The effect of Privacy, Security Reliability in SaaS Continuance Use

Transcription

1 The effect of Privacy, Security Reliability in SaaS Continuance Use The National Taipei University of Technology Taipei, Taiwan Abstract Software-as-a-service (SaaS) can increase the competence of the small and medium sized enterprises as that of a globally integrated enterprise. However, the SaaS provider has total control over the underlying cloud infrastructure while the customer has little control. As numerous surveys show, security and privacy are the top concerns preventing firms from moving to SaaS. This study applied the Information Systems Continuance Model and adopted privacy and security reliability as a new construct of interest. The study contributed to a more sophisticated understanding of the role of privacy and security reliability for customer satisfaction and continued SaaS usage intentions. As an academic contribution, this study enriched existing research models on SaaS continuance by adopting privacy/security reliability construct which existing SaaS continuance models have not addressed. This study also identified whether, and in what way specific privacy/ security reliability construct contributes to explain SaaS satisfaction and continuance intention. Keywords: Software-As-A-Service (SaaS), Privacy, Security Reliability, Continuance Model 1. Introduction Cloud computing has been recognized as one of the most important developments in information technology in the past 60 years (Francoise Gilbert, 2010).Software-as-a-service (SaaS), where software applications are accessed via a web browser on a pay-as-you use basis, is a form of cloud computing. With SaaS, a provider licenses an application to customers for use as an on-demand service, either through a time subscription or a "pay-as-you-go" model. The SaaS model allows vendors to develop, host and operate software for a customer to use, rather than having them purchase the software (Seth Fineberg, 2010; Anirban Kundu et al. 2010). SaaS strengthens the small and medium sized enterprises capabilities similar to those of a globally integrated enterprise by enabling them to access software, services and infrastructure they would not otherwise be able to afford (Anita Hawser, 2009).Thus, SaaS is a way of offering the small and medium sized enterprises infrastructure which takes them away from having to worry about capital expenditure for servers and operating systems or security infrastructure in their data center. However, the SaaS provider has total control over the underlying cloud infrastructure, including network, servers, operating systems, storage, and even individual application capabilities. The SaaS customer just receives access to the provider s applications running on a cloud infrastructure and has administrative control that is limited to customer-specific application configuration settings. The customer has little control over the underlying technology (Francoise Gilbert, 2010). As recent reports show, there has been an increase in instances where the provision of SaaS offerings has missed customers service quality expectations (Weier, 2009). Failing to fulfill customers expectations regarding service quality, such as application availability or vendor responsiveness, may have critical consequences not only for customers, but also for the vendor. In a Gartner study (2009) of 333 US- and UK-based organizations, the top three reasons why organizations discontinue SaaS or put SaaS on hold are security/privacy issues, technical integration problems, and low-quality customer support. Although previous researchers had approached models to examine the influence of IS service quality confirmation on satisfaction and of continued IS usage intentions (e.g. Bhattacherjee 2001; Deng et al. 2010;Alexander Benlian, Marios Koufaris and Thomas Hess 2010), they used rather general facets of service quality that influence customer satisfaction and paid more attention on technical integration problems, and low-quality customer support issues. As such, most SaaS continuance models have not addressed how security and privacy issues are the top concerns discontinuing or preventing firms from moving to SaaS. However, in order to offer more Journal of Convergence Information Technology(JCIT) Volume7, Number7, April 2012 doi: /jcit.vol7.issue

2 diagnostic and thus prescriptive advice, a more in-depth conceptualization of security and privacy for SaaS continuance is required. 2. Theory Background 2.1. Cloud Service Models and Benefits The Infrastructure as a Service model provides the customer with processing, storage, networks, and other fundamental computing resources, which the customer rents. Dale Vile and Tony Lock (2010) draw upon the experience of the Freeform Dynamics analyst team advising mainstream IT departments on the practical application of emerging ideas and technologies in a business context. There is a great deal of emphasis in the industry at the moment on technology and services, cloud computing is as much a philosophy as anything else. Francoise Gilbert (2010) introduced several examples of IaaS service providers include Amazon Web Services, Amazon Elastic Compute Cloud, IBM, and Rackspace Cloud. Platform as a Service provides a computing platform and deploys customer-provided applications to a cloud. This model is most appropriate for developers that address niche markets. Examples of PaaS service providers include Windows Azure and Force.com (a division of Salesforce.com ), OrangeScape, and Wolf PaaS. Software as a Service provides the customer with the ability to use the provider s applications over a network. The vendor may host the application on its own Web servers or upload the application to the customer s device and disable it after use or after expiration of the contract. Examples of SaaS service providers include G-Mail, Yahoo Mail, Google Apps, Mint, and Salesforce.com. Choudhary (2007) made a comparison of software quality under perpetual licensing and SaaS. They mentioned that SaaS was followed by the application service provider (ASP) model where the user could purchase a perpetual license but execute the software on hardware owned by a third party as well as the ASP model is different from SaaS in several aspects. Anita(2009) analysed that the economic benefits of cloud computing will ultimately outweigh the barriers, and the IT services [that] companies can access in the cloud are probably better quality than what they will get from their own internal IT department anyway. Seth (2010) concluded that effective use of SaaS solutions would keep small firms staying competitive. If a small firm doesn't keep up with technology, it will lose to the firms who are a bit bigger and who do have it. It's the one place a small firm can actually compete easily with bigger firms. Because of size, the nature of business and geographic dispersion of small firms, they have made a considered, strategic decision to adopt cloud computing to satisfy their information technology needs. Many of their business applications are provided via the SaaS. This is a sound business decision, as it reduces risk, cost and management overheads of small firms, and allows small firms to focus on their core business. Anita (2009) mentioned that most of the commentary and advice that is published tends to focus on the benefits. Currently valued at $36 billion, the cloud computing market is expected to more than quadruple in value to $160 billion by As soon as 2012, Gartner predicts, 20% of firms will rely on cloud computing for significant parts of their IT environment. A recent report from tech researcher Gartner Inc. stated that SaaS revenue rose 27 percent year over year, to $6.4 billion and that figure may double by 2012 (Seth fineberg, 2010). 2.2 Privacy and Security on cloud computing Privacy advocates have raised many concerns about cloud computing. These concerns typically mix security and privacy. Yuliang Shi et al. (2011) mentioned that tenants are facing the new secure data storage challenge, including data privacy and secure data possession at untrustworthy servers. Tim Mather et al. (2009) mentioned that users should be aware of some considerations as follows: Access: Data subjects have a right to know what personal information is held and, in some cases, can make a request to stop processing it. Compliance: what are the privacy compliance requirements in the cloud? Storage: where is the data in the cloud stored? Retention: how long is personal information retained? 284

3 Destruction: how does the cloud provider destroy personal information at the end of the retention period? Privacy refers to the claim of persons to determine when, how, and to what extent information about themselves is communicated to others (Harry Katzan, Jr., 2010). Some privacy issues of cloud computing are summarized as follows: the location of information in the cloud may have significant effects on the privacy and confidentiality protection of information and on the privacy obligations of those who process or store the information. Legal uncertainties make it difficult to assess the status of information in the cloud as well as the privacy and confidentiality protections available to users (Gellman, R. 2009). There is no denying that the main issue is identity, which serves as the basis of privacy or lack of it, and undermines the trust of individuals and organizations in other entities (Harry Katzan, Jr., 2010). Regarding to the Privacy and Security reliability, Tim Mather et al. (2009) described the implications of computing on compliance with various privacy regulations. In U.S., there are Patriot Act of 2001, Electronic Communications Privacy Act (ECPA), and Federal Information Security Management Act of 2002 (FISMA), Health Insurance Portability and Accountability Act of 1996 (HIPAA). In additionally, the international regulatory environment is driven by two approaches : one represented by EU Directive 95/46EC on the protection of individuals with regard to the processing of personal data, and another reflected by the APEC Privacy Framework. 2.3 Previous SaaS Quality Research and IS continuance The service quality literature and the SERVQUAL scale have been adapted to the IS context through several studies investigating the service quality of IS functions and departments from the perspective of users or IS professionals (Jiang, J.J., Klein, G., and Carr, C.L. 2002). The new architecture has important implications for customers service quality perceptions. While the findings in IS SERVQUAL and ASP research can be borrowed to guide research in SaaS service quality, SaaS differs in several aspects from previous models: software applications and IT infrastructure are shared across customers in the SaaS model, the SaaS model constrains clients options for customization of the main functionality and data structures of the software, the architecture of SaaS allows for the separation of maintenance responsibilities between the SaaS vendor and the client and so on(choudhary 2007). Syed A. Ahson and Mohammad Ilyas (2009) introduced that Saas simple maturity model by Microsoft corporation (2006)and model by forrester research (2008). They also presented the initial version of an SaaS QoS evaluation model. However, the substance of the 4 SaaS maturity levels is not well-defined and corresponding quality approaches are not clarified clearly. Noura Limam and Raouf Boutaba (2010) described a framework for reputation-aware software service selection and rating. A selection algorithm is devised for service recommendation, providing SaaS consumers with the best possible choices based on quality, cost, and trust. Alexander Benlian, Marios Koufaris and Thomas Hess (2010) developed a Zone-of-Tolerance (ZOT)-based SaaS-QUAL scale and validate it in a model of IS continuance based on two empirical surveys of SaaS using firms. They examined the importance of SaaS service quality factors for shaping customer satisfaction and SaaS continuance intentions. However, privacy/security issue was established as only one of the six facets of SaaS service quality and wasn t highlighted. 3. Research Model Bhattacherjee s (2001) work built on different theoretical foundations by examining the influence of IS service quality confirmation on satisfaction and of continued IS usage intentions has been validated in several follow-up studies (e.g. Benlian et al.;deng et al. 2010) and thus has proven its theoretical value. However, cloud computing which allows the IT systems to be managed from very remote locations where data is accessed and manipulated via a server is quite different from the traditional IS operation. Drawing on previous SaaS continuance literature, there are numerous of privacy and security issues such as encrypted technology, physical security measures like facilities, surveillance, guards, fire fighting preparedness, disaster management arrangements, security records, anti-virus technology, investment in technical standards in privacy, database separation, schema/table separation, data 285

4 separation etc. Privacy/security issues turn out to be the main reason why organizations discontinue SaaS or put SaaS on hold. Realizing the need to better understand SaaS continuance, however, requires adopting privacy/security as a new construct of interest. Figure 1. SaaS continuance model based on Bhattacherjee (2001) by Benlian et al.(2010) Incorporating the ideas described in the previous sections into Bhattacherjee s Post-Acceptance Model of IS Continuance (2001) and Benlian s (2010) SaaS continuance model, this study developed the rationale for the relationships as Figure 2. Figure 2. Research Model This study provided the following hypothesis: H1: Privacy/security reliability has a positive association with perceived usefulness. H2: Privacy/security reliability has a positive association with confirmation of saas service quality. H3: Perceived usefulness has a positive association with satisfaction. H4: Confirmation of saas service quality has a positive association with satisfaction. H5: Satisfaction has a positive association with continuance intention. 4. Research Methodology 4.1 Structural Equation Model (SEM) To validate the model we utilize Structural Equation Modeling (SEM) as it allows the simultaneous modeling of independent and dependent constructs and the intricate causal networks enabled by SEM characterize real-world processes better than simple correlation-based models (Carmen Barroso, et al., 2010) 4.2 Data Collection 286

5 Data was collected via a web-based survey from the staffs who served in the Taiwanese small and medium sized enterprises. The online questionnaire of this study began on September 23th, 2011 and went until October 20th, After filtering invalid and incomplete responses, a final net sample of 130 observations was obtained. 4.3 Development of Measurement Scales The five constructs of interest in our research model are the Privacy/Security (PS), Perceived Usefulness (PU), Confirmation of SaaS service quality (CSQ), Satisfaction (SA), and SaaS Continuance Intention (CI). To ensure the content validity of the scales, the items selected must represent the concept about which generalizations are to be made (Bohmstedt, 1970). Therefore, measurements selected for the constructs were mainly adapted from prior studies to ensure content validity. All constructs were measured using five-point Likert scales anchored with strongly disagree and strongly agree. The definitions and measurements of the constructs were summarized in Table1. Construct Name Privacy/ Security reliability,ps Confirmation of SaaS service quality, CSQ Perceived Usefulness, PU Satisfaction, SA Table 1. The definitions and measurements of the constructs Definition Number Measurement Sources of Indicators users perception 3 PS1: of the information Identification is security of SaaS use users perception of the congruence between expectation of SaaS use and its actual performance users perceptions of the expected benefits of SaaS use a users postacceptance affect, recorded as positive (satisfied), required to access the information. PS2: The SaaS system adopts information security standards like ISO certification. PS3: User Access Administration is set up. 2 CSQ1: The service level provided by SaaS was better than what I expected. CSQ2: Overall, the experience with using SaaS was better than what I expected. 2 PU1: Using SaaS will improve my job performance PU2: Using SaaS will increase my productivity 2 SA1: After using SaaS, I am satisfied. SA2: Harry Katzan, Jr., 2010) Tim Mather et al. (2009) Bhattacherjee (2001) Bhattacherjee, A., & Premkumar, G. (2004) Bhattacherjee (2001) Davis et al.(1989) Bhattacherjee, A., & Premkumar, G. (2004) Bhattacherjee (2001) Mckinney (2002) 287

6 Continuance Intention, CI indifferent, or negative (dissatisfied) users intention to continue using the SaaS After using SaaS, I am pleased. 2 CI1: I expect my use of SaaS to continue in the future CI2: I agree the business will purchase SaaS in the future Bhattacherjee (2001) Davis (1989) 5. Data Analysis and Results 5.1 The reliability of the construct measurement scales Cronbach s Alpha is computed in order to evaluate Internal Consistency, which measures the reliability of the construct measurement scales. Hair et al. (1998) recommended that Cronbach alpha values from 0.6 to 0.7 were deemed the lower limit of acceptability. An alpha of more than 0.7 would indicate that the items are homogeneous and measuring the same constant. Table 2 showed the reliability of the measurement scales. Cronbach s alpha for each latent construct except continuance intention ranged from to and indicated good internal consistency. The Cronbach s alpha value of the continuance intention construct is also acceptable. Hence, all the scale items exhibited acceptable internal consistency and were validated in previous studies. The results demonstrated that the questionnaire was a reliable measurement instrument. Table 2. The reliability of the construct measurement scales results Construct Number of Cronbach s Alpha indicators Privacy/security 3.79 Perceived usefulness Confirmation of SaaS service quality Satisfaction Continuance intention The goodness of fit analysis of structural model A confirmatory factor analysis using LISREL 8.3 was conducted to test the structural model. eight common model-fit measures were used to assess the models overall goodness of fit: X2/df, goodnessof-fit index (GFI), adjusted goodness-of-fit index (AGFI), normalized fit index (NFI), non-normalized fit index (NNFI), comparative fit index (CFI), and standardized root mean square residual (SRMR). As illustrated in Table 3. The goodness-of-fit indices of the proposed model of continuance intentions fitted the data reasonably well, as confirmed by the X2/df = 2.28, GFI = 0.90, AGFI = 0.82, NFI = 0.96, NNFI = 0.97, CFI = 0.98, RFI=0.94, RMSR = Thus, we could proceed to examine the path coefficients of the structural model. 288

7 Goodness of fit indicator X2/df Table 3. The goodness of fit of each of the model s indicator Description Suggestive References values the ratio of X2 to 3 Hair et al. degrees-of-freedom (2005) (df) 0.90 Hair et al.(2006) relative amount of variances and GFI a measure of the AGFI covariances jointly accounted for by the model. adjusted goodness of fit index NFI a ratio of the difference in the χ2 value for the proposed model and a null model divided by the χ2 value for the null model NNFI CFI (comparative fit index ) NNFI uses a similar logic but adjusts the NFI for the number of degrees of freedom in the model test the significance of change test the significance of change Hair et al.(2006) RFI Relative fit index Hair et al.(2006) RMSR an average of the residuals between individual observed and estimated variance and covariance terms < 0.08 < 0.08 Hair et al.(2006) Structural model Structural model results Figure 3. indicated the construct path relations estimated by the structural equation modeling (SEM). The path value is the standardized coefficient. The five assumptions of the research model all reached the significance level of α =0.05. Hypotheses H1, H2 were supported. The privacy/security reliability had significant positive effects on perceived usefulness and confirmation of SaaS service quality. Hypotheses H3 was supported, in that perceived usefulness had a significant positive effect on satisfaction. Hypotheses H4 was supported, in that confirmation of saas service quality had a significant positive effect on satisfaction. Hypotheses H5 was supported, in that satisfaction had a significant positive effect on continuance intention. 289

8 Figure 3. Structured Equation Model results *p < 0.05; **p < 0.01; ***p < Discussion and implications This study was a pioneering effort in applying IS continuance to the newly emerging context of SaaS services, which has become available and popular recently. The hypotheses of original model were also supported: H3: perceived usefulness has a positive association with satisfaction, H4: confirmation of SaaS service quality has a positive association with satisfaction., H5: satisfaction has a positive association with continuance intention. Many studies found that perceived usefulness to be the most dominant predictor of satisfaction (e.g., Limayem and Cheung, 2008; Roca et al., 2006). Our finding was in line with this in the sense that we also found that perceived usefulness dominantly impacts satisfaction. our results also suggested that in the post-adoption stage, confirmation of SaaS service quality can shaping users satisfaction as indicated in the IS continuance theory. According to our findings, satisfaction dominantly affected continuance intention. Thus, the SaaS vendors should develop strategies that will help increase user satisfaction with the SaaS. We found strong support for all added hypotheses in our extended IS continuance model: H1: privacy/security reliability has a positive association with perceived usefulness.h2: privacy/security reliability has a positive association with confirmation of SaaS service quality. These results are in line with the prior research about the privacy and security concerns are the top reason to discontinue using SaaS system. In order to retain SaaS users perceived usefulness and confirmation, appropriate data protection actions should be taken and advertised by the venders. 6. Conclusions Building on recognized theories of IS continouse, this paper took a systematic approach to empirically identify the impact "privacy/security reliability" on SaaS Use. The obtained results suggested that the privacy/security reliability is the important factor in explaining users perceived usefulness and confirmation of SaaS service quality which are important features in explaining the satisfaction. This study contributed to a more sophisticated understanding of security and privacy reliability for the SaaS continuance use. For researchers, this study enriched existing research models on SaaS continuance by adopting privacy/ security reliability construct which existing IS continuance models have not addressed. This research also contributed to emerge service science and service management literature. This research had practical implications too. Appropriate data protection actions should be taken and advertised by the venders to increase SaaS users continuance use indirectly. 7. References [1] Anita Hawser, Cloud Control Businesses Looking For Cost Effective Data and IT Infrastructure Solutions Are Increasingly Finding the Answer Is in the Cloud, Global Finance, pp.59-61,

9 [2] Bhattacherjee, A., Understanding Information Systems Continuance: An Expectation- Confirmation Model, MIS Quarterly 25(3), pp , [3] Choudhary, V., "Comparison of Software Quality under Perpetual Licensing and Software as a Service", Journal of Management Information Systems 24(2), pp , [4] Dale Vile and Tony Lock., Applied Cloud Computing A Practical Guide to Identifying the Potential in Your Environment, Orientation guide, pp. 1-15, [5] Deng, L., Turner, D.E., Gehling, R., and Prince, B., "User Experience, Satisfaction, and Continual Usage, European Journal of Information Systems, 19(1), pp , [6] Francoise Gilbert, Cloud Service Contracts May Be Fluffy: Selected Legal Issues to Consider before Taking off, Journal of Internet Law, pp.17-30, [7] Carmen Barroso, Gabriel Cepeda Carrión and José L. Roldán, Computing and Software Services Theory and Techniques, [8] Harry Katzan, Jr., Identity Analytics and Belief Structures, Journal of Business & Economics Research, 6(8), pp , [9] Bhattacherjee, A., & Premkumar, G., Understanding Changes in Belief and Attitude Toward Information Technology Usage A Theoretical Model and Longitudinal Test, MIS Quarterly, 28(2), pp , [10] Davis, F. D., Bagozzi, R. P., & Warshaw, P. R., User Acceptance of Computer Technology: A Comparison of Two Theoretical Models, Management Science, 35(8), pp , [11] McKinney, V., Yoon, K., Zahedi, F.M., The Measurement of Web-Customer Satisfaction: An Expectation and Disconfirmation Approach, Information System Research, 13(3), pp , [12] Bentler, P. M., & Bonett, D. G., Significance Tests and Goodness-of-Fit in the Analysis of Covariance Structures, Psychological Bulletin, 88(3), pp , [13] Limayem, M. and Cheung, C. M. K., Understanding Information Systems Continuance: the Case of Internet-Based Learning Technologies, Information & Management, 45(4), pp , [14] Roca, J. C., Chiu, C. M. and Martínez, F. J., Understanding E-Learning Continuance Intention: An Extension of the Technology Acceptance Model, International Journal of Human Computer Studies, 64(8), pp , [15] Hair, J., Anderson, R., Tatham, R. & Black, W., Multivariate Data Analysis (5th ed.), New York: Prentice Hall, [16] Gellman, R., Privacy in the Clouds: Risks to Privacy and Confidentiality from Cloud Computing, World Privacy Forum, [17] Jiang, J.J., Klein, G., and Carr, C.L., "Measuring Information System Service Quality: Servqual from the Other Side," MIS Quarterly, 26(2), pp , [18] Noura Limam, Raouf Boutaba, Assessing Software Service Quality and Trustworthiness at Selection Time, IEEE Transactions on Software Engineering, 36(4), pp , [19] Seth Fineberg, To SaaS or not to SaaS, at [20] Alexander Benlian, Thomas Hess and Marios Koufaris, The Role of Saas Service Quality for Continued Saas Use: Empirical Insights From Saas Using Firms, International Conference on Information Systems, [21] Tim Mather, Subra Kumaraswamy, Shahed Latif, Cloud Security and Privacy. An Enterprise Perspective on Risks and Compliance, O'Reilly Media, Inc., [22] Mary Hayes Weier, "Google, Workday Outages Show Saas Isn't Perfect," at [23] Syed A. Ahson and Mohammad Ilyas, Cloud Computing and Software Services, CRC Press, [24] Bohmstedt, G. W., Reliability and Validity Assessment in Attitude Measurement, Chicago: Rand- McNally, [25] Davis, F. D., Perceived usefulness, perceived ease of use and user acceptance of information technology, MIS Quarterly, 13(3), pp , [26] Anirban Kundu, Chandan Banerjee, Priya Saha, "Introducing New Services in Cloud Computing Environment", JDCTA, 4(5), pp , [27] Yuliang Shi, Kun Zhang, Qingzhong Li, "Meta-data Driven Data Chunk Based Secure Data Storage for SaaS", JDCTA, 5(1), pp ,