How education level influences internet security knowledge, behaviour, and attitude: a comparison among undergraduates, postgraduates and working graduates

HAIS-Q and extended KAB model

A review of previous ISA studies revealed that some pre-existing, well-established behavioural models were used to investigate the issue of ISA. The Theory of Planned Behaviour (TPB) [2], which evolved from the Theory of Reasoned Action [13], the Protection Motivation Theory (PMT) [14], the Health Belief Model [15], the General Deterrence Theory [16], the Technology Acceptance Model (TAM) [17], and the Knowledge-Attitude-Behaviour (KAB) model [4], have all attracted the interest of many ISA scholars [18].

Take the Theory of Planned Behaviour, whose key points include intention (attitude, subjective norms) and perceived behavioural control [13], which have been applied to adolescents' acceptance of friendship requests sent by online strangers on social networking sites [19]. This theory has also been used to assess students' levels of Cybersecurity awareness (CSA) at a private tertiary education institution [20], as well as to investigate Information Systems Security Policy (ISSP) compliance using two relevant theories, TPB and PMT [21].

The Theory of Planned Behaviour was composed of two items: perceived vulnerability and perceived severity [3], which have been found to be very useful in predicting behaviours related to an individual's computer security behaviours both at home and in organisations [22]; an individual's internet security perceptions and behaviours in a poly context [23] or an individual’s continued engagement in protective security [24] and Information Systems Security Policy compliance [25, 26].

These models, however, have been criticised for failing to capture the complexities and specific phenomena of cybersecurity [27]. The KAB, a dynamic and sometimes reciprocal model, on the other hand, was originally used in the health and environmental psychology area [28] as well as in the criminology and education fields [29] and has also been applied to the ISA context [30, 31]. KAB has received much attention among scholars and has been applied to various fields of research because previous research found that knowledge alone was not sufficient to cause behavioural changes [32].

Simultaneously, based on the KAB model, the conceptualised Human Aspects of Information Security Questionnaire (HAIS-Q) has been developed [33]. HAIS-Q research has shown that age, gender, resilience, job stress, education level, and some other personal characteristics can predict ISA to some extent [34]. In particular, education in information and communication technology (ICT) could positively benefit one’s IS behaviour [35, 36]. In addition, it was also found that ISA would be higher as age increased, or among the female group, which was not consistent with findings from previous research results that no ISA difference could be seen between men and women [37], if individuals possess higher education [9], if one is more conscientious and agreeable [38]; and if one owned a propensity to take fewer risks [5]. Furthermore, if one was more resilient but underwent less job stress, they would have a higher ISA [34]. Moreover, an inverse relationship between Internet addiction, cyber-loafing tendencies, and ISA has been discovered [39]. A significant positive relationship between organizational culture, security culture, and ISA [9] has also been tested from the social influence or work environment perspective. Furthermore, the bank's employees have higher ISA than the general workforce participants in all focus areas and overall [37].

Although Parson et al. [6] acknowledged in their initial HAIS-Q proposal that other social factors should be considered when using the KAB model or HAIS-Q in future research, there was no easy way to quantify social influence. To adapt the framework, Hong et al. [7] proposed an extended model of KAB (see Fig. 1), which suggested that more social contact at work implied a decrease in SEL. SEL was about how the general education level of an internet user’s immediate circle, such as family, friends, and colleagues, influenced the user's cybersecurity behaviours [7].

@@@An extended KAB model, Source: Hong, W. C. H., et al. [7].

ISA influencing factors

When attempting to understand what shapes human behaviour, looking at an individual in isolation could be problematic. It has been found that individuals of different nationality backgrounds but similar levels of ISA exhibited highly varied cybersecurity behaviours and safety responses [31]. Past studies have found personal education level [35], gender [40], age [41], stress level [34] self-efficacy [42], and cultural beliefs [9] to be salient predictors of cybersecurity awareness and behaviours. An individual’s knowledge of information and communication technology (ICT), especially, has been widely suggested to positively correlate with ISA and safe behaviours [35, 43, 44]. However, no internet users live or work in isolation from other internet users, but they are under the constant influence of one another to adjust and readjust thoughts and actions. Hence, personal factors must be viewed in conjunction with social factors. Existing studies have found that social influence is a key motivator to safe or unsafe cybersecurity behaviours [12, 19, 45–47]. Some found that the online experience of friends and family impacted our own beliefs and behaviours [46, 48], and that imitation of others is a primary reason for safe practices [45]. Similarly, the working environment where one is immersed has a tremendous impact on individuals’ ISA and practice [7, 47]. Hong et al. [7] found that workplace influence in China, especially from colleagues of lower education levels, severely deteriorated university graduates’ attitudes towards safe internet practices. The deterioration emerged as early as in the (full-time) internship period, resulting in poor cybersecurity behaviours. Worse still, respondents’ cybersecurity knowledge appeared to be reshaped by the working environment. This echoes the findings of Elkhannoubi & Belaissaoui [12], who contended that social influence plays a more significant role in developing countries, as the individuals high in ISA are only the minority of the society. SEL as a relatively objective factor that is quantifiable by published indices such as the Education Index [49] and literacy rate [50] can serve to measure how much an individual is under social influence.

The influences of education level and SEL on ISA in China

Previous research found that ISA scores increased with age [34, 37, 41] and that individuals with a higher education had higher ISA scores [9, 51]. However, some ISA education research discovered that final-year students, who were more educated and older, consistently scored the lowest in ISA when compared to other year-levels of students. To name a few, Li et al. [10] discovered that the senior group had significantly less awareness than the junior groups. Huang et al. [11] discovered that senior students were the most vulnerable to safety incidents. These findings in the Chinese context differed significantly from previous international research, in which an individual's education level was known to positively correlate with ISA [51].

At the same time, the impact of a country's GDP and development level on its population's ISA was volatile. As a result, SEL could be used as a factor to quantify external influence, including social influence and national context. SEL is concerned with how the general education level of an internet user's immediate circle, such as family, friends, and colleagues, influences the user's cybersecurity behaviours [7].

Previous research revealed some additional limitations. For example, to determine whether increased exposure to society affects ISA or whether academic growth influences it, it was necessary to compare the ISA of non-final-year students, final-year students, postgraduate students, as well as interns (final-year students), young working graduates, and experienced working graduates. A thorough literature review, however, revealed that there had been little comparative ISA research among these three groups, namely, different year levels of university students, postgraduate students, and working graduates. Furthermore, the majority of previous research on ISA in higher education had relatively small sample sizes. A sample size of 333 to 400 for each group of respondents has been recommended for better generalizability [52]. Despite the abundance of ISA research, a recent systematic review of ISA in higher education revealed that the majority of existing ISA surveys did not meet such criteria [8].

According to the findings of the preceding study, learners' attitudes towards cybersecurity would be influenced by their internal education level and external environment, which would eventually change their internet behaviours. Furthermore, education level had a positive effect and work exposure time had a negative effect on a person's ISA [7, 9].

Hence, the following hypotheses were proposed:

Sample and sampling method

Snowball and criterion sampling methods were used to recruit participants. Students were invited to complete the questionnaire via email or personal contact, and then they contacted their peers to participate in the survey. Furthermore, as a criterion for participation, all students were first screened as having received cybersecurity training during their higher education and as having completed a mandatory full-time internship for half a year or a full year in their final year of study, allowing comparisons to be made between different levels of work exposure (i.e. prior, short-term and long-term work exposure).

In total, 1882 valid responses were obtained from more than ten higher education institutions and 110 Chinese businesses. There were 480 year 1 students, 372 year 2–3 students, 325 final-year students, 230 postgraduate students (age range = 18–25), and 343 young working graduates, 132 experienced working graduates (age range = 18–46); 938 majored in liberal arts and social sciences, 499 natural sciences, and 445 technology and engineering; 691 males and 1191 females. Table 1 contains descriptive information about the participants.

The participants were divided into two groups based on our hypothesis, which stated that work exposure time had a negative effect on a person's ISA and education level had a positive effect. Internships, young graduates, and experienced graduates were thus regarded as the first short-term and long-term work exposure to a work environment. Furthermore, non-final-year students, final-year students, and postgraduates were viewed as three distinct educational levels.

Instrument design

Hong et al.'s [7] survey questions were adopted. They translated, verified, and adjusted the questionnaire based on the Questionnaire on Human Aspects of Information Security (HAIS-Q). It was then distributed online via one of the largest local survey platforms, Wenjuanxing, also known as Sojump [53]. Meanwhile, each question was scored using a five-point Likert scale (5 = strongly agree, 1 = strongly disagree).

The study proposal submission form was submitted to and approved by the academic committee of the first author's university in December 2021. All survey responses were kept anonymous, and their participation in this study was entirely voluntary. When participants clicked on the survey, they would be prompted to a page containing brief information about the survey and their rights to privacy and anonymity. They then provided their consent by clicking “agree to continue”.

Data analyses

Data results (N = 1882) were analysed by using IBM Statistic Package for Social Science (SPSS). Cronbach’s alpha was used to check internal reliability. Normality testing, correlations and multivariate regressions were adopted to analyse the variables.

Internal reliability

Each of the three dimensions was checked for internal reliability. The knowledge dimension reported a Cronbach’s alpha of 0.84, while attitude and behaviour had an alpha value of 0.91 and 0.77, respectively, which indicated good to excellent levels of internal consistency in the subscales.

Data normality

The moderating effects of education level and work exposure on Internet security knowledge, attitude, and behaviour variables were investigated in this study.

The education level was divided into four levels: freshmen (low education level), sophomores and juniors (medium education level), seniors (higher-medium education level), and postgraduates (advanced education level). Meanwhile, work exposure was classified as follows: non-graduation years (low exposure), graduation years (medium exposure), and working graduates (high exposure).

The ISA variables were then examined for normality. Direct hypothesis testing was not recommended because both Kolmogorov–Smirnov and Shapiro–Wilk were designed for smaller sample sizes (n ≤ 50) [54]. Skewness and kurtosis values, on the other hand, were determined manually. A larger sample with skewness between −2 and + 2 and kurtosis between −7 and 7 were considered normally distributed. Mean knowledge (skewness = −0.270, kurtosis = −0.393), mean attitude (skewness = −0.263, kurtosis = −0.783), and mean behaviour (skewness = −0.342, kurtosis = 0.351) were all within the normal range.

Demographic information

According to the range provided by the questionnaire, grades were segmented into six sequential levels (year 1, year 2–3, postgraduate students, young working graduates, experienced working graduates, and final year). Ages (18–25, 26–35, 36–45, 46), disciplines (liberal arts and social sciences, natural sciences, technology and engineering), and genders (male, female) were also used as classification variables.

Multicollinearity

Next, a multicollinearity test was performed on the data. Correlation tests were conducted for variables such as knowledge, attitude, behaviour, grade, age, discipline, and gender (see Table 2 for correlation results). The mean knowledge, attitude and behaviour were discovered to be significantly positive and highly correlated (p < 0.001). There was a significant positive correlation between grade and age (p < 0.001), and they showed significant negative correlations with mean knowledge, attitude, and behaviour (p < 0.001). Therefore, grade and age as independent variables were considered covariables. To test the effect of grade, age has to be controlled.

As a result, the regression analysis hypothesis was completely satisfied. Therefore, the data and residuals were normally distributed, with no heteroscedasticity or correlation between regression residuals. The potential collinearity between grade and age was identified, but it could be accommodated in the proposed regression model by controlling for the latter.

Data analysis

A multivariate regression model was used to examine the effects of different grade levels and levels of work exposure on mean score of knowledge, attitude, and behaviour, with gender, age, and discipline controlled, as detailed below according to the corresponding assumptions. For simplicity, the changes are illustrated in Figs. 2, 3, and 4).

Gender difference

Many studies have hypothesised that personal factors such as gender influence behavioural decisions [37, 41]. The analysis revealed that the hypothesis was statistically supported. Females' knowledge (M = 3.44, SD = 0.78) was found to be significantly higher than males' (M = 3.27, SD = 0.78), as was their attitude (M = 3.66, SD = 0.94 vs M = 3.32, SD = 0.99). The same was true for female and male behaviour (M = 3.44, SD = 0.70 vs M = 3.19, SD = 0.81). As a result, females had higher ISA scores than males in all three dimensions.

Significant predictors

A multivariate regression model was also run to see if age, discipline, grade, or gender were significant predictors of ISA. Previous research suggested that age was a significant predictor of ISA (e.g. [55]), but a recent study found that age was not a significant predictor [7]. Pillai's Trace was used to evaluate the sum of the matrix's eigenvalues, and Roy's Largest Root statistic, to test the maximum value in a matrix's eigenvalues, have been used. And the greater the magnitude of these values, the greater the contribution of this effect to the model. Wilk's Lambda was also used, with a value between 0 and 1. In Wilk's Lambda, the smaller the value, the greater the contribution. As a result of the above analysis, the results showed that overall, grade and gender were significant predictors of ISA, whereas age and discipline were not.

Significant correlations

In addition, tests of between-subjects effects were examined further, with mean knowledge, mean attitude, and mean behaviour as the dependent variables.

Significant correlations were discovered between grades, discipline, and gender.

According to the Sum of Squares, the grade had the greatest impact on knowledge (112.96), attitude (123.35), and behaviour (70.33), in that order. (See Table 3.)

Discipline differences

To the best of the authors' knowledge, ISA research in higher education rarely focuses on discipline. Thus, Fisher's LSD was used in this study for inter-group multiple comparisons to compare disciplines. The analysis found no difference between the disciplines of natural sciences and technology and engineering, but there was a difference between the above two disciplines and the discipline of liberal arts and social sciences. That could be because, in Chinese universities, the disciplines of natural sciences, technology, and engineering had at least two advanced information and communication technology (ICT) courses and one professional computer application course, whereas students majoring in liberal arts and social sciences only took the common course on basic ICT skills in the first year, according to the Computer Basic Curriculum System and the actual investigation [55, 56].

Discussion

To our surprise, there was little difference in overall ISA between graduate students and college students, implying that EL had little impact on these students. What we did not expect was that education level had no positive effect on postgraduates' cybersecurity behaviours, while it had a negative impact on postgraduates' Internet security knowledge and attitude. This result differed from previous international findings that individuals with higher education had higher ISA scores [9, 51] but was consistent with previous findings in the Chinese context [7, 10, 11]. Among past studies that investigated both undergraduate and postgraduate students [58–60], very few compared them as separate groups. However, our results echo findings that undergraduate and postgraduate students had similarly inadequate ISA [60] or that the postgraduates had slightly weaker awareness than the undergraduate group [58]. ICT education is known to benefit to one's ISA [35, 36], but computer-related courses are typically not provided at higher undergraduate levels and postgraduate study in most Chinese universities. Many tertiary-level students in China were only required to take a basic ICT course in year-1 [55, 56], the lack of ICT education in subsequent years and postgraduate programmes might have led to ISA deterioration. In fact, similarly inadequate training/education was found in non-Chinese institutes [60]. Although this is one of the few studies that investigated comprehensive ISA changes among university students and graduates, other studies have indicated that senior-year students were more prone to risky online behaviours [61] and weak preventative awareness of cyber-threats [62]. Increasing involvement in social activities such as interest groups and part-time jobs is potentially a major contributor to such peer-level changes, as argued by researchers [7, 62]. This social influence reaches a high point upon complete detachment from tertiary education, while others who choose to continue/return to their studies at postgraduate level may receive a less negative impact.

We also argue one major reason for existing ISA studies to yield contradicting results was that they only examined individual factors [34, 35, 40, 41], which should be considered alongside the influence of social forces [7, 12, 47] to paint a fuller picture. This study found that when all the factors (i.e. grades, age, discipline, and gender) were analysed together, age did not show significant correlations with any ISA dimensions. Our results indicated that year-levels/work exposure and age were highly correlated, which makes sense as the higher one’s education level and work experience are, the older they typically are. In past studies, age alone seemed to predict ISA [34, 37, 41]. However, it is evident in this study that age is not the cause for changes in ISA, but rather, a co-founder or covariate of other directly related factors such as education levels. In particular, social influence is found to be more important than an individual's level of education. Although this study has provided further evidence of social influence [19, 21], much has yet to be done to examine how the external environment impacts one’s ISA as studies beyond individual factors are relatively few [12, 45, 47]. This also explains why the results of previous studies that used GDP and country development to predict citizens' ISA were inconsistent [37, 57, 63], suggesting that the educational level of the whole country (SEL) plays a crucial role. Previous studies have argued that social influence may be more pronounced in developing countries than developed ones [12, 64, 65]. Apart from weaker cybersecurity infrastructure [65], the general lack of basic knowledge in ICT [64], added to the rampant access to pirate software [66], shaped people’s risk-prone attitudes in developing countries. Despite the high GDP, China is a developing country, where people’s education level and ICT knowledge vary largely [7, 49]. University students, graduates and postgraduates are undoubtedly under constant but varying levels of negative social influence, which, if strong enough, can result in a critical downturn of ISA.

Further, as expected, females had better attitudes and behaviour than males, which was consistent with previous findings [37, 40]. Another expected outcome was that there was a significant difference between liberal arts, social sciences and natural sciences, technology, and engineering which was rarely focused on in the previous studies. The reason was that different levels and amounts of ICT curriculum were designed among these disciplines, which also proved the previous finding that ICT education could be beneficial to one's ISA [35, 36].

Implications

An important methodological implication for the future was that, with readily available figures of national education level, the year-level (education level) and length of time at work (SEL) were quantifiable measures, similar to existing cross-national findings (e.g. [23, 58, 59]). As a result, it addresses the issue that GDP and nationality are inconsistent predictors of national ISA.

Because of the influence of SEL, the fact that the average difference in ISA between working graduates and the other two student groups was significant provided insight into the importance of conducting a survey on working postgraduates and working PhDs, given that the SEL of the working environment for working postgraduates may be better. Nonetheless, the behaviour of postgraduate students was significantly higher than that of final-year students, indicating that the negative effects of society (SEL) were offset by the positive effects of the university environment (education level). With this in mind, an ISA survey of PhD students was undoubtedly a worthwhile topic worthy of further investigation.

This study recommends that a greater effort is needed to be made to educate the general public, particularly while they were still in school. With 95.41% of the population in China having received an education, cybersecurity awareness training at the school level was critical to improving the national ISA and SEL. What was more important was the higher education group's knowledge of ICT. The ICT knowledge that remained only in the freshmen stage could no longer meet the current era of extensive and in-depth popularization of the Internet, and thus the ICT knowledge needed to be provided according to the needs of students at various stages, including the postgraduate stage. Simultaneously, because teachers' ICT knowledge can influence the younger generation, the quickest and most effective strategy was to train the teacher population on ICT knowledge [67].

Meanwhile, companies should consider providing more training for employees with lower education, who make up 48.8% of the workforce in China, as well as maintaining young graduates' better ISAs, to ensure that all employees have a broad range of ICT knowledge. Simultaneously, it was critical for the government to take actions to promote safe Internet behaviours among citizens, such as broadcasting knowledge and the importance of ISA via social media, online advertising, television, government-led talks, establishing network security policies, and collaborating with businesses to initiate social transformation.

Limitations

The study collected a larger sample in the hope that a larger sample would increase generalizability and thus mitigate the problem of non-random sampling. However, due to the varying difficulty of data collection in each group, the number of respondents in each of the six groups varied.

We attempted to understand changes in ISA and behaviour from year-1 to postgraduate studies to graduated employees. However, the change is not observed longitudinally, but it was obtained through a cross-sectional survey. Therefore, factors such as generation difference cannot be duly represented in the data. Readers are forewarned of this potential confounder.

Future research could also conduct longitudinal and cross-country studies to investigate the influence of education level and SEL on ISA using this extended model to further our understanding of education level and SEL.

Conclusions

This study used an extended KAB model, which proposed that year-level (grade) could act as a moderator in the relationship between knowledge and attitude. As a result, three main hypotheses and three sub-hypotheses were proposed based on the respondents' various conditions. The postgraduate student group has the highest education level, while the final-year students and non-final-year students decrease in order. These conditions represent various levels of educational influence. At the same time, postgraduate students return to the university environment after having had some contact with work, representing the group that has been influenced by both education level and SEL.

On this basis, the Human Aspects of Information Security Questionnaire (HAIS-Q) was used to assess the extended KAB model. The effect of grade and work exposure on mean knowledge, attitude, and behaviour scores was investigated. The findings confirmed that education level and SEL had a statistically significant effect on variables.

Three major hypotheses were found to be correct. H1-University students of various years of study, postgraduate students, and working graduates will demonstrate varying levels of cybersecurity knowledge was confirmed. There were significant differences in knowledge among university students of various years of study, postgraduate students, and working graduates.

H2a–H2c examined whether there would be statistically significant differences in attitudes among four groups of respondents. Non-final-year students performed better than the other three groups. Furthermore, final-year students had higher scores than postgraduate students, and postgraduate students had higher scores than working graduates.

H3a–H3c examined whether the behaviours of four groups of respondents will differ. Postgraduate students were found to score higher than final-year students and working graduates, but their scores were comparable to non-final-year students.

The current study was one of the first to compare postgraduate students with university students and working graduates in order to examine the cognitive and behavioural changes of well-educated individuals. It contributed to methodology and practice guidance. The findings of this study need to be confirmed by additional research, but it could serve as a starting point for future investigations.

Conflict of interest

The authors have no relevant financial or non-financial interests to disclose. The authors have no competing interests to declare that are relevant to the content of this article. All authors certify that they have no affiliations with or involvement in any organization or entity with any financial interest or non-financial interest in the subject matter or materials discussed in this manuscript. The authors have no financial or proprietary interests in any material discussed in this article. The authors declare no competing interests.