Perceived IT security risks of cloud computing: Conceptualization and scale development

International Conference on Information Systems, ICIS 2012

Volumn 4, Issue , 2012, Pages 3468-3487

  Ackermann, Tobias ^a   Benlian, Alexander ^a   Widjaja, Thomas ^a   Buxmann, Peter ^a  

^a DARMSTADT UNIVERSITY OF TECHNOLOGY   (Germany)

Author keywords

Cloud computing; IS security; IT outsourcing; Multi dimensional scale development; Perceived IT security risks

Indexed keywords

ANALYSIS OF DATA; COMPLEX NATURE; IS SECURITY; IT OUTSOURCING; IT SECURITY; LITERATURE REVIEWS; RISK DIMENSIONS; SCALE DEVELOPMENT;

CLOUD COMPUTING; INFORMATION SYSTEMS; OUTSOURCING; SECURITY OF DATA; SECURITY SYSTEMS;

RISK ASSESSMENT;

EID: 84886495454     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (101)

1. Ackermann, T., Miede, A., Buxmann, P., and Steinmetz, R. 2011. "Taxonomy of Technological IT Outsourcing Risks: Support for Risk Identification and Quantification, " in Proceedings of the 19th European Conference on Information Systems (ECIS), Paper 240.
2. Ajzen, I., and Fishbein, M. 1980. Understanding Attitudes and Predicting Social Behavior, Prentice Hall, Englewood Cliffs, NY.
3. Ajzen, I. 1985. "From intentions to actions: A theory of planned behavior, " in Action-control: From cognition to behavior, J. Kuhl, and J. Beckmann (eds.), Springer, Heidelberg.
4. Alvarez, G., and Petrović, S. 2003. "A new taxonomy of Web attacks suitable for efficient encoding, " Computers & Security (22:5), pp. 435-449.
5. Anderson, J., and Gerbing, D. 1991. "Predicting the Performance of Measures in a Confirmatory Factor Analysis With a Pretest Assessment of Their Substantive Validities, " Journal of Applied Psychology (76:5), pp. 732-740.
6. Andrews, F. 1984. "Construct Validity and Error Components of Survey Measures: A Structural Modeling Approach, " Public Opinion Quarterly (48:2), pp. 409-442.
7. Armbrust, M., Fox, A., Griffith, R., Joseph, A. D., Katz, R., Konwinski, A., Lee, G., Patterson, D., Rabkin, A., and Stoica, I. 2010. "A view of cloud computing, " Communications of the ACM (53:4), pp 50-58.
8. Armstrong, J., and Overton, T. 1977. "Estimating Nonresponse Bias in Mail Surveys, " Journal of Marketing Research (14:3), pp. 396-402.
9. Avižienis, A., Laprie, J.-C., Randell, B., and Landwehr, C. 2004. "Basic Concepts and Taxonomy of Dependable and Secure Computing, " IEEE Transactions on Dependable and Secure Computing (1:1), pp. 11-33.
10. Bagozzi, R. P. 2011. "Measurement and Meaning in Information Systems and Organizational Research: Methodological and Philosophical Foundations, " MIS Quarterly (35:2), pp. 261-292.
11. Bahli, B., and Rivard, S. 2003. "The Information Technology Outsourcing Risk: A Transaction Cost and Agency Theory-based Perspective, " Journal of Information Technology (18:3), pp. 211-221.
12. Bahli, B., and Rivard, S. 2005. "Validating measures of information technology outsourcing risk factors, " Omega (33:2), pp. 175-187.
13. Bansal, G. 2011. "Security Concerns in the Nomological Network of Trust and Big 5: First Order Vs. Second Order, " in Proceedings of the 32nd International Conference on Information Systems (ICIS), Paper 9.
14. Barki, H., Titah, R., and Boffo, C. 2007. "Information System Use-Related Activity: An Expanded Behavioral Conceptualization of Individual-Level Information System Use, " Information Systems Research (18:2), pp. 173-192.
15. Benlian, A., and Hess, T. 2011. "Opportunities and risks of software-as-a-service: Findings from a survey of IT executives, " Decision Support Systems (52:1), pp. 232-246.
16. Benlian, A., Koufaris, M., and Hess, T. 2011. "Service quality in Software-As-A-Service: Developing the SaaS-QUAL measure and examining its role in usage continuance, " Journal of Management Information Systems (28:3), pp. 85-126.
17. Bettman, J. R. 1973. "Perceived Risk and Its Components: A Model and Empirical Test, " Journal of Marketing Research (10:2), pp. 184-190.
18. Boehm, B. W. 1991. "Software Risk Management: Principles and Practices, " IEEE Software (8:1), pp. 32-41.
19. Bollen, K. A. 1989. Structural Equations with Latent Variables, John Wiley & Sons, New York.
20. Bollen, K. A., and Davis, W. R. 2009. "Causal Indicator Models: Identification, Estimation, and Testing, " Structural Equation Modeling (16:3), pp. 498-522.
21. Bollen, K. A. 2011. "Evaluating Effect, Composite, and Causal Indicators in Structural Equation Models, " MIS Quarterly (35:2), pp. 1-14.
22. Bolton, R. 1993. "Pretesting Questionnaires: Content Analyses of Respondents' Concurrent Verbal Protocols, " Marketing Science (12:3), pp. 280-303.
23. vom Brocke, J., Simons, A., Niehaves, B., Riemer, K., Plattfaut, R. and Cleven, A. "Reconstructing the Giant: On the Importance of Rigour in Documenting the Literature Search Process, " in Proceedings of the 17th European Conference on Information Systems, 2009.
24. Browne, M. W., and Cudeck, R. 1993. "Alternative Ways of Assessing Model Fit, " in Testing Structural Equation Models, Bollen, K. A. and Long, J. S. (eds.), Sage, Newbury Park, CA.
25. Carmines, E. G., and McIver, J. P. 1981. "Analyzing Models with Unobserved Variables, " Social Measurement: Current Issues, G. W. Bohrnstedt and E. F. Borgatta (eds.), Sage Publications, Beverly Hills, CA, pp. 65-115.
26. Carr, M. J., Konda, S. L., Monarch, I., Ulrich, F. C., and Walker, C. F. 1993. "Taxonomy-Based Risk Identification", Technical report CMU/SEI-93-TR-6, Carnegie Mellon University.
27. Casalo, L., Flavian, C., and Guinaliu, M. 2007. "The Impact of Participation in Virtual Brand Communities on Consumer Trust and Loyalty, " Online Information Review (31:6), pp. 775-792.
28. Chellappa, R. K., and Pavlou, P. 2002. "Perceived Information Security, Financial Liability, and Consumer Trust in Electronic Commerce Transaction, " Journal of Logistics Information Management (15: 5/6), pp. 358-368.
29. Churchill, G. 1979. "A Paradigm for Developing Better Measures of Marketing Constructs, " Journal of Marketing Research (16:1), pp. 64-73.
30. Chwelos, P., Benbasat, I., and Dexter, A. 2001. "Research Report: Empirical Test of an EDI Adoption Model, " Information Systems Research (12:1), pp. 304-321.
31. Comps, B., and Slovic, P. 1979. "Newspaper Coverage of Causes of Death, " Journalism Quarterly (56:4), pp. 837-849.
32. Cooper, H., Hedges, L. V., and Valentine, J. C. 2009. The Handbook of Research Synthesis and Meta-Analysis, Russell Sage Foundation, New York, NY.
33. Cunningham, S. 1967. "The Major Dimensions of Perceived Risk", in "Risk Taking and Information Handling in Consumer Behavior", D. F. Cox (ed.), Harvard University Press, pp. 102-108.
34. Currie, W. L. 2003. "A knowledge-based risk assessment framework for evaluating web-enabled application outsourcing projects, " International Journal of Project Management (21:3), pp. 207-217.
35. Currie, W. L., Desai, B., and Khan, N. 2004. "Customer evaluation of application services provisioning in five vertical sectors, " Journal of Information Technology (19:1), pp 39-58.
36. Davis, F. D. 1989. "Perceived usefulness, perceived ease of use, and user acceptance of information technology, " MIS Quarterly (13: 3), pp. 319-339.
37. Dawoud, W., Takouna, I., and Meinel, C. 2010. "Infrastructure as a service security: Challenges and solutions, " 7th International Conference on Informatics and Systems (INFOS), pp. 1-8.
38. DeVellis, R. F. 2003. Scale Development, SAGE Publications.
39. Diamantopoulus, A., and Winklhofer, H. M. 2001. "Index Construction with Formative Indicators: An Alternative to Scale Development, " Journal of Marketing Research (38:2), pp. 269-277.
40. Diamantopoulus, A., Riefler, P., and Roth, K. P. 2008. "Advancing Formative Measurement Models, " Journal of Business Research (61:12), pp. 1203-1218.
41. Diamantopoulos, A. 2011. "Incorporating Formative Measures into Covariance-Based Structural Equation Models, " MIS Quarterly (35:2), pp. 335-358.
42. Earl, M. 1996. "The Risks of Outsourcing IT, " Sloan Management Review (37:3), pp. 26-32.
43. Featherman, M. S., and Pavlou, P. A. 2003. "Predicting e-services adoption: a perceived risk facets perspective, " International Journal of Human-Computer Studies (59:4), pp. 451-474.
44. Featherman, M. S., Valacich, J., and Wells, J. 2006. "Is that Authentic or Artificial? Understanding Consumer Perceptions of Risk in e-Service Encounters, " Information Systems Journal (16:2), pp. 107-134.
45. Fishbein, M., and Ajzen, I. 1975. Belief, Attitude, Intention and Behavior: An Introduction to Theory and Research, Addison-Wesley, Reading, MA.
46. Flavian, C., and Guinaliu, M. 2006. "Consumer Trust, Perceived Security and Privacy Policy, " Industrial Management & Data Systems (106:5), pp. 601-620.
47. Fornell, C., and Larcker, D. 1981. "Evaluating Structural Equation Models with Unobservable Variables and Measurement Error, " Journal of Marketing Research (18), pp. 39-50.
48. Gefen, D., Karahanna, E., and Straub, D. 2003. "Trust and Tam in Online Shopping: An Integrated Model, " MI (27:1), pp. 51-90.
49. Gewald, H., and Dibbern, J. 2009. "Risks and Benefits of Business Process Outsourcing: A Study of Transaction Services in the German Banking Industry, " Information & Management (46:4), pp. 249-257.
50. Gewald, H., Wullenweber, K., and Weitzel, T. 2006. "The influence of perceived risks on banking managers' intention to outsource business processes-a study of the German banking and finance industry, " Journal of Electronic Commerce Research (7:2), pp 78-96.
51. Goncalves, V. and Ballon, P. 2009. "An exploratory analysis of Software as a Service and Platform as a Service models for mobile operators" 13th International Conference on Intelligence in Next Generation Networks (ICIN), pp. 1-4.
52. Gouscos, D., Kalikakis, M., and Georgiadis, P. 2003. "An Approach to Modeling Web Service QoS and Provision Price, " in Proceedings of the Fourth International Conference on Web Information Systems Engineering Workshops (WISEW), pp. 121-130.
53. Gigerenzer, G. 2004. "Dread risk, September 11, and fatal traffic accidents, " Psychological science (15:4), p 286.
54. Gregory, R., and Mendelsohn, R. 1993. "Perceived risk, dread, and benefits, " Risk Analysis (13:3), pp 259-264.
55. Hahn, E. D., Doh, J. P., and Bunyaratavej, K. 2009. "The Evolution of Risk in Information Systems Offshoring: The Impact of Home Country Risk, " MIS Quarterly (33:3), pp. 597-616.
56. Havlena, W. J., and DeSarbo, W. S. 1990. "On the Measurement of Perceived Consumer Risk, " Decision Sciences (22), pp. 927-939.
57. Hinkin, T. R. 1998. "A Brief Tutorial on the Development of Measures for Use in Survey Questionnaires, " Organizational Research Methods (1:1), pp. 104-121.
58. Hu, L. T., and Bentler, P. M. 1999. "Cutoff Criteria for Fit Indexes in Covariance Structure Analysis: Conventional Criteria Versus New Alternatives, " Structural Equation Modeling (6:1), pp. 1-55.
59. Jarvis, C. B., MacKenzie, S. B., and Podsakoff, P. M. 2003. "A Critical Review of Construct Indicators and Measurement Model Misspecification in Marketing and Consumer Redearch, " Journal of Consumer Research (30:2), pp. 199-218.
60. Jayatilaka, B., Schwarz, A., and Hirschheim, R. 2002. "Determinants of ASP choice: an integrated perspective, " IEEE, pp. 2790-2800.
61. Jensen, M., Schwenk, J., Gruschka, N., and Iacono, L. L. 2009. "On Technical Security Issues in Cloud Computing" in IEEE International Conference on Cloud Computing (CLOUD), pp. 109-116.
62. Joreskog, K., and Sorbom, D. 2006. Lisrel 8.80, Chicago: Scientific Software International.
63. Kim, D. J., Ferrin, D. L., and Rao, H. R. 2008. "A Trust-based Consumer Decision-making Model in Electronic Commerce: The Role of Trust, Perceived Risk, and their Antecedents, " Decision Support Systems (44:2), pp. 544-564.
64. Koller, M. 1988. "Risk as a determinant of Trust, " Basic and Applied Social Psychology (9:4), pp. 265-276.
65. Lacity, M. C., Khan, S. A., and Willcocks, L. P. 2009. "A review of the IT outsourcing literature: Insights for practice, " The Journal of Strategic Information Systems (18:3), pp. 130-146.
66. Lampson, B. 2009. "Usable Security: How to Get It, " Communications of the ACM (52:11), pp. 25-27.
67. Landwehr, C. E. 2001. "Computer Security, " International Journal of Information Security (1:1), pp. 3-13.
68. Levy, Y., and Ellis, T. J. 2006. "A Systems Approach to Conduct an Effective Literature Review in Support of Information Systems Research, " Informing Science Journal (9), pp. 181-212.
69. Featherman, M. S., and Pavlou, P. A. 2003. "Predicting e-services adoption: a perceived risk facets perspective, " International Journal of Human-Computer Studies (59:4), pp. 451-474.
70. Featherman, M. S., Valacich, J., and Wells, J. 2006. "Is that Authentic or Artificial? Understanding Consumer Perceptions of Risk in e-Service Encounters, " Information Systems Journal (16:2), pp. 107-134.
71. Fishbein, M., and Ajzen, I. 1975. Belief, Attitude, Intention and Behavior: An Introduction to Theory and Research, Addison-Wesley, Reading, MA.
72. Flavian, C., and Guinaliu, M. 2006. "Consumer Trust, Perceived Security and Privacy Policy, " Industrial Management & Data Systems (106:5), pp. 601-620.
73. Fornell, C., and Larcker, D. 1981. "Evaluating Structural Equation Models with Unobservable Variables and Measurement Error, " Journal of Marketing Research (18), pp. 39-50.
74. Gefen, D., Karahanna, E., and Straub, D. 2003. "Trust and Tam in Online Shopping: An Integrated Model, " MI (27:1), pp. 51-90.
75. Gewald, H., and Dibbern, J. 2009. "Risks and Benefits of Business Process Outsourcing: A Study of Transaction Services in the German Banking Industry, " Information & Management (46:4), pp. 249-257.
76. Gewald, H., Wullenweber, K., and Weitzel, T. 2006. "The influence of perceived risks on banking managers' intention to outsource business processes-a study of the German banking and finance industry, " Journal of Electronic Commerce Research (7:2), pp 78-96.
77. Goncalves, V. and Ballon, P. 2009. "An exploratory analysis of Software as a Service and Platform as a Service models for mobile operators" 13th International Conference on Intelligence in Next Generation Networks (ICIN), pp. 1-4.
78. Gouscos, D., Kalikakis, M., and Georgiadis, P. 2003. "An Approach to Modeling Web Service QoS and Provision Price, " in Proceedings of the Fourth International Conference on Web Information Systems Engineering Workshops (WISEW), pp. 121-130.
79. Gigerenzer, G. 2004. "Dread risk, September 11, and fatal traffic accidents, " Psychological science (15:4), p 286.
80. Gregory, R., and Mendelsohn, R. 1993. "Perceived risk, dread, and benefits, " Risk Analysis (13:3), pp 259-264.
81. Hahn, E. D., Doh, J. P., and Bunyaratavej, K. 2009. "The Evolution of Risk in Information Systems Offshoring: The Impact of Home Country Risk, " MIS Quarterly (33:3), pp. 597-616.
82. Havlena, W. J., and DeSarbo, W. S. 1990. "On the Measurement of Perceived Consumer Risk, " Decision Sciences (22), pp. 927-939.
83. Hinkin, T. R. 1998. "A Brief Tutorial on the Development of Measures for Use in Survey Questionnaires, " Organizational Research Methods (1:1), pp. 104-121.
84. Hu, L. T., and Bentler, P. M. 1999. "Cutoff Criteria for Fit Indexes in Covariance Structure Analysis: Conventional Criteria Versus New Alternatives, " Structural Equation Modeling (6:1), pp. 1-55.
85. Jarvis, C. B., MacKenzie, S. B., and Podsakoff, P. M. 2003. "A Critical Review of Construct Indicators and Measurement Model Misspecification in Marketing and Consumer Redearch, " Journal of Consumer Research (30:2), pp. 199-218.
86. Jayatilaka, B., Schwarz, A., and Hirschheim, R. 2002. "Determinants of ASP choice: an integrated perspective, " IEEE, pp. 2790-2800.
87. Jensen, M., Schwenk, J., Gruschka, N., and Iacono, L. L. 2009. "On Technical Security Issues in Cloud Computing" in IEEE International Conference on Cloud Computing (CLOUD), pp. 109-116.
88. Joreskog, K., and Sorbom, D. 2006. Lisrel 8.80, Chicago: Scientific Software International.
89. Kim, D. J., Ferrin, D. L., and Rao, H. R. 2008. "A Trust-based Consumer Decision-making Model in Electronic Commerce: The Role of Trust, Perceived Risk, and their Antecedents, " Decision Support Systems (44:2), pp. 544-564.
90. Koller, M. 1988. "Risk as a determinant of Trust, " Basic and Applied Social Psychology (9:4), pp. 265-276.
91. Lacity, M. C., Khan, S. A., and Willcocks, L. P. 2009. "A review of the IT outsourcing literature: Insights for practice, " The Journal of Strategic Information Systems (18:3), pp. 130-146.
92. Lampson, B. 2009. "Usable Security: How to Get It, " Communications of the ACM (52:11), pp. 25-27.
93. Landwehr, C. E. 2001. "Computer Security, " International Journal of Information Security (1:1), pp. 3-13.
94. Levy, Y., and Ellis, T. J. 2006. "A Systems Approach to Conduct an Effective Literature Review in Support of Information Systems Research, " Informing Science Journal (9), pp. 181-212.
95. Straub, D., Boudreau, M.-C., and Gefen, D. 2004. "Validation Guidelines for IS Positivist Research, " Communications of the Association for Information Systems (13), Article 24.
96. Swartz, N. 2004. "Offshoring Privacy, " Information Management Journal (38:5), pp. 24-26.
97. Tversky A., and Kahneman D. 1973. "Availability: A heuristic for judging frequency and probability, " Cognitive Psychology (5), pp. 207-232.
98. Venkatesh, V.; Morris, M.; Davis, G. B.; and Davis, F. D. 2003. "User acceptance of information technology: Toward a unified view, " MIS Quarterly (27: 3), pp. 425-478.
99. Viega, J. 2009. "Cloud Computing and the Common Man, " Computer (42:8), pp. 106-108.
100. Wheaton, B., Muthen, B., Alwin, D., and Summers, G. 1977. "Assessing Reliability and Stability in Panel Models, " Sociological Methodology (8:1), pp. 84-136.
101. Xia, W., and Lee, G. 2005. "Complexity of Information Systems Development Projects: Conceptualization and Measurement Development, " Journal of Management Information Systems (22:1), pp. 45-83.