address RQ2 and explore relationships between the TBP factors and the security intention (SeBIS). A low p-value (< 0.05) indicates that the hypotheses are grounded. TABLE 3 REGRESSION COEFFICIENTS Unstandardized Coefficients Standardized Coefficients Model B Std. Error Beta t Sig. 1 (Constant) 1,833,169 10,880,000 Attitude,185,034,318 5,382,000 Subjective Norm,234,035,391 6,710,000 Perceived Behavior Control -,035,038 -,055 -,938,349 a. Dependent Variable: SeBIS Regression analysis (table 3) shows that H1 is supported. The correlation between Attitude and Security Intention =.318. It is therefore concluded that Attitude is significantly and positively correlated with the intent of students to secure their CADs. H2 is also supported. The correlation between Subjective Norm and Security Intention =.391. Therefore, the data indicates that the Subjective Norm is significantly and positively correlated with the intent of students to secure their CADs. H3 is not supported. The correlation between Perceived Behavioral Control and Security Intention = Therefore, the data indicates Perceived Behavioral Control is not correlated with the intent of students to secure their CADs. The reason for a negative value is the use of a reversed scale to measure perceived behavior control. 15

16 However, when regression analysis is made between the composite variable Perceived Behavior Control and the separate dimension of the SeBIS, correlation is found between Perceived Behavior Control and the SeBIS constructs Password Generation and Proactive Awareness, as shown in table 4. TABLE 4 REGRESSION COEFFICIENTS Perceived Behavior Control Device Security Password Generation Proactive Awareness Software updates Pearson Correlation -,015,346 ** -,492 **,073 Sig. (2-tailed),819,000,000,278 N To answer RQ3, a descriptive and regression analysis was run again in split mode, dividing our collected data into two groups: one set of data collected from Korean students and one set from students studying in the Netherlands. No remarkable differences were found when analyzing the frequency tables and means of several constructs. In addition, when running a regression analysis with split data no significant differences were discovered. Discussion and limitations When we look at the results of this study we can conclude that there is room for improvement for student s intention on securing their cloud access devices. Overall, students seem to secure their devices above average using fingerprint and PIN security to gain access to their CAD. However, students seem to have low intentions on increasing password security, updating devices and being proactive about the safety of web-services, links, and forms. Through the results gathered from the survey, this study has provided a better understanding of 16

17 the factors which influence students intention on security. This is important for several reasons. If organizations (e.g. universities, banks, or personal cloud service providers) aim to increase the security intentions of students, they should focus on changing students attitude and removing barriers in perceived behavior control when trying to achieve better password generation and increase proactive awareness. Considering the strong support in the Theory of Planned Behavior literature indicating a significant relationship between the three constructs and behavioral intention, it was initially surprising to detect no significant difference between the correlation among the two groups. One of the limitations of this study is the low internal reliability of the TPB measurements. To increase internal reliability, the number of respondents should be doubled. In addition, the questionnaire items regarding TPB required more preparation. Due to the limit of available time for this research, the suggested interviews to derive more specific and effective items for the questionnaire and pilot testing of the survey were omitted. The sample size should be bigger to make the results more representative. 17

18 References Ajzen, I. (1991). The Theory of Planned Behavior. Organizational behavior and human decision processes, 50, Bang, Y., J., L. D., S., B. Y., & H., A. J. (2012). Improving information security management: An analysis of ID password usage and a new login vulnerability measure. international journal of information management, 32(5), Bang, Y., Lee, D.-J., Bae, Y.-S., & Ahn, J.-H. (2012). Improving information security management: An analysis of ID password usage and a new login vulnerability measure. International Journal of Information Management, 32, Das, S. (2016, 3 7). Understanding and Leveraging Social Influence to Improve End-User Security Sensitivity. Berkeley. Dinh, H. T., Lee, C., Niyato, D., & Wang, P. (2013, 10 11). A survey of mobile cloud computing: architecture, applications, and approaches. WIRELESS COMMUNICATIONS AND MOBILE COMPUTING, 13. Egelman, S., Harbach, M., & Peer, E. (2016). Behavior Ever Follows Intention? CHI '16 Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems, Gartner. (2012, 6 25). Gartner Says That Consumers Will Store More Than a Third of Their Digital Content in the Cloud by Retrieved from Gartner: Hunsinger, D. S., & Corley, J. K. (2012). An Examination of the Factors Influencing Student Usage of Dropbox, a File Hosting Service. Proceedings of the Conference on Information Systems Applied Research. 18

19 Margaryana, A., Littlejohna, A., & Gabrielle Vojtb. (2011). Are digital natives a myth or reality? University students use of digital technologies. Computers & Education, 56(2), NT, B. (2014, 7 28). 5 advantages and disadvantages of Cloud Storage. Retrieved 6 17, 2016, from Big Data made simple: Park, N., Kim, Y.-C., Shon, H., & Shin, H. (2013, 3 27). Factors influencing smartphone use and dependency in South Korea. Com puters in Human Behavior, 29, Stantchev, V., Colomo-Palacios, R., Soto-Acosta, P., & Misra, S. (2014). Learning management systems and cloud file hosting services: A study on students acceptance. Computers in Human Behavior, 31, Statista. (2016, 3 1). Statista. Retrieved 4 29, 2016, from Countries with the highest average internet connection speed as of 4th quarter 2015 : Yahya, F. W. (2015). Protecting data in personal cloud storage with security classifications. Science and Information Conference (pp ). SAI: IEEE. 19