Spyware is the latest epidemic security threat. Investigating Factors Affecting

Transcription

1 By Younghwa Lee and Kenneth A. Kozar Investigating Factors Affecting of Anti Spyware is the latest epidemic security threat for Internet users. There are various types of spyware programs (see Table 1) creating serious problems such as copying and sending personal information, consuming CPU power, reducing available bandwidth, annoying users with endless pop-ups, and monitoring users computer usage. As spyware makes the Internet a riskier place and undermines confidence in online activities, Internet users stop purchasing at online stores a consequence that clearly disrupts e-business. A variety of countemeasures for fighting spyware have been developed, including ant-spyware law enforcement and legislation, antispyware systems, and self-regulatory programs (see Figure 1 and Table 1). An anti-spyware Illustration by Ferruccio Sardella 72 August 2005/Vol. 48, No. 8 COMMUNICATIONS OF THE ACM

2 the Like any IT innovation, determining how best to convince users to adopt it is half the battle. Such is the case for anti-spyware solutions. -Spyware s COMMUNICATIONS OF THE ACM August 2005/Vol. 48, No. 8 73

3 system is the most widely recommended solution, which implements features that prevent, detect, and remedy the problems caused by spyware. The system monitors spyware attacks and automatically identifies and cleanses a system. Studies have identified that more than 80% of current spyware problems could be identified and resolved by using anti-spyware systems. Therefore, spyware experts such as FTC commissioner Orson Swindle strongly encourage Internet users adopt anti-spyware systems. However, contrary to our expectation for a higher adoption rate, only 10% of Internet users have actually done so [2]. Considering that anti-spyware systems effectively shield users from spyware, their low adoption rate continues to be a problem. Several suppositions have been made about this, but an empirical study has yet to be conducted. The goal of this article is to investigate the factors affecting Internet users adoption of an anti-spyware system. Our study seeks to provide a better understanding of an individual s decision to adopt an anti-spyware system, as well as provide a useful guideline on how to increase the adoption rate. The anti-spyware system adoption model was developed based on the theory of planned behavior (TPB) and previous studies of IT Antispyware solutions Types Spyware Anti-spyware law enforcement and legislation Anti-spyware systems Anti-spyware self-regulatory program Table 1. Types of spyware and anti-spyware solutions. innovation adoption. The TPB model has been widely adopted to address computer-related human behaviors because it can successfully capture individual, social, and situational factors impacting an individual s decision [1]. As this model has been effective in explaining and predicting the adoption of new information technologies, it was fitting to use it to examine the adoption of anti-spyware systems. In this context, the model hypothesizes when an individual has a favorable attitude toward an anti-spyware system; when an individual perceives social pressure to adopt or not to adopt an anti-spyware system; and when an individual perceives Classification Adware Keyloggers Trojans Scumware Dialers Browser Hijackers Internet Spyware (I-SPY) Prevention Act of 2004 SPYBLOCK Act Securely Protect Yourself Against Cyber Trespass Act (SPY ACT) Spybot Search and Destroy Spy Sweeper Ad-Aware Spector Pro Spyware Eliminator PestPatrol Spy Catcher AntiSpy AntiSpyware STOPZilla SpywareBlaster Consortium of Antispyware Technology Vendors (COAST) SpyNet SpywareInfo Definition and URL Programs that monitor Internet users online activities to initiate pop-up advertising or other targeted marketing purposes. Programs that capture and record Internet users every keystroke, including personal information and passwords. Malicious programs that appear as harmless or desirable applications, but are designed to cause loss or theft of computer data, or even to destroy the system. Programs that alter the content of Web sites Internet users are accessing, changing the normal links to reroute them to other Web sites. Programs typically used by vendors serving pornography via the Internet. Programs that run automatically every time Internet users start their Internet browser to gather info on the users surfing habits Anti-spyware terms and definitions; there are controlling factors that facilitate or constrain his or Lee her adoption, table 1 (8/05) thus influencing their intention to adopt anti-spyware software. In the same vein, previous studies of IT innovation adoption have identified factors that influence an individual s decision to adopt a new technology [3], including relative advantage, moral compatibility, ease of use, image, visibility, and trialability. These IT innovation factors are well suited for explaining the adoption of an anti-spyware system. In addition, subjective norm, perceived cost, and computing capacity are new factors identified through a focus group study with seven anti-spyware system experts and interviews with 21 anti-spyware system adopters. To increase the explanation power of the TPB 74 August 2005/Vol. 48, No. 8 COMMUNICATIONS OF THE ACM

4 model, researchers have encouraged identifying situation-specific factors and adding them to the model. Figure 2 shows the research model consisting of nine factors believed to significantly influence an individual s adoption of an anti-spyware system. Relative advantage, moral compatibility, and ease of use are classified as attitude factors, subjective norm, visibility and image as social factors, and computing capacity, perceived cost, and trialability as perceived behavioral control factors. The definition of each factor is described in Table 2. To validate the research model, a questionnairebased field survey was conducted with Internet users who have adopted or have Factors Attitude Social Factors Behavioral Control Intention ware system adoption. The insignificance of subjective norm points out that users did not consider pressures from their referents to be important for the anti-spyware adoption decision. For perceived behavioral control, computing capacity and trialability showed a significant effect, while perceived cost did not. The significant impact of computing capacity suggests the more powerful computing environ- Sub- Factors Relative Advantage Moral Compatibility Ease of Use Subjective Norm Visibility Image Computing Capacity Cost Trialability Definition Table 2. Definitions of factors affecting the anti-spyware system adoption. Lee table 2 (8/05) an interest in adopting an anti-spyware system. Some 292 subjects were recruited to the study through advertisements addressing an online privacy community, as well as local and student newspapers. In the end, 212 usable responses were gathered. The average age of the respondents was 27.6 years Gender old. 67% of subjects Female were male, and 65% (n = 70) were industry professionals. They had an ** Ease of Use Relative Advantage ** Moral Compatibility average of nine months Subjective Norm of experience with antispyware system adop- Image * Visibility ** Computing Capacity tion. Data was analyzed * Cost using Partial Least Trialability Squares (PLS). * As illustrated in Figure 3, the model successfully explains an individual s adoption intention (R 2 = 0.83) and actual adoption (R 2 = 0.55) of the anti-spyware system. 1 Six out of nine factors showed a significant influence on anti-spyware system adoption intention. Relative advantage, moral compatibility, visibility, image, computing capacity and trialability were significant factors, whereas ease of use, subjective norm, and perceived cost were not. Out of three attitude factors, relative advantage was the strongest factor affecting the adoption intention. It indicates that people are inclined to adopt an antispyware system when they perceive it as a useful, effective means for keeping their computing environment safe and thus enhancing their task performance. Moral compatibility also showed a significant influence suggesting the stronger the belief that adopting anti-spyware systems is a morally correct behavior to contribute to the overall safety of the Internet environment, the higher the intention to adopt it. The insignificance of ease of use reflects The degree to which an individual believes that using an anti-spyware system would enhance his or her task performance The degree to which the adoption of an anti-spyware system is compatible with one s moral perception The degree to which an anti-spyware system is easy to learn and use The degree to which an individual perceives social pressure to adopt or not to adopt an anti-spyware system from his/her referents The degree to which an individual observes others adoption of an anti-spyware system The degree to which the adoption of an antispyware system enhances one s image as a technical and moral leader among his/her referents. The degree to which an anti-spyware system fits with capacity of one s computer and networks The degree to which an individual perceives purchasing an anti-spyware system is expensive The degree to which it is possible to try using an anti-spyware system before adoption An indication of a person's readiness to use an anti-spyware system Actual anti-spyware system use Male (n = 142 ) *** * ** ** * * Table 3. Results by different gender and age. Lee table 3 (8/05) 1 R 2 = 0.83 means that 83% of individual s adoption intention is explained by antecedents including attitude, social factors, and perceived behavioral control. Age 30 and Below (n = 85 ) ** ** 0.17 ** * * 0.1 * Above 30 (n = 127 ) *** *** * ** * * * Statistically significant at * : p <0.05, ** : p <0.01, *** : p <0.001 that Internet users did not perceive any difficulty in installing and using the system. Most current anti-spyware systems are equipped with user-friendly installation procedures and menus that help the users easily implement and use them. With respect to social factors, Internet users were significantly influenced by visibility and image, but not subjective norm. The significant effect of visibility addresses Internet users tendency of exhibiting herding behavior in adopting a system. That is, when Internet users observe the adoption of antispyware systems by their friends, family, colleagues, and other referent groups, they have more intention to adopt the system. Perceiving the adoption as an opportunity to enhance their image as a technical leader is also a strong motivator of anti-spy- COMMUNICATIONS OF THE ACM August 2005/Vol. 48, No. 8 75

5 Figure 1. Countermeasures of spyware. Legislation ment (such as large RAM, fast CPU, and a high-speed Internet connection) led to a stronger intention to adopt the system. Trialability also showed a significant effect reflecting people trying the system before adopting it. The insignificance of perceived cost suggests the price of an anti-spyware system is not an inhibitor of adoption. Finally, three out of four factors showed significant influence on actual adoption. intention, computing capacity, and trialability were significant, but perceived cost was not. Further analysis was conducted to examine whether the adoption decision is different across gender and age. With respect to gender, all the relationships between adoption factors of male users were the same as those in the original model shown in Figure 3. However, for female respondents, several interesting results were found (see Table 3). Compared to the findings of the original model, subjective norm was found to be significant, while image was not. These findings suggest that women were strongly influenced by mandatory pressure from their referents, whereas they did not highly consider enhancement of their image. In addition, moral compatibility of female adopters was found to be much stronger than for males, indicating women are more sensitive to moral values. Finally, the effect of trialability is much stronger in females than males, suggesting women are more conservative customers. That is, women prefer more hands-on experience with anti-spyware software before actual adoption. To examine the effect of age difference, the original data was divided into two groups: 30 and below and over 30. For the former, major differences from the original model come from moral compatibility and perceived cost. Contrary to the findings of the original model, perceived cost was a significant factor for the younger group while moral compatibility was not. Internet Spyware Prevention Act of 2004 SPYBLOCK Act Securely Protect Yourself Against Cyber Trespass Act s Anti-Adware s Anti-Key Logger s Anti-Trojan Horse s Self-Regulatory Program SpyNet SpywareInfo Attitude Relative Advantage Moral Compatibility Ease of Use Social Influence Subjective Norm Visibility Image Behavioral Control Computing Capacity Cost Trialability Figure 2. The antispyware system adoption model. NO SPYWARE These results indicated the younger adopters did not seriously consider moral value, but were sensitive to the price Lee of an fig anti-spyware 1. (8/05) system in their adoption decision. For the older group, subjective norm was found Intention of of to be significant explaining that the older adopters importantly consider normative beliefs from referents when adopting Lee fig the 2. system. (8/05) STRATEGIC SUGGESTIONS Based on our research findings, this study provides several strategic suggestions on how to increase the adoption of the anti-spyware systems. First, developers should design anti-spyware systems that align better with adopters usefulness and effectiveness expectations. Several reports pointed out that any single antispyware system could not successfully identify and 76 August 2005/Vol. 48, No. 8 COMMUNICATIONS OF THE ACM

6 clean all types of spyware [2]. Therefore, anti-spyware system experts recommend using multiple systems. This is not desirable since this requires the adopters to expend more effort in maintaining multiple systems, not to mention increased cost. Legislators, online users, and developers should work together to create a consensus of the maliciousness of spyware. Most Internet users believe that spyware is an obvious menace that erodes the security of the Internet. However, some users believe that spyware is beneficial in that it provides more effective and personalized customer service, as well as free stateof-the-art applications. They may not have enough knowledge to fully understand the malicious Attitude Relative Advantage Moral Compatibility Ease of Use Social Influence Subjective Norm Visibility Image Behavioral Control Computing Capacity Cost Trialability Figure 3. Research findings. aspects of spyware. Therefore, an ongoing effort to educate Internet users of the problems caused by spyware is necessary. It is also recommended that anti-spyware system developers include explanations that emphasize moral image and innovativeness of adopters in their marketing strategy. For instance, advertisements could explain how an individual s adoption of an anti-spyware system contributes to the improvement of Internet security. Ads could also emphasize that users of anti-spyware systems indicate savvy computer users and industry leaders. To increase the visibility for potential adopters, antispyware system venders should create and manage online discussion databases, anti-spyware communities, and promote the integration of recommendation-to-friends links on their Web sites. As the size of antispyware communities increases, the number of new adopters would also increase due to improved awareness. Anti-spyware developers and marketers should provide more opportunity for users to have hands-on experience with anti-spyware systems. The free versions available on the Internet only provide the most basic security functions, such as determining whether a PC is infected. Removing the spyware would require purchasing an anti-spyware system. Since reducing the perceived uncertainty of potential adopters toward anti-spyware systems is critical for adoption, offering fully functional free anti-spyware systems for a limited time period (say, a 30-day free trial) is recommended. Developers must create multiple versions of antispyware systems to cater to specific user needs, such as financial ability, operating system environments, and *** ** ** * Intention of (R 2 = 0.83) * * * * * desktop or laptop computers. Finally, Lee developers fig 3. (8/05) should tailor their marketing efforts to increase the adoption rate. For example, our findings show an effective way to reach potential women adopters is to provide more trial opportunities. In summary, spyware is the newest threat to betray the trust of Internet users, invade their privacy, and deteriorate their productivity. This problem is exacerbated by the increased number of people online and the increased time they spend online. The creators of spyware programs are also becoming more experienced and agile, which should serve to underscore the importance of promoting anti-spyware research. If we do not provide adequate defenses against spyware, we risk undermining the confidence of Internet users. An anti-spyware system must be perceived as a powerful weapon to counteract the effects of spyware. Ongoing efforts to develop improved anti-spyware systems that meet users needs and influence them to adopt a system should continue to enable building a secure Internet environment. c References 1. Ajzen, I. Attitudes, Personality, and Behavior. Open University Press, Milton- Keynes, England, Kawamoto, D. Few corporations use the anti-spyware tools; news.zdnet.com/ _ html 3. Moore, G.C. and Benbasat, I. Development of an instrument to measure the perceptions of adopting an information technology innovation. Information s Research 2, 3 (1991), Younghwa Lee ([email protected]) is an assistant professor in the School of Business at the University of Kansas, Lawrence, KS. Kenneth A. Kozar is associate dean and a professor of information systems in the Leeds School of Business at the University of Colorado, Boulder ACM /05/0800 $5.00 of (R 2 = 0.55) Statistically significant as *: p<0.05, **: p<0.01, ***: p<0.001 COMMUNICATIONS OF THE ACM August 2005/Vol. 48, No. 8 77