IT-BASED RISKS in ADVERGAME CAMPAIGNS a Focus on Fairness and Privacy UNRESTRICTED VERSION
Total Page：16
File Type：pdf, Size：1020Kb
IT-BASED RISKS IN ADVERGAME CAMPAIGNS A focus on fairness and privacy UNRESTRICTED VERSION R.E.J. de Groot SCHOOL OF MANAGEMENT AND GOVERNANCE INFORMATION SYSTEMS & CHANGE MANAGEMENT (ISCM) FACULTY OF ELECTRICAL ENGINEERING, MATHEMATICS & COMPUTER SCIENCE INFORMATION SYSTEMS (IS) SUPERVISORS Dr. A.J.B.M. Wijnhoven (ISCM) Dr. P.A.T. van Eck (IS) DOCUMENT VERSION Final Restricted (e-version) 30-08-2012 IT-based Risks in Advergame Campaigns UNRESTRICTED VERSION Important: This version of this thesis is unrestricted and does not contain confidential chapters. The full version of this thesis is not available to the general public. 2 Master Thesis Jogchem de Groot IT-based Risks in Advergame Campaigns A focus on fairness and privacy Amsterdam, August 30 2012 Author Jogchem de Groot Programme Business Information Technology (MSc), School of Management and Governance, University of Twente Student number 0047376 E-mail [email protected] Graduation committee Fons Wijnhoven Department School of Management and Governance, University of Twente E-mail [email protected] Pascal van Eck Department Faculty of Electrical Engineering, Mathematics and Computer Science University of Twente E-mail [email protected] 3 IT-based Risks in Advergame Campaigns 4 Management summary Purpose The last few years have seen a rise in the use of advergames, games designed around a brand or product that are specifically created to communicate advertising messages. The combination of a brand with the fun and entertainment from playing a game results in outstanding performance with regard to brand memory, persuasion and visitor retention. However, due to their interactive, technological and data-oriented nature they have a risk profile different from other advertising methods, as they are also exposed to IT-based risks. The purpose of this study is to investigate what and how IT-based risks affect advergames, what their prevalence is, and to design a control to mitigate some of these risks. Results Four key areas of IT-based risk have been identified for advergames: security, where threats can target the brand owner's assets or visitors; fairness, where cheating can harm a brand's reputation and undermine the fun perceived by players, the key catalyst of advergame success. privacy, where threats are concerned with the loss of privacy sensitive data of players; and quality of experience risks, which can frustrate players and undermine fun as well. A model for fairness and privacy threats that is operationalized for the technological context of advergames, consisting of detailed descriptions of eighteen different threats that are categorized according to what part of an advergame's architecture they target has been developed. This model enables advergame developers to understand these threats and to assess their own advergames. This model has been used to perform a risk assessment of sixteen existing advergame campaigns and the results indicate overall high vulnerability for fairness threats, with medium to low impact and medium to high overall risk. The results indicate a serious and structural problem with fairness risks in advergames which significantly reduces the reliability and predictability of advergames as advertising instrument. An effective solution to mitigate fairness risks has been designed that supports the detection of almost all forms of cheating, and that can be integrated in existing or new advergames with relatively low effort. Recommendations For brand-owners: 1. Include risk factors in the evaluation of whether the choice for an advergame is appropriate. 2. Consider the risk track record of an advergame company before selecting one. 3. Include risk management requirements in contracts negotiated with advergame creators. But always monitor and maintain an active position within the process, it is after all your brand at stake! 4. Allocate a realistic budget and time-frame on top of the basic advergame budget to assess and mitigate the risks for an advergame campaign. For advergame creators: 1. Present a realistic view about risks to the client and include risk-management (costs) in proposals. Do not accept a project to create an advergame without a budget for risk management, it is after all also your reputation as an advergame creator at stake! 2. Make the advergame creation process risk aware: involve risk evaluation and communication at every stage of the advergame creation process. 3. Implement the proposed solution in new and existing advergames. Do not rely on your own anti- cheating controls and do not rely on anti-reverse engineering techniques as they are unlikely to be effective. 4. Perform a vulnerability assessment of both client-side and server-side code before going live. For the client-side code the threat model developed as part of this research should be used. 5. During live time, continuously monitor the campaign for incidents and respond appropriately. 5 IT-based Risks in Advergame Campaigns 6 Table of Contents Acknowledgements.............................................................................................................................9 Chapter 1: Introduction......................................................................................................................11 1.1 Advergames..............................................................................................................................11 1.1.1 Advergame classification.................................................................................................12 1.1.2 Advergame creation.........................................................................................................12 1.1.3 Advergame technology.....................................................................................................13 1.2 Advergame motivation & theory.............................................................................................15 1.3 Problem description & rationale..............................................................................................17 1.4 Conceptual model....................................................................................................................18 1.5 Research approach...................................................................................................................19 1.5.1 Research structure & scope..............................................................................................20 1.5.2 Methodology....................................................................................................................21 1.5.3 Impact and relevance........................................................................................................22 1.6 Structure of report....................................................................................................................22 Chapter 2: Advergame risks..............................................................................................................23 2.1 IT-risk fundamentals................................................................................................................23 2.2 Security....................................................................................................................................24 2.3 Fairness....................................................................................................................................25 2.4 Privacy.....................................................................................................................................27 2.5 Quality of experience...............................................................................................................29 2.6 Conclusion...............................................................................................................................30 Chapter 3: Methodology, data collection and analysis......................................................................31 3.1 Threat theory development methodology (stage I)..................................................................31 3.2 Risk assessment methodology (stage II)..................................................................................32 3.2.1 Scale.................................................................................................................................33 3.2.2 Operationalization............................................................................................................33 3.2.3 Research process..............................................................................................................35 3.2.4 Limitations.......................................................................................................................36 3.3 Solution development methodology (stage III).......................................................................37 3.4 Data requirements and collection............................................................................................37 3.5 Analysis technique: reverse engineering..................................................................................38 Chapter 4: Analytical results (stage I)...............................................................................................41 4.1 Advergame architectures & fairness implications...................................................................41 4.2 Reverse engineering.................................................................................................................43