An Empirical Study: Cloud Users' Optimistic Bias Regarding Data Security Risk Perception and Its Impact

Abstract

Abstract:

It is very important for the development of cloud computing to analyze cloud users' risk perception regarding data security. Based on the optimistic bias of psychology theory and the research logic "Antecedents-Optimistic Bias-Outcomes", the cloud users' optimistic bias regarding data security risk perception and its impact explored from the perspective of individual users. An empirical analysis of 201 participants shows that the cloud users have no optimistic bias towards the data security risk perception on the whole, but there is a certain degree of negative optimistic bias, the negative optimistic bias of confidentiality risk perception is the biggest, the negative optimistic bias of availability risk perception is the second and the negative optimistic bias of integrity risk perception is the smallest. The optimistic bias of risk perception about confidentiality and availability is significantly affected by prior experience and the optimistic bias of the risk perception about integrity is significantly affected by controllability. The cloud users' effective security management decision is significantly affected by the optimistic bias of risk perception regarding confidentiality, integrity and availability. The study provides a theoretical and practical reference for analyzing the cloud users' data security risk perception from the aspects of information security psychology.

Key words: data security about cloud computing, risk perception, optimistic bias, confidentiality, integrity, availability

Wang Zhiying, Ge Shilun, Su Xiang. An Empirical Study: Cloud Users' Optimistic Bias Regarding Data Security Risk Perception and Its Impact[J]. , 2016, 28(9): 121-133.

References

[1] Marston S., Li Z., Bandyopadhyay S., et al. Cloud Computing—The Business Perspective[J].Decision Support Systems, 2011,51(1):176-189
[2] Mell P., Grance T. The NIST Definition of Cloud Computing[J].National Institute of Standards and Technology, 2009,53(6):50-59
[3] Benlian A., Hess T. Opportunities and Risks of Software-as-a-service: Findings from a Survey of IT Executives[J].Decision Support Systems, 2011,52(1):232-246
[4] Zissis D., Lekkas D. Addressing Cloud Computing Security Issues[J].Future Generation Computer Systems, 2012,28(3):583-592
[5] Cachin C., Keidar I., Shraer A. Trusting the Cloud[J].Acm Sigact News, 2009,40(2):81-86
[6] 冯登国,张敏,张妍等.云计算安全研究[J].软件学报, 2011,22(1):71-83
[7] Pring B. Cloud Computing: The Next Generation of Outsourcing[R].Gartner Report, 2010
[8] Balduzzi M., Zaddach J., Balzarotti D., et al. A Security Analysis of Amazon's Elastic Compute Cloud Service[C].Proceedings of the 27th Annual ACM Symposium on Applied Computing, 2012
[9] Ackermann T., Widjaja T., Benlian A., et al. Perceived IT Security Risks of Cloud Computing: Conceptualization and Scale Development[C].Thirty Third International Conference on Information Systems, 2012
[10] Shetty S. Gartner Says Cloud Computing Will Become the Bulk of New IT Spend by 2016[R].Gartner Report, 2013
[11] Burda D., Teuteberg F. The Role of Trust and Risk Perceptions in Cloud Archiving—Results from an Empirical Study[J].The Journal of High Technology Management Research, 2014,25(2):172-187
[12] Pavlou P. A. Consumer Acceptance of Electronic Commerce: Integrating Trust and Risk with the Technology Acceptance Model[J].International Journal of Electronic Commerce, 2003,7(3):101-134
[13] Gregory R., Mendelsohn R. Perceived Risk, Dread, and Benefits[J].Risk Analysis, 1993,13(3):259-264
[14] Gigerenzer G. Dread Risk, September 11, and Fatal Traffic Accidents[J].Psychological Science, 2004,15(4):86-287
[15] Rhee H. S., Ryu Y. U., Kim C. T. Unrealistic Optimism on Information Security Management[J].Computers & Security, 2012,31(2):221-232
[16] Loske A., Widjaja T., Buxmann P. Cloud Computing Providers' Unrealistic Optimism regarding IT Security Risks: A Threat to Users?[C].Thirty Fourth International Conference on Information Systems, 2013
[17] Weinstein N. D. Unrealistic Optimism about Future Life Events[J].Journal of Personality and Social Psychology, 1980,39(5):806-820
[18] Weinstein N. D., Klein W. M. Unrealistic Optimism: Present and Future[J].Journal of Social and Clinical Psychology, 1996,15(1):1-8
[19] Perloff L. S., Fetzer B. K. Self-other Judgments and Perceived Vulnerability to Victimization[J].Journal of Personality and Social Psychology, 1986,50(3):502-510
[20] Martha C., Laurendeau J., Griffet J. Comparative Optimism and Risky Road Traffic Behaviors among High-Risk Sports Practitioners[J].Journal of Risk Research, 2010,13(4):429-444
[21] Moritz S., Jelinek L. Inversion of the “Unrealistic Optimism” Bias Contributes to Overestimation of Threat in Obsessive-Compulsive Disorder[J].Behavioural and Cognitive Psychotherapy, 2009,37(2):179-193
[22] Weinstein N. D., Slovic P., Gibson G. Accuracy and Optimism in Smokers' Beliefs about Quitting[J].Nicotine & Tobacco Research, 2004,6(Suppl 3):S375-S380
[23] Rhee H. S., Ryu Y., Kim C. T. I am Fine but You Are Not: Optimistic Bias and Illusion of Control on Information Security[C].International Conference on Information Systems 2005 Proceedings, 2005
[24] Campbell J., Greenauer N., Macaluso K., et al. Unrealistic Optimism in Internet Events[J].Computers in Human Behavior, 2007,23(3):1273-1284
[25] Cho H., Lee J. S., Chung S. Optimistic Bias about Online Privacy Risks: Testing the Moderating Effects of Perceived Controllability and Prior Experience[J].Computers in Human Behavior, 2010,26(5):987-995
[26] Armbrust M., Fox A., Griffith R., et al. A View of Cloud Computing[J].Communications of the ACM, 2010,3(4):50-58
[27] 谢宗晓,林润辉,王兴起.用户参与对信息安全管理有效性的影响—多重中介方法[J].管理科学, 2013,26(3):65-76
[28] Spears J. L., Barki H. User Participation in Information Systems Security Risk Management[J].MIS Quarterly, 2010,34(3):503-522
[29] 陈瑞君,秦启文.乐观偏差研究概况[J].心理科学进展, 2010,18(11):1822-1827
[30] Helweg-Larsen M., Shepperd J. A. Do Moderators of the Optimistic Bias Affect Personal or Target Risk Estimates? A Review of the Literature[J].Personality and Social Psychology Review, 2001,5(1):74-95
[31] Chapin J., De las alas S., Coleman G. Optimistic Bias among Potential Perpetrators and Victims of Youth Violence[J].Adolescence, 2005,40(160):749-760
[32] Klein W. M. P., Lipkus I. M., Scholl S. M., et al. Self-affirmation Moderates Effects of Unrealistic Optimism and Pessimism on Reactions to Tailored Risk Feedback[J].Psychology and Health, 2010,25(10):1195-1208
[33] Dijk H. V., Fischer A. R. H., Honkanen P., et al. Perceptions of Health Risks and Benefits Associated with Fish Consumption among Russian Consumers[J].Appetite, 2011,56(2):227-234
[34] Smith H. J., Dinev T., Xu H. Information Privacy Research: An Interdisciplinary Review[J].MIS Quarterly, 2011,35(4):989-1016
[35] Bisong A., Rahman S. M. An Overview of the Security Concerns in Enterprise Cloud Computing[J].International Journal of Network Security & Its Applications, 2011,3(1):30-45
[36] Shepperd J. A., Carroll P., Grace J., et al. Exploring the Causes of Comparative Optimism[J].Psychologica Belgica, 2002,42(1):65-98
[37] Rothman A. J., Klein W. M., Weinstein N. D. Absolute and Relative Biases in Estimations of Personal risk1[J].Journal of Applied Social Psychology, 1996,26(14):1213-1236
[38] Lim S. S., Cho H., Sanchez M. R. Online Privacy, Government Surveillance and National ID Cards[J].Communications of the ACM, 2009,52(12):116-120
[39] Harris P. R., Griffin D. W., Murray S. Testing the Limits of Optimistic Bias: Event and Person Moderators in a Multilevel Framework[J].Journal of Personality and Social Psychology, 2008,95(5):1225-1237
[40] Menon G., Kyung E. J., Agrawal N. Biases in Social Comparisons: Optimism or Pessimism?[J].Organizational Behavior and Human Decision Processes, 2009,108(1):39-52
[41] Floyd D. L., Prentice-Dunn S., Rogers R. W. A Meta-analysis of Research on Protection Motivation Theory[J].Journal of Applied Social Psychology, 2000,30(2):407-429
[42] Chambers J. R., Windschitl P. D. Biases in Social Comparative Judgments: The Role of Nonmotivated Factors in Above-average and Comparative-optimism Effects[J].Psychological Bulletin, 2004,130(5):813-838
[43] Luo X., Li H., Zhang J., et al. Examining Multi-dimensional Trust and Multi-faceted Risk in Initial Acceptance of Emerging Technologies: An Empirical Study of Mobile Banking Services[J].Decision Support Systems, 2010,49(2):222-234
[44] Gewald H., Dibbern J. Risks and Benefits of Business Process Outsourcing: A Study of Transaction Services in the German Banking Industry[J].Information & Management, 2009,46(4):249-257
[45] Johnston A. C., Warkentin M. Fear Appeals and Information Security Behaviors: An Empirical Study[J].MIS Quarterly, 2010,34(3):549-566
[46] Loske A., Widjaja T., Benlian A., et al. Perceived IT Security Risks in Cloud Adoption: The Role of Perceptual Incongruence between Users and Providers[C].Proceedings of the European Conference on Information Systems (ECIS), 2014
[47] Chang S. E., Lin C-S. Exploring Organizational Culture for Information Security Management[J].Industrial Management & Data Systems, 2007,107(3):438-458
[48] Brady J. W. An Investigation of Factors that Affect HIPAA Security Compliance in Academic Medical Centers[D].Doctoral Dissertation of Nova Southeastern University, 2010
[49] Awad N. F., Krishnan M. S. The Personalization Privacy Paradox: An Empirical Evaluation of Information Transparency and the Willingness to Be Profiled Online for Personalization[J].MIS Quarterly, 2006,30(1):3-28
[50] Bansal G., Gefen D. The Impact of Personal Dispositions on Information Sensitivity, Privacy Concern and Trust in Disclosing Health Information Online[J].Decision Support Systems, 2010,49(2):138-150
[51] Weinstein N. D., Nicolich M. Correct and Incorrect Interpretations of Correlations between Risk Perceptions and Risk Behaviors[J].Health Psychology, 1993,12(3):235
[52] Weinstein N. D. Effects of Personal Experience on Self-protective Behavior[J].Psychological Bulletin, 1989,105(1):31-50
[53] Acquisti A. Privacy in Electronic Commerce and the Economics of Immediate Gratification[C].Proceedings of the 5th ACM Conference on Electronic Commerce, 2004
[54] Liang H., Saraf N., Hu Q., et al. Assimilation of Enterprise Systems: The Effect of Institutional Pressures and the Mediating Role of Top Management [J].MIS Quarterly, 2007,31(1):59-87
[55] Jansen L. A., Appelbaum P. S., Klein W. M. P., et al. Unrealistic Optimism in Early-phase Oncology Trials [J].Ethics & Human Research, 2011,33(1):1-8
[56] Hamamura T., Heine S. J., Takemoto T. R. S. Why the Better-than-average Effect Is a Worse-than-average Measure of Self-enhancement: An Investigation of Conflicting Findings from Studies of East Asian Self-evaluations[J].Motivation and Emotion, 2007,31(4):247-259
[57] Hablemitoglu S., Yildirim F. Gender Differences in the Influence of Egocentrism and Focalism on Turkish Young People's Optimism: Are Young Men More Optimistic or Young Women More Realistic?[J].World Applied Sciences Journal, 2008,5(1):42-53
[58] Coelho M. P. Unrealistic Optimism: Still a Neglected Trait[J].Journal of Business and Psychology, 2010,25(3):397-408
[59] 王炼,贾建民.突发性灾害事件风险感知的动态特征—来自网络搜索的证据[J].管理评论, 2014,26(5):169-176
[60] Sharot T., Riccardi A. M., Raio C. M., et al. Neural Mechanisms Mediating Optimism Bias[J].Nature, 2007,450(7166):102-105