False Impressions: Contrasting Perceptions of Security as a Major Impediment to Achieving Survivable Systems

William Yurcik Aashish Sharma David Doss Illinois State University Department of Applied Computer Science Survivability-Over-Security (SOS) Research Group {wjyurci,ashish,dldoss}@ilstu.edu Abstract: There is a distinct lack of basic understanding of user problems with current web technologies where the majority of electronic transactions occur at present. Our results show that a user’s level of trust and risk are based on perceptions of website design that are significantly different based on prior knowledge. We report that corporations are already exploiting this result to maximize the use of superficial security cues that do not provide protection while minimizing investment in technological security solutions that do provide protection. Implications of this finding may help explain the measured increasing lack of Internet security and thus survivability of web-based information systems. 1.0 Introduction Although a large proportion of users refuse to transact online due to their concerns about security, the actual source(s) of those concerns are not well understood. Marketing studies provide data on customers’ opinions and preferences, but do not capture customers’ actual thoughts and behaviors as they transact with sites. On the other hand, usability testing of websites does yield some data on users’ behavior as they interact with sites, but there is little experimental control and the lessons learned from tests are rarely applied to general models of user behavior [7]. Despite the substantial expenditure by many companies in online security, there is very little published research on the specific factors that influence consumers’ perceptions of the security of websites. While security is only one aspect of a consumer’s experience with a commercial website, it is an important one and may be a strong determinant of whether or not a user decides to begin or continue an online transaction. In order to ensure a positive user experience, it is therefore necessary to fully understand how different users perceive the risks associated with transacting online as well as how they perceive the various measures employed by sites to ensure secure transactions. In this paper we have focused exclusively on website security since this is where the overwhelming majority of electronic transactions presently occur. The remainder of this paper is organized as follows: Sections 2 and summarize security evaluations by experts and novice users respectively. Section 4 details false security cues found among novice users. We conclude with a summary, conclusions, and future directions in Section 5. 2.0 Website Evaluation By Security Experts In order to understand consumers’ perceptions of the security of a website, it is necessary to first establish what website security techniques are available and what can be determined about the security of a specific website from inspection and interaction. Under a controlled setting we gathered information from Internet security experts to obtain a baseline measure of security metr ics found across different sets of websites [8]. The expert group expressed that while there is a wide range of possible security techniques available, only a subset of these techniques will be employed by any single web site, not all techniques will be implemented properly, none of the techniques is completely foolproof, and increased security is a direct tradeoff with performance and usability. As a group these experts embodied the technical knowledge needed to determine if security vulnerabilities exist and the cues for their manifestation. During initial evaluation, experts would conduct what is known as a “pre-attack”. This pre-attack, which is also used by crackers in choosing potential targets, is an evaluation process to determine if a website’s security vulnerabilities can be exploited: