180 likes | 308 Views
Assessing Home Internet Users’ Demand for Security. Brent Rowe, RTI International Dallas Wood, RTI International. Study Sponsor. The Institute for Homeland Security Solutions (IHSS) – a research consortium funded by the U.S. Department of Homeland Security ( www.ihssnc.org )
E N D
Assessing Home Internet Users’ Demand for Security Brent Rowe, RTI International Dallas Wood, RTI International
Study Sponsor • The Institute for Homeland Security Solutions (IHSS) – a research consortium funded by the U.S. Department of Homeland Security (www.ihssnc.org) • IHSS was established to conduct applied research in the social and behavioral sciences to address a wide range of homeland security challenges
ISP-based Security Solutions • ISPs are in prime position to observe internet traffic and quarantine infected users (van Eeten, 2010) but • Few ISPs actually respond to signs of infection or misbehavior (Arbor Networks, 2009). • Many policies have been proposed to encourage ISPs to pursue more active roles in security (Lightman & Posner, 2004; Moore, 2010; Clayton, 2010).
Costs to Home Internet Users • ISP-led security solutions have the potential to impose at least three kinds of costs on home internet users: • Increases in the cost of internet access; • time spent complying with ISP-determined security requirements; and • limits on their internet access.
Research Questions • Quantify Home Internet Userpreferences using discrete choice experiments (n=3,635); • Explore Home Internet User WTP for changes in individual ISP security package features; • Explore Home Internet UserWTP for hypothetical security packages.
Methodology: Discrete Choice Experiments • Astated preference survey method that uses “choice experiments” to assess individuals’ preferences for specific goods, services, or polices. • Experiments ask individuals to choose between two or more hypothetical goods/services/polices. Each differing along several characteristics or “attributes”.
Attributes: ISP Security Strategies • Pay Additional Monthly Fee • $4 per month • $7 per month • $12 per month • Spend Time Complying with ISP security requirements • 0.5 hours per month • 1 hour per month • 3 hours per month • Allow ISPs to Restrict Subscriber Access to the Internet • Never • Restrict usage to certain functions/websites if user is infected w/malware • Entirely cut-off internet access if infected user is infected w/malware
Attributes: Cyber Security Outcomes • Reduced risk of your computer slowing down or crashing • Not Reduced • Somewhat Reduced • Greatly Reduced • Reduced risk of your identity being stolen • Not Reduced • Somewhat Reduced • Greatly Reduced • Reduced risk to other individuals and business from your insecurity • Not Reduced • Somewhat Reduced • Greatly Reduced
Random Utility Model • We only observe the choices respondents make. To quantify preferences, we need to make assumptions about respondent utility function. ujt= vjt(Xjt)+ εjt, j = 0, 1, 2, t = 1,….,7 • Where v is deterministic component of utility that depends on vector of attribute levels Xjtand εjtis a random error.
Research Question 1:Quantified Preferences • Home InternetUsers prefer: • Smaller monthly fees • Less time complying with security requirements • Not having their internet connection interrupted • Great reductions in cyber security risks
Research Question 3:WTP for Hypothetical ISP Packages • Hypothetical ISP Package 1 (Most Preferred): fee = $0, time = 0 hours, ISP can never limit Internet access, and all security risks are “greatly reduced.” • Hypothetical ISP Package 2 (Quarantine): fee = $0, time = 1 hour, ISP can entirely cut off Internet access, and only security risks to others “greatly reduced.”
Future Research Questions • We have seen U.S. Home Internet Users are willing to pay for ISP security packages, but that they can also be ill informed wrt cyber security. • If users were better aware of cyber security threats, would they pay more for security? • We investigate this question in a forthcoming paper using 7 information treatments
Additional Information • If you would like additional information please contact: Dallas Wooddwood at rti.org Brent Rowe browe at rti.org