Smartphone security awareness, perceptions and practices: a Welsh higher education case study

Higher Education students are purported to be heavy users of technology; specifically smartphones, which represent the “Internet of Things” (IoT). These have revolutionized every sector of public and personal lives, and also revolutionised teaching and learning within Higher Education, providing students a 21st century learning experience. The way students engage with each other, with institutions of higher learning, and with their own learning, has changed dramatically. The smartphone is used to assist with all areas of their lives; however, a plethora of security issues accompanies its use. Cybersecurity perceptions are said to inform security practices and precautionary-related behaviours. If perceptions are skewed, the necessary security behaviours might be inadequate. The main objective of this quantitative study was to investigate the level of smartphone security awareness of Higher Education students undertaking a Business degree at a Welsh University during the 2016-17 and 2018-19 academic years. Understanding whether students have acquired prior cybersecurity knowledge through formal means was key to understanding whether there was a link between security education, security awareness, smartphone security behaviours, perceptions and practices.This research therefore aimed to investigate:1) The level of smartphone security awareness depicted in the attitudes, behaviours, knowledge and competences of these university students;2) Any gender differences in terms of attitudes, behaviours, knowledge and competences regarding smartphone security awareness;3) The importance of cybersecurity awareness training.Participants in this study were largely male, with half of the participants having undertaken a prior information communication technology related type courses. Almost all participants recognised that there were security related issues with social networking and location based applications. The majority of participants did not deploy measures to prevent viruses, this being the case for significantly more females. More than half of the participants used some mechanisms to protect their data. However, significantly more of the 2018-19 participant group compared to the 2016-17 participant group indicated that they did not do this. Moreover, a large proportion of the participants were unaware of the liability linked to the use of social media and the related rules applicable. This study suggests that students who received some formal information communication technology training prior to university entry were more aware of the security risks and their behaviours reflect this. Despite this, the level of smartphone security awareness is not as high as it should be which is in keeping with other research findings. This study suggests that as technology and digital literacy gain further importance, smartphone security literacy training should not be left to chance. . It is clear that education and training should occur early in the education life cycle, and should be a lifelong learning activity.