A Longitudinal Analysis of Undergraduate Students' Internet Security Perceptions and Purchasing Behavior (2017)

INTRODUCTIONThe scope, type, and liability of cyber attacks are startling. From a business perspective, the 2014 Cost of Cyber Crime study found that cyber attacks cost the average U.S. company $12.7 million, an increase of 9% from 2013 (Ponemon, 2015). In particular, the Ponemon Institute found in a survey of more than 375 information technology (IT) and IT security practitioners in U.S. organizations that the total annual cost of phishing for the average organization is more than $3.7 million (CyberheistNews, 2015). In addition, the FBI's Internet Crime Complaint Center (IC3) found that there has been a 270% spike in victims and cash losses caused by a scam in which cyber criminals spoof emails from executives at a victim organization in a bid to execute unauthorized international wire transfers (IC3, 2015). According to the FBI, 1,198 firms in the U.S. lost a total of $179 million between October 2013 and December 2014 in these business e-mail compromise (BEC) scams, also known as CEO fraud. Between October 2013 and August 2015, nearly $750 million in such scams was stolen from more than 7,000 victim companies in the U.S. Two of these victim in 2015, for example, were Ubiquiti Networks Inc. of San Jose, CA and Scoular Company of Omaha, NE who lost $46.7 million and $17.2 million, respectively (Krebs, 2015).Individuals have also been victims. During the first eight months of 2015, the National Counterintelligence and Security Center estimated that there were over 500 spear-phishing breaches (Sjouwerman, 2015). Spear-phishing has affected 47% of adults in the U.S. in the last three years. The U.S. Office of Personnel Management breach, for example, exposed the data of over 22 million individuals. The potential result is identity theft. In 2012, alone, approximately 16.6 million individuals were victims of identity theft (Shadel, 2014). Losses were estimated to be $21 billion (Javelin Strategy and Research, 2013). In response to these scammers, cheats, and criminals, AARP even created a Fraud Watch Network, a network that had nearly 500,000 U.S. members by the end of 2014 (Love, 2015).Because individuals shop online, there may be additional exposure to crime. Even lesser known websites such as Pinterest have turned into learning and shopping hubs. Pinterest had 79 million unique visitors in February 2015, a 47% increase from 2014, had more than 50 billon pins, and had two-thirds of its content created by brands (Ortutay, 2015). Interestingly, however, although the Center for the Digital Future at the University of Southern California (USC) found that 68% of adult Internet users shop online, only 48% of respondents worried about privacy when shopping online (Ortutay, 2011).As a result of this crime wave, corporate legal risks are becoming evident. Target and Visa, for instance, reached a settlement in which Target would pay up to $67 million to Visa card issuers for a security breach in 2013 that left 40 million customer credit card numbers compromised (Arstechnica.com, 2015). In addition, the U.S. Court of Appeals reinstated a liability case against Neiman Marcus for the potential damage to consumers from a data breach of 350,000 customers, 9,000 of which were used for fraud (Nash, 2015). Moreover, in August 2015, the third U.S. Federal circuit court ruled that the Federal Trade Commission (FTC) has the power to take action against organizations that employ poor IT security practices (CyberheistNews, 2015). The ruling was part of a lawsuit between the FTC and hotel chain Wyndham that was hacked three times in 2008 and 2009, exposing credit card data for more than 619,000 customers and causing $10.6 million in loss due to the fraud.Given that cyber crime and its resultant legal risk continue to be an organizational challenge, this study was undertaken to better understand perception and behavior from a consumer perspective. The focus of this research is the undergraduate business student population, in other words, consumers and the next generation of business employees and management. …