Received 1 April 2015; accepted 15 April 2015; published 20 April 2015

ABSTRACT

To find out the psychological root cause of Secure System Development (SSD) innovation digestion behavior, this article establishes the double digestion model of SSD innovation based on psychological factors. The theoretical bases include the acceptance model, motivation theory and theories related to innovation digestion. Then, we use SPSS 19.0 and AMOS 17.0 to verify the model. The results indicate that the perceived ease of use, intrinsic motivation, and perceived usefulness have a positive and degressive influence on SSD innovation digestion intention respectively; SSD innovation digestion intention has a positive effect on SSD digestion behavior; And, absorptive capacity and risk attitude have positive regulating effects on the conversion from SSD innovation digestion intention to SSD innovation digestion behavior.

Keywords:

Secure System Development, Key Psychology and Behavior Factors, Path Analysis, Innovation Assimilation

1. Introduction

With the rapid development of network communication and electronic commerce, the contradiction between people’s demands of information service security and the security of software has become increasingly prominent. Because of massive development of application software, the quantity of system vulnerabilities has showed exponential growth, which largely results in system being attacked. SSD has provided a new way to solve these questions. SSD is an innovative system development methodology. It means embedding security elements in all phases of the system development life cycle (safety requirements analysis, safety design, safety code, safety testing and a series of safety process) and ensuring the security of software products in the whole life cycle. It’s very effective to reduce many kinds of security flaws, especially those logic errors in system security requirements analysis and system design. The SDL practice of Microsoft Corporation has showed that SSD practices can reduce the quantity of system vulnerabilities effectively with no additional costs.

Innovation digestion refers to an innovation spreads among the members of social system through certain channels over time and finally completes the process of digestion and absorption. From the initial appearance to wide range of application, it normally takes 10 to 20 years for an innovation. To accommodate the changes brought by the new technology, the management and the operation mode of organizations need to be adjusted. Through organization adoption, adaption, routine and eventually institutionalized, it marks a new approach to be fully digested and absorbed [1] . However, current researches of SSD innovation digestion merely remain on technical and management level, lack of psychology-based research. As the root cause of behavior, psychological factors play an important role in the digestive process of an innovation. Aimed at these questions, in this study, we introduce some psychological factors into classical technology acceptance model and build SSD innovation digestion behavior model based on psychological factors. We try to give the psychology explanation of complex SSD innovation digestion behaviors.

Technology Acceptance Model (TAM) [2] is an universal model proposed by Davis in 1975, when he was using Reasoned Action Theory [3] to study the user’s adoption of information systems. Based on this theory, scholars have conducted extensive applied researches [4] . Because of the difference of research area and acceptance objects, they have different topologies.

In order to construct a scientific, comprehensive and rational model of individual psychological and behavioral factors of innovation assimilation, we study the relationship between perceived usefulness, perceived ease of use and behavioral intention and actual behavior, and finally we get the basic infrastructure based on TAM,. Then combining Motivation Theory with theories of innovation digestion [5] -[8] , we introduce intrinsic motivation. Considering the two kinds of extrinsic motivation (perceived usefulness and perceived ease of use), we constitute basic psychological and behavioral model of SSD innovation digestion. Together with other factors that affect SSD innovation digestion [9] -[11] , we introduce absorption capacity and risk attitude as two manipulated variables for further study. Finally, we use SPSS19.0 and AMOS 17.0 to verify the model, and analyze the impacts of key factors on the behavior of SSD innovation assimilation.

2. Theoretical Analysis and Research Hypothesis

In this model, we consider various innovative psychological and behavioral factors, which influence SSD innovation digestion. The following will be introduced to factors constructing the model and propose research hypotheses.

2.1. Technology Acceptance Model and Application

Technology Acceptance Model (TAM) thinks that actual use behavior is determined by behavioral intention, while behavior intention is determined by helpful attitude and perceived usefulness. Helpful attitude is determined by perceived usefulness and perceived ease of use, in which perceived usefulness is determined by perceived ease of use and external variables together, and perceived ease of use is determined by external variables [2] . Subsequent scholars applied TAM widely in many fields. For instance, personal computers, e-mail system, word processing software, knowledge management system, ERP application system, and the complex electronic commerce application systems. Because of the difference of acceptance objects, technology acceptance models have different topological structure, empirical variables are not identical to each other as well [4] . As shown in Table 1.

2.2. SSD Innovation Digestion Behavior Model Based on Psychological Factors

This research focuses on mining psychological and behavioral factors of SSD innovation assimilation. It has nothing to do with the external factors that affect perceived usefulness, perceived ease of use, so we don’t take into account of the external factors when referencing technology acceptance model. It also does not take helpful attitude into consideration, because Davis found that helpful attitude only has partial mediation effect on the impact of perceived usefulness to the behavioral intention of using [5] . According to actual needs of this re-

search, we study the relationship between perceived usefulness, perceived ease of use, SSD innovation assimilation intention and SSD innovation digestion behavior.

Perceived usefulness reflects that the extension of people to use a specific system to improve his work performance, and perceived ease of use reflect the degree of easy to use a system [2] . From the view of motivation theory, intrinsic motivation means that people do something because of a certain individual behavior itself or the pure joy and satisfaction with this behavior, extrinsic motivation is raised by praise, reward and honor [6] . As perceived usefulness and perceived ease of use are created by external influence rather than pure pleasure and satisfaction of the action, they can be viewed as extrinsic motivation.

Psychological research shows that there is a close relationship between man’s need and intrinsic motivation. Intrinsic motivation is the source of behavior. In the study of psychological and behavioral factors, intrinsic motivation is an essential part. Mentioned in the ERP digestion innovation model [7] , intrinsic motivation and perceived usefulness are important factors affecting the individual digestion. In the research of the influence factors of continued use of mobile internet business, it mentions that perceived usefulness is an extrinsic motive, which is a complement to intrinsic motive.

Therefore, in the research of SSD innovation digestion psychological and behavioral factors, it regards the two extrinsic motivation, perceived usefulness, perceived ease of use, together with intrinsic motivation as the main measure variables influencing SSD innovation digestion intention and behavior, and then puts forward the SSD basic research model (see Figure 1). According to the above, we propose the following four hypotheses:

Hypothesis 1 (H1): Intrinsic motivation has a positive effect on individual SSD assimilation intention.

Hypothesis 2 (H2): Perceived usefulness has a positive effect on individual SSD assimilation intention.

Hypothesis 3 (H3): Perceived ease of use has a positive effect on individual SSD assimilation intention.

Hypothesis 4 (H4): Individual SSD innovation assimilation intention has a positive effect on individual SSD innovation digestion behavior.

2.3. SSD Innovation Assimilation Behavior Model Based on Psychological Factors with Regulated Variables

In the process of SSD innovation assimilation, in addition to motivation factors, other factors may also play a role in the regulation of the final assimilation behavior. In this study, we considered the influence of two regulated variables (absorptive capacity and risk attitude) on the final behavior. Concrete analysis is as follows.

Absorptive capacity is proposed by Cohen and Levinthal when they analyzed the role of corporate research and development [9] . According to the experience of few successful industrialization of the backward country, enterprise absorbing knowledge from the outside can be divided into four phases: acquisition, adoption, transformation and utilization. Then in the process of industrialization, the developing countries achieve technical catch-up of developed countries through the introduction of foreign technology, FDI and other ways. In the “absorption capacity: a new idea of learning and innovation”, it put forward that individual ability of absorp-

tion is different, and it will affect organizational innovation adoption and digestion [9] . Actually, knowledge absorption is the process of innovation adoption and the digestion. ERP innovation digestion model [6] also uses empirical method to demonstrate the regulation effect of absorption capacity. Thus absorptive capacity plays an important regulating role in the process of innovation assimilation.

Risk attitude refers to people’s attitude towards risk. It is a kind of selected mind state based on the uncertainty of positive or negative influence on the target or a kind of selected response to cognitive uncertainty of importance. Risk attitude is generally divided into three types: risk aversion, risk neutral and risk preference. Risk aversion is the degree of reluctance when a person accepts a trade of uncertain benefits relative to accepts another trade of more insurance but may also have a lower expected return. Risk neutral is relative to the concept of risk preference and risk aversion, risk neutral investors does not require risk compensation for their risk. We called the world with all risk neutral man neutral world [10] . And the process of innovation diffusion is also exist uncertainty benefits, so personal risk attitudes will affect the diffusion of the SSD. In addition, in the innovation assimilation model of the micro decision-making theory [11] , it introduced risk aversion index as variables of the minimum required capital discount rate when regulating personal innovation adoption, and it thought that risk attitude will also affect innovation assimilation. It is clear that risk attitude has important effect on innovation digestion behavior adjustment. Thus we put forward the following hypotheses:

Hypothesis 5 (H5): Absorption capacity has positive effect on the transformation of SSD innovation assimilation intention into behavior

Hypothesis 6 (H6): Risk attitude has positive effect on the transformation of SSD innovation assimilation intention into behavior

After the introduction of regulated variables, finally, we establish SSD innovation assimilation double-layer model based on psychological factors. As shown in Figure 1.

3. Research Design

We use the method of survey search to verify the assumption model presented above. Referenced to the items used in domestic and foreign related empirical literature, we design the scale of questionnaire. Besides, according to the characteristics of SSD innovation, we do appropriate adjustments and extensions. The measure method of perceived usefulness and perceived ease of use comes from the research literature of Davis [12] , each of them is measured by 4 items. The measurement of behavior intention comes from the Davis, Taylor and Todd [13] , it is measured by 3 items. For innovation digestion behavior, we referenced the literature of Premkumar and Bhattacherjee [14] , it is measured by 3 items. Intrinsic motivation is set by Maslow’s hierarchy of needs theory, which divided people’s demands into five levels, from low to high was the physiological needs, safety needs, social needs, esteem needs and self actualization needs [15] [16] . Because the users’ participation in the SSD innovation digestion is a kind of knowledge representation and contributions, it belongs to the high level needs satisfied way. Therefore, the research regarded the 3 items, social needs, esteem needs and self realization need as the measurement of intrinsic motivation. As for risk attitude and absorption capacity, according to the characteristics of their own elements and the SSD innovation, discussing with relevant experts and enterprise management personnel, we measure them by 5 items from two dimensions. There are 22 measurement items in the questionnaires totally. The scale uses Likert magnitude scale to design, using 1 to 5 five digital ID to re- present respondents’ identity degree of related statements (1 represents strongly opposed, 5 represents strongly supported). In addition, before the formal survey we conducted many discussions about the questionnaire with the domain experts and part of the enterprise managers. After repeated changes of the content and items, the formal questionnaire is eventually formed.

The assurance of questionnaire is mainly through expert interviews, online surveys, direct issuance in the meeting site, e-mails and other forms. Questionnaire respondents include domestic and foreign well-known software engineers, safety engineers, security consultants of software companies and senior managers in related enterprises and so on. This survey recovers 215 questionnaires, with 208 valid votes.

4. Research Data Analysis

After reading lots of literature and data, combined with concrete practicability of research objectives, the study ultimately use IBM SPSS 19.0 and AMOS 17.0 alternately to analyze data. Firstly, we make reliability analysis [17] [18] to verify the reliability and applicability of the model. Then we make validity analysis and path analysis [19] -[21] to verify the assumption of the model. Finally, we verify the interaction between the moderator variables and other variables [17] [22] [23] .

4.1. Reliability Analysis

First of all, we do reliability and validity analysis of the scale to verify its stability, reliability, consistency and validity, using SPSS to achieve reliability analysis.

Reliability refers to the stability, reliability and consistency of the results according to measurement or scale. The majority of measurements use Cronbach’s alpha value to illustrate the trustworthiness of the scale. For the total scale, if Cronbach’s α value is greater than or equal to 0.8, it represents that the scale has high reliability. If Cronbach’s α value is greater than 0.7 but less than 0.8, it represents that the scale can be basically accepted; For each of the subscales, if Cronbach’s α value is greater than or equal to 0.7, it represents that the scale has high reliability. If Cronbach’s α value is greater than 0.6 but less than 0.7, it represents that the scale can be basically accepted. The greater Cronbach’s alpha value is, the greater the internal consistency is. Besides, each item’s reliability of the scale should be tested and items that cannot meet the requirement should be deleted. If item’s Cronbach’s alpha value after deleting the item is greater than the variable’s Cronbach’s alpha value, then the item should be deleted, else all items should be reserved. Results of reliability analysis are shown in Table 2.

It does not exist this kind of situation that the Cronbach’s alpha value is greater than the critical value after deleting an item in the table, and the Cronbach’s alpha values reach the level of 0.7, the total validity reach 0.951, so the questionnaire is credible.

4.2. Validity Analysis

Validity is the correctness of measurement, referring to the degree of the test or other measuring tools that can measure the characteristics of measured concept. This research uses confirmatory factor analysis method to achieve validity analysis [19] . First of all, we use fit index to verify the model’s fit measure. Then with the results of the confirmatory factor analysis, we determine the factor loading value of each item, calculate the value of the average extraction variance (AVE) and composite reliability (CR) and estimate the convergent validity of the scale. Finally, we compare each variable’s AVE square root with the correlation index in its row and column and estimate the discriminant validity of the scale.

The result of the scale’s fit index analyzed by AMOS is shown in Table 3.

As can be seen from the table, the fit index of the model has achieved an acceptable level. So we are convinced that the model has a good overall structure.

The result of the scale’s convergent validity analyzed by AMOS is shown in Table 4.

As can be seen from the table, all variables’ CR value is greater than 0.7 and AVE value is greater than 0.5. So the model has good convergent validity.

The result of the scale’s discriminant validity analyzed by AMOS is shown in Table 5.

Note: X²/df means ratio of chi-square to the degrees of freedom; RMSEA means root mean square error of approximation; GFI, IFI, CFI mean value-added fit index; PGFI, PCFI mean contracted fit index.

As can be seen from the table, each variable’s AVE square root is greater than the correlation index in its row and column. So there is good discriminant validity between different variables.

4.3. Hypothesis Verification

This research adopts SEM structural equation model to verify and analysis the path of the model. SEM can be used to explain the relationship between one or more independent variables and one or more of the dependent variables. In this paper, we use AMOS 17.0 to validate the model. Structural equation model are shown in Figure 2.

As can be seen from the table, the fit index of the model has achieved an acceptable level. In this study, the relationships among the various variables can be estimated by path coefficient and P value. According to AMOS analysis, we obtain the results of hypothesis testing. We can see that all paths are tenable significantly (P < 0.05). So the hypotheses from H1 to H4 are tenable. Results are shown in Table 6.

Referring to the path coefficients among different variables, we get the overall impacts of each variable on SSD innovation digestion behavior. The results are shown in Table 7.

According to the results in Table 7, the variables’ impacts on the SSD innovation digestion behavior (AT) arranged from large to small are SSD innovation digestion intention (IT), perceived ease of use (ES), intrinsic motivation (EM) and perceived usefulness (US).

4.4. Regulated Effect Verification

Structural equation model includes regulated variables, dependent variables, independent variables, regulated variables and so on. If the relationship between the two variables (such as the relationship between Y and X) is a function of the variable M, we called M regulated variables [17] [22] [23] .

In this study, there are two regulated variables (absorption capacity, risk attitude). Variables involve in the study are absorption capacity (AB), risk attitude (RS), SSD innovation digestion intention (IT) and SSD innovation digestion behavior (AT). First, we average the items of four latent variables and generating a new variable. Then, we do the centralized processing. Finally, we make an analysis by using the method of regression and calculate the interaction items (digestive absorption capacity × SSD innovation intention, risk attitude × SSD innovation digestion intentions), observing whether the regression coefficient is significant.

The regulation results of absorption capacity on interaction between SSD innovation digestion intention and SSD innovation digestion behavior by regression analysis is shown in Table 8.

As we can see from the table, the value of F in model 1 is 67.327 and the regression effect is remarkable. The value of R2 is 0.396 and it means the proportion of the two independent variables’ joint explanation to dependent variables is 39.6%. The value of F in model 2 is 53.071 and the regression effect is significant. The interaction item “SSD innovation digestion intention × absorption capacity” reaches a significant level (Sig < 0.05), indicating that absorption capacity plays a regulating role between SSD innovation digestion intention and SSD innovation digestion behavior. Besides, the values of R2 in model 2 is 0.438, increasing 4.2% compared to model 1. That means after joining the absorption capacity regulating variable, the model get optimized. Because the regression coefficient of the interaction item “absorption capacity × SSD innovation digestion intention” is positive, absorption capacity has a positive regulating effect on SSD innovation digestion behavior. So hypothesis H5 is tenable.

The regulation results of risk attitude on interaction between SSD innovation digestion intention and SSD innovation digestion behavior by regression analysis is shown in Table 9.

As we can see from the table, the value of F in model 1 is 59.520 and the regression effect is remarkable. The value of R2 is 0.367 and it means the proportion of the two independent variables’ joint explanation to dependent variables is 36.7%. The value of F in model 2 is 52.771, and the regression effect is significant. The in-

Note: * represent significant when Sig. < 0.05; ** represent significant when Sig. < 0.01 (the same below).

teraction item “SSD innovation digestion intention × risk attitude” reaches a significant level (Sig. < 0.05), indicating that risk attitude plays a regulating role between SSD innovation digestion intention and SSD innovation digestion behavior. Besides, the value of R2 in model 2 is 0.437, increasing 7% compared to model 1. That means after joining the regulating variable of risk attitude, the model get optimized. Because the regression coefficient of the interaction item “risk attitude × SSD innovation digestion intention” is positive, risk attitude has a positive regulating effect on SSD innovation digestion behavior. So hypothesis H6 is tenable.

Through the above analysis, it can be seen that absorption capacity and risk attitude play a positive regulating role in the process of transaction from SSD innovation digestion intention to SSD digestion innovation behavior.

5. Results Analysis and Discussion

Through model proposition, hypothesis verification, regulation variables analysis and control variables analysis, we have three important conclusions.

Conclusion one: intrinsic motivation, perceived usefulness and perceived ease of use has a positive significant influence on SSD digestion innovation intention, and the order from large to small is perceived ease of use, intrinsic motivation and perceived usefulness.

Conclusion two: SSD innovation digestion intention has a positive significant effect on SSD innovation digestion behavior.

Conclusion three: absorption capacity and risk attitude play a positive regulating role in the process from SSD innovation digestion intention to SSD digestion innovation behavior.

We can see from the conclusions that after adopting security system development, the influence of perceived ease of use on innovation digestion process is the strongest. That is to say, in the process of the security system diffusion, we need to pay attention to whether the SSD process is easy to master by users firstly. Secondly, we need to pay attention to individual intrinsic motivation to SSD adoption and personal perceived value of SSD method. To improve perceived ease of use, we can simplify the process of security system development and promote the convenience of application. To improve intrinsic motivation, we can increase the personal understanding of the security system development and increase the correlation between individual task and SSD. To improve perceived usefulness, we can increase personal performance, quality, speed and so on through increasing practicability of secure software development. Finally, by improving the intrinsic motivation, perceived usefulness and perceived ease of use, the intention to digest SSD innovation can be improved.

In addition, absorption capacity and risk attitude play a positive regulating role in the process from SSD innovation digestion intention to SSD digestion innovation behavior, so it is necessary to increase personal absorption capacity and risk attitude in the transaction phase. To enhance individual absorption capacity, we can conduct relevant education and train of SSD and through self study and learning from others to enhance personal ability of adaption and related experience. Through the diathesis developing training and adventure activities, personal risk tolerance could be enhanced. Finally, by improving the absorption capacity, risk attitude and SSD innovation digestion intention, SSD innovation digestion behavior could be promoted.

So in the process of organization SSD innovation digestion, it should not only pay attention to the factors of organization itself, but also pay attention to the intrinsic motivation, perceived usefulness, perceived ease of use, risk attitude and psychological factors’ impacts on SSD innovation digestion behavior. Furthermore, we should focus on the development of absorption capacity and increase training and learning skills related to SSD. The quality and the ability of the whole team should be improved finally, in order to make it more feasible for the security system development.

References