SMARTPHONE SECURITY AWARENESS, PERCEPTIONS AND PRACTICES: A WELSH HIGHER EDUCATION CASE STUDY

Higher Education students are purported to be heavy users of technology; specifically, smartphones, which are "Internet of Things" devices. These have revolutionized every sector of public and personal life, including teaching and learning within Higher Education. The way students engage with each other, with institutions of higher learning, and with their own education, has changed dramatically. The smartphone pervades all areas of their lives with a plethora of security issues accompanying its use. Cybersecurity perceptions are said to inform security practices and precautionary-related behaviours. If perceptions are skewed, the necessary security behaviours might be inadequate. The main objective of this quantitative study was to investigate the level of smartphone security awareness of Higher Education students undertaking a Business degree at a Welsh University during the 2016-17 and 2018-19 academic years. Understanding whether students have acquired prior cybersecurity knowledge through formal means was key to understanding whether there was a link between security education, security awareness, smartphone security behaviours, perceptions and practices. This research therefore aimed to investigate: 1) The level of smartphone security awareness depicted in the attitudes, behaviours, knowledge and competences of these university students; 2) Any gender differences in terms of attitudes, behaviours, knowledge and competences regarding smartphone security awareness; and 3) The importance of cybersecurity awareness & training. Participants in this study were largely male, with half of the participants having undertaken a prior information communication technology course. Almost all participants recognised that there were issues with social networking applications and location sharing. The majority did not deploy measures to prevent viruses, this being the case for significantly more females. More than half of the participants used mechanisms to protect their data. However, significantly more of the 2018-19 participant group, as compared to the 2016-17 participant group, did not do this. This study suggests that formal information communication technology training improved awareness of the security risks and more secure behaviours. Even so, smartphone security awareness is not as high as hoped. This study suggests that as technology and digital literacy gain importance, smartphone security literacy training should not be left to chance. It is clear that education and training should occur early in the education life cycle, and be a lifelong learning activity.