Received June 27, 2020, accepted July 4, 2020, date of publication July 8, 2020, date of current version July

20, 2020.
Digital Object Identifier 10.1109/ACCESS.2020.3007867

Factors Related to Cyber Security Behavior

ANA KOVAČEVIĆ 1, NENAD PUTNIK1 , AND OLIVER TOŠKOVIĆ2
1 Facultyof Security Studies, University of Belgrade, 11000 Belgrade, Serbia
2 Laboratory for experimental psychology, Faculty of Philosophy, University of Belgrade, 11000 Belgrade, Serbia

Corresponding author: Ana Kovačević ([email protected])

ABSTRACT Theoretical and empirical insight notes that cyber security awareness is a topic of particular
interest in cyber security. Humans are the central figures in cyber security and the way to reduce risk in
cyberspace is to make people more security aware. While there have been numerous studies about various
aspects of cyber security awareness, they are both inconsistent and environment-dependent. The main aim of
our research is to analyze cyber security awareness in depth, and to try to discover how various factors such as
socio-demographics, cyber security perceptions, previous cyber security breaches, IT usage, and knowledge
may individually or together impact on cyber security behavior. To prove that we conducted our research
on students, as they are the most technologically active part of the society. We discovered that knowledge
proved to be the dominant factor for cyber security awareness, and although students are digital natives, they
do not feel safe in the cyber environment; they do not behave securely and do not have adequate knowledge
to protect themselves in cyberspace.

INDEX TERMS Cyber security, cyber security behaviours, cyber security breaches, cyber security
perception, knowledge, user awareness.

I. INTRODUCTION the goal of securing operations against unauthorized access or

Today, life can hardly be imagined without information tech- attack [5].
nology; more than half of the world’s population (58.8%) Although users are somewhat aware of the security risks,
used the Internet in 2019 with 73.4% Internet users in most of them are not sure how they should behave to achieve
Serbia [1]. According to a report compiled by Ratel in Serbia, cyber security (e.g., even if they have heard about phishing,
99.2 % of those aged between 16 and 24 use computers and some users are not sure how to recognize the problem or
98.2% use the Internet every day or almost every day [2]. react appropriately). According to numerous reports, human
Recent technological development has had a great impact error is seen as the dominant problem for secure information,
on people’s lifestyles [3]. However, there is also a dark side making it necessary to understand people’s behavior towards
to this trend; in 2017 the Ponemon Institute estimated the security technology [6]–[8]. Numerous security breaches are
economic impact of security breaches at nearly half a trillion caused by a lack of knowledge or unsafe behavior (e.g.,
dollars globally, with the cost of data breaches increasing sharing passwords, or clicking on unsecured links in emails).
every year [4]. Security incidents are constantly expand- Protecting oneself in cyberspace has become a necessity
ing, and are becoming increasingly sophisticated and more today.
severe. With the wide adoption of information technologies Security awareness is defined in NIST Special Publication
in the last decades, the profile of the end-user also has 800-16 as follows: ‘‘Awareness is not training. The purpose
changed. The average user of information technology is not of awareness presentations is simply to focus attention on
necessarily technically educated, and has most likely not security. Awareness presentations are intended to allow indi-
studied cyber security in his/her previous education. Cyber viduals to recognize IT security concerns and respond accord-
security is defined as a computer-based discipline, which ingly’’ [9]. Bada [10] noted that awareness does not only
involves technology, people, information and processes, with mean being aware of possible threats, but also adopting
security behavior.
In this paper, we analyze cyber security awareness in depth,
The associate editor coordinating the review of this manuscript and and accordingly, the paper is organized in the following way;
approving it for publication was Sabu M. Thampi . the Background section reviews and presents relevant work on

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
125140 VOLUME 8, 2020
A. Kovačević et al.: Factors Related to Cyber Security Behavior

cyber security awareness and the proposed research question. weaker passwords than males. Their study shows both corre-
Section III describes and discusses the adopted methodology. lations and contradictions with previous studies (e.g., in line
Section IV presents the results and provides a discussion of the with [16], risk taking preferences did not correlate with
findings, interpreting them in order to achieve greater clarity. security behavior intentions of device securement; contrary
Finally, Section V gives our conclusion and future direction to [16], regarding the correlation between individuals willing
of work. to take ethical and health/safety risks and poor security
behavior intentions), so the authors emphasize the uniqueness
II. BACKGROUND of the environment in exploring cyber security.
Cyber security is a growing and important field involving Moallem [17] carried out a study of cyber security aware-
various research studies [11]. One of the research directions ness among students in the Silicon Valley in California, USA
in the field of cyber security is how to improve cyber security as the most advanced technology environment. The author
awareness, focusing on those factors which are the most reported that although college students believed that they
significant in achieving this aim. This section briefly presents were observed and not secure online, they were not aware of
relevant studies in cyber security awareness, mostly within how to protect their data. Besides that, Moallem also stated
the education sector. that educational institutions did not take an active approach to
In their research, Kruger et al. [12] describe an exploratory improve awareness among students, to increase their knowl-
study to test the possibility of using information security edge about threats and to make them safer in cyberspace [17].
vocabulary tests to assess awareness levels and familiar- Parsons et al. [6] surveyed university students by means
ity with security terms so as to indentify suitable areas of their HAIS_Q instrument (Human Aspects of Information
and topics for information security awareness programs. Security Questionnaire), and the same students also partici-
The questionnaire used consisted of two sections: the first pated in an empirical phishing experiment. It was shown that
section was a vocabulary test and the second evaluated the students who had a higher score on the HAIS_Q performed
respondents’ behavior. They found the use of the vocabulary better in the phishing experiment. The HAIS-Q is based on
test for the assessment of awareness levels to be a use- the Knowledge-Attitude-Behavior (KAB) model, whereby in
ful tool and a significant relationship between knowledge their previous research the authors demonstrated a strong,
of concepts (vocabulary) and behavior was shown. positive relationship between knowledge, attitude, and behav-
Al-Janabi and Al-Shourbaji [13] carried out research to ana- ior [18], [19]. McCormac et al. [19] used the HAIS-Q to
lyze information security awareness levels and associated measure the relationship between individual differences and
risk, as well as the overall impact on institutions, among information security awareness among working Australians.
students and staff within the educational environment in the They reported that conscientiousness, agreeableness, emo-
Middle East. The results revealed that the participants did not tional stability and risk-taking propensity are significant,
have the required knowledge and understanding of informa- while age and gender have no influence on an individual’s
tion security awareness. The authors outlined the implications information security awareness.
for real-world problems from the identified weakness in this Anwar et al. [20] explored how important a factor gender
survey, and made recommendation to remedy the situation. is in terms of cyber security beliefs and behaviors among
Jeske and van Schaik [14] conducted a survey of students’ employees. They found statistically significant gender-wise
familiarity with different Internet threats. The participants differences based on computer skills, prior experience, cues-
were presented with definitions of threats and were asked to-action, security self-efficacy, and self-reported cyber secu-
to state how familiar they were with each. According to rity behavior. The women in the study self-reported slightly
their responses, three clusters were identified; the first cluster lower levels of computer skills, lower prior experience
included those participants who were knowledgeable about with computer security, and lower cues-to-action scores.
all threats (both new and familiar), the second cluster com- The greatest difference was noted for self-efficacy, where
prised participants more familiar with new threats, while the women showed significantly lower self-efficacy than the
the third cluster consisted of participants more familiar with men. The authors also noted that this might have been the
well-known threats. The authors showed that time spent consequence of overconfidence among the men or under
on the Internet and the length of Internet experience were confidence among the woman in their self-evaluation.
predictors of familiarity with Internet threats, which are a Cain et al. [21] analyzed the cyber hygiene knowledge
further predictor of computer security use. of concepts and threats, and the behaviors of the end-users.
Gratian et al. [15] carried out a survey correlating human In their analysis, they reported that there were statistically
characteristics, such as risk-taking preferences, decision- significant gender-wise differences in terms of knowledge,
making styles, demographics, and personality traits with where males were more knowledgeable. In addition, there
cyber security behavior intentions among students and staff were no statistically significant differences between gen-
at a large public university. They reported that financial der and behavior, previous attacks and behavior, or train-
risk-taking, rational decision-making, extraversion, and gen- ing and behavior. There was an evident link between‘
der are good predictors of security behaviors. Gender was self-identified experts and knowledge (and behaviors);
found to predict strength of passwords, with females creating self-identified experts had less secure behaviors than

VOLUME 8, 2020 125141

 A. Kovačević et al.: Factors Related to Cyber Security Behavior

self-identified non-experts and also less knowledge about This led us to our research which focuses on three main
cyber hygiene. They also concluded that although users areas:
should be more knowledgeable in order to improve cyber 1) How are socio-demographic characteristics, such as
security, this was not enough in itself, and users should gender and previous education, related to the behav-
change their behavior. A large majority of the participants ioral aspects of cyber security?
(81%) had some security training in cyber hygiene, but it 2) How are perceptions of cyber security related to the
did not improve their behaviors or increase their knowledge. behavioral aspects of cyber security?
They concluded that more effective training should be pro- 3) How is knowledge of cyber security related to the
vided for all users, and this statement is similar to Bada [10]. behavioral aspects of cyber security?
The Pew Research Centre conducted research into the In addition, we were also interested in investigating how
perceptions, security breaches and behavior of Americans the assumed factors (socio-demographics, perceived security,
with regard to cyber security [22]. Their report states that and knowledge) are related to each other, and whether they
although the majority of Americans had experienced data interact in relation to the behavioral aspects of cyber security.
breaches and did not trust modern institutions to protect their This is the first survey conducted among university stu-
personal data, they themselves did not implement the best dents in Serbia to analyze the various factors affecting cyber
practices in cyberspace. In addition, the Pew Research Centre security awareness.
carried out two more studies into the cyber security knowl-
edge of Americans, and their results show that a large number III. METHOD
of participants are unclear about certain key cyber security The current study is performed through a survey, on a con-
topics, terms, and concepts [23], [24]. It was shown that while venience sample of students. The questionnaire contained
the participants are able to identify a strong password or adapted items from previous surveys conducted by the Pew
are aware of the danger of using public WiFi, they achieved Research Centre [22]–[24].
poorer results in questions with more technical details such
as two-factor authentication or page encryption. These Pew A. SAMPLE
Research surveys were quite comprehensive, and the most Our participants in the survey were students, as it is assumed
relevant for our analysis, so most of our questions were based that this population is very familiar with IT technology [2].
on them. We decided to conduct our research on students at the Faculty
All of the aforementioned studies, with different focuses of Security Studies, University of Belgrade, as they have
and methodologies, but each in its own way - address the chosen to study different aspects of security (i.e., national
complexity of the cyber security awareness phenomenon. security, environmental security, crime and criminology, and
Common to all these studies is that they have identified information security) for their professional vocation and
various factors that affect cyber security awareness and tried under the assumption that they have a higher degree of secu-
to explain the interconnectedness of these factors, such as per- rity awareness than students from other faculties. In addition,
ceptions [14], [17], [22]; security breaches [14], [22]; behav- our participants were freshmen at the beginning of their stud-
ior [6], [12], [14], [15], [21], [22]; knowledge [6], [12], [13], ies and they still do not have specific cyber security expertise,
[17], [21], [23], [24]; and socio-demographic characteristics - so their current level of knowledge can only be related to the
age and gender [15], [19]–[23]. knowledge gained in high school. Our primary idea was to
Although these studies have shown that each of these discover the level of security awareness of freshmen when
factors (i.e., socio-demographic characteristics, perception, they arrive at the Faculty of Security Studies, and the practical
security breaches, behavior, and knowledge) have an impact implication is that we can improve our curriculum regard-
on cyber security awareness, there are noticeable inconsis- ing those findings. The sample consists of 147 participants,
tencies in how they affect cyber security awareness. These 40 (27%) male and 107 (73%) female.
inconsistencies mostly occur with socio-demographic factors
(i.e., gender), perceptions, and previous security breaches, B. INSTRUMENTS
which is in line with the conclusion that cyber security is The first section of the survey focused on the students’
environment-dependent, as stated in [15]. socio-demographic information, such as gender and previous
Hence, our aim was to test the effects of these factors education. Cyber security is quite a complex and broad sub-
on cyber security awareness, and to attempt to discover ject [23], and the second part of the questionnaire analyzed
how various factors such as socio-demographics, perceived the various dimensions of cyber security. The majority of the
cyber security, previous breach experiences, IT usage, and questions were adapted from the survey conducted by the Pew
knowledge may individually or together impact on cyber Research Centre in 2016 [22]. The third part of the survey
security behavior. This will serve to expand empirical knowl- measured knowledge, and we chose to use questions from
edge about this issue and further contribute to clarifying questionnaires [23], [24], which were developed by cyber
the dilemma related to the extent of the influence of these security experts to measure the general concepts and essential
factors, without, of course any pretentious intentions to offer building blocks for online protection. We selected those ques-
conclusive answers. tions which were relevant for our participants. We chose those

125142 VOLUME 8, 2020

A. Kovačević et al.: Factors Related to Cyber Security Behavior

questionnaires because the questions were specific, in the and saturation is from 0.452 to 0.824; the password related
form of a test mostly with only one correct answer, explicitly behavior factor explains 17% of the variance and saturation is
showing knowledge of lack of knowledge [23], [24]. from 0.313 to 0.677 and the cell phone related behavior factor
The tested variables included socio-demographic factors explains 22% of the variance with saturation from 0.507 to
(gender, previous education), IT usage (5 questions), previous 0.706.
cyber security breaches (7 questions), perceptions of cyber In the following step for each of the aforementioned con-
security (11 questions), cyber security behavior regarding structs, we calculated the corresponding score as the sum of
passwords (11 questions), cyber security behavior regard- the individual items. In addition, we also calculated the total
ing cell phones (7questions), and cyber security knowledge score for knowledge and IT usage by summing up all the
(10 questions). items related to them. Table 1 shows the descriptive statistics
The items were translated into Serbian by professional for each construct’s score.
translators, and then verified through back-translation proce-
dure. The Pew Research Centre published the original content TABLE 1. Basic descriptive statistics for each measured construct.

in English but has not reviewed or approved this translation

C. PROCEDURE
The Faculty of Security Studies at the University of Belgrade
approved the study. A paper-based survey was administered
to the students at the same faculty on November 22th, 2019.
The survey was completed in a group classroom setting under
the supervision of the authors. The participants were briefed
about the goal of the study and approximately 20-30 minutes
were required to complete it. Participation was voluntary, and
all of the students were informed that participation (or refusal
to participate) would not affect their course grade.
The Statistical Package for Social Sciences (SPSS)
version 22 was used to process the data collected, and to ana-
lyze the repossesses of the participants from the survey [25].
Firstly, the descriptive-statistical data were processed, where
the parameters of the mean and standard deviations were According to the values of standardized skewness and
used for the numerical variables, while the frequencies and kurtosis, almost all of the variables have satisfactory values
percentages were used for the categorical variables. Subse- (within +/−1.96), with the exception of cyber security breach
quently, the following methods were used for the purpose experiences, as is shown in Table X1. The skewness value on
of analysis: Principal Component Analysis, T-test, Pearson’s this score indicated positively skewed distribution, meaning
correlation coefficient, multiple regression analysis and hier- that most of the participants had low breach experience,
archical multiple regression analysis, with a significance level which is expected. So, we can conclude that most of the
of p<0.05. variables fulfill the conditions of normality, except for cyber
security breach experiences. However, we also decided to use
IV. RESULTS AND DISCUSSION this variable in our analysis since it did show some significant
To provide construct validity to cyber security perceptions, relations.
cyber security breach experiences and cell phone and pass-
word behaviors, we firstly performed factor analysis- PCA B. DESCRIPTIVE RESULTS REGARDING CYBER SECURITY
(Principal Component Analysis) on the related questions. Almost all of the participants have smartphones (99.3%),
Factor analysis with PCA (Principal Component Analysis) and use the Internet on their cell phones (or other mobile
was used in order to reveal groups of questions which showed handheld devices). Besides that, 99.3% use social media sites
high inter-correlations. This facilitates the detection of so such as Facebook, Twitter, or LinkedIn. However, when it
called latent variables, which lie behind the participants’ comes to online shopping and e-banking, only 17.7% of the
answers to the questions. participants use online banking services, while 50.3% of the
participants do their shopping online.
A. CONSTRUCTS The majority of the students (73.5%) have never faced a
One factorial solution was chosen for each of the examined security breach, while 11.6% of them have encountered one,
constructs. For factor structure loadings, we chose only items 12.2% less than five times, 2.0% more than 3 times, and just
which showed high saturations (>0.3). The cyber security one participant(0.7%) more than ten times. We also analyzed
perception factor explains 40% of the variance, and loadings which security breaches the participants had encountered;
are in the range from 0.309 to 0.824; the cyber security 4.1% of the participants had experienced a compromised
breach experiences factor explains 43% of the variance, email account, while 22.4% a compromised social media

VOLUME 8, 2020 125143

 A. Kovačević et al.: Factors Related to Cyber Security Behavior

account. On the other side, almost all of the participants avoid performing sensitive activities on them [22]. In terms
(99.3%) said that they had heard about at least one security of using public Wi-Fi; 12.2.% of the participants make online
breach that had happened to their close friends or family: purchases connected to public Wi-Fi, 6.1% have used pub-
34.7% just once, 46.3% between 1 and 5 times, and 18.3% lic Wi-Fi for online banking, while 60.5% have used it for
more than five times. sending an email. It was shown that although the majority of
The participants do not feel very confident in various insti- the participants are aware of threats from public Wi-Fi for
tutions to protect their personal data from unauthorized users, online banking and purchasing, they lack awareness when
and they show the greatest level of concern (not confident using emails. If we compare this data to the question about
at all) primarily about social media sites (42.8%), govern- https, only 10.9% of the participants know what https is.
ment institutions (20%), companies they pay online (20%), This led us to the conclusion that while some students use
or Internet providers (20%). On the other side, they have online banking and shopping services, they have insufficient
higher levels of confidence in the university e-service (28%) security awareness of the threats posed by using unsecured
and online banking (22%). Roughly one third of the partici- connections.
pants (30.6%) feel that their personal data is more secure than If we analyze the results of knowledge, no one had all the
five years ago, 30.6% think that it is as secure as it was five correct answers, and the best result was 8 out of 10. The
years ago, while 28% think they are less secure. question with the most correct answers was related to creating
Passwords are considered one of the main factors that secure passwords (85.7%), followed by the safety of pubic
increase the security of an information system, which Wi-Fi (64.4%), while the least correct answers were for more
increase security especially if they are complex (e.g., a com- technical questions such as identifying botnets (3.4%), email
bination of numbers, small/capital letters, and symbols) encryption (10.2%) or https (10.9%). Such results imply that
and not shared with others. Despite the existence of new although the participants spend quite a large amount of time
authentification methods, usernames and passwords are still on their digital devices, they are not so aware of security
very popular because of their simplicity [17]. The reuse of threats in cyberspace.
passwords is quite common, and in the study from 2007, con-
ducted on more than 500,000 users, it was reported that the C. THE EFFECT OF SOCIO-DEMOGRAPHIC
average user reuses the same password across 3.9 sites [26]. CHARACTERISTICS ON CYBER SECURITY PERCEPTIONS,
With the steady increase in the number of web applications KNOWLEDGE AND BEHAVIOURS
since this study was conducted, we can assume that today The T-test for independent samples is used in order to reveal
this number is even higher. In line with this, over half of any differences between two groups on certain numerical
the participants reported that they had reused passwords characteristics. In our paper, we used it for analyzing gender
for highly important accounts [27]. The reason for reusing and differences in the type of school attended by the respon-
passwords may be found in the results that a strong password dents, their cyber security perceptions, knowledge, experi-
requires distinctive cognitive processing [28] while reusing it ences and behaviors.
is much easier. We explored whether our students have safe The analysis showed that there are significant differences
password behavior. based on gender only for knowledge (t=3.505; df=144;
The participants demonstrated self-reported unsafe behav- p<0.01): the male respondents had higher scores (4.60) than
ior as 74.1% stated that most of their passwords are the same the females (3.50), as can be seen in Fig. 1. This result is
or very similar. This result is in line with the result in [17]; in line with previous research [21]. Also, for cyber security
where it was reported that 78% reuse or sometimes reuse perceptions, the p-value is close to the significance level,
their passwords. Reusing passwords is not a secure behavior, so we concluded that males are more convinced of their
and may put users at risk when a website does not encrypt
usernames/passwords. Also, almost half of the participants
(47.6%) considered passwords stressful and found it difficult
to keep track of their passwords. On the other hand, 54.4% of
the participants chose to use less secure passwords, because
complicated passwords are too hard to remember. This shows
the important fact that the majority of the participants are not
aware of how to create good passwords that can be easily
remembered. In addition, it is also evident that the majority of
these students lack awareness about safe passwords: 54.4%
have shared an online account with others and 72.1% have
used a social media account to log on to another website.
Although almost all users have smartphones, only 32%
of them have installed antivirus protection on their phones.
Public Wi-Fi or unfamiliar Wi-Fi networks are very vulner- FIGURE 1. Average values and deviations of measured constructs for two
able and can easily be attacked by hackers, and users should genders.

125144 VOLUME 8, 2020

A. Kovačević et al.: Factors Related to Cyber Security Behavior

security (t=1.919; df=145; p=0.057). Something is consid- TABLE 2. Pearson’s Correlation coefficients between cyber security
perceptions, knowledge, experiences and behaviors.
ered significant if it is <0.05.
In addition, we also used a t-test for independent samples
for testing the differences between the type of school attended
by the respondents on the aforementioned variables. The
analysis showed that there are statistically significant differ-
ences between school types (grammar school and vocational
school) on knowledge (t=2.115; df=146; p<0.05), cyber
security breach experiences (t=1.987; df=144; p<0.05), and
cell phone related behavior (t=2.914; df=144; p<0.01). The
differences lie in the higher scores recorded for students
who attended grammar schools for three constructs; they
experienced security breaches more frequently, they know a somewhat more complex analysis in order to gain a better
more, and their cell phone related behavior are more security- insight into their interrelationships.
conscious, as is shown in Fig. 2. Multiple regression analysis shows the significance of
one numerical characteristic prediction based on a set of
numerical indicators. Multiple regression analysis was used
to predict cyber security behavior based on cyber security
perceptions, IT usage, cyber security breach experiences, and
knowledge. Password related behavior and cell phone related
behavior were used as cyber security behavior indicators.
For each of those two cyber security behavioral indicators,
we performed separate regressions.
Firstly, the idea behind this analysis was to discover
the existence of any combination of predictors that can
best explain cyber security behavior regarding passwords.
The analysis showed that there is no significant prediction,
i.e., password behavior cannot be explained by the previ-
ously mentioned predictors (r2 =0.028; F=1.002; df=4, 144;
p=0.409). We can only note that cyber security breach expe-
FIGURE 2. Average values and deviations of measured constructs for riences is close to the significance level (p=0.067, Table 3).
different school types. If we consider the previously mentioned correlation between
cyber security breach experiences and passwords, it can be
D. RELATIONS BETWEEN PERCEPTIONS, KNOWLEDGE, concluded that there is a tendency for those who are the vic-
EXPERIENCES AND BEHAVIOURAL ASPECTS OF CYBER tims to have less secure passwords. However, this tendency
SECURITY should be further investigated since it might be mediated or
Pearson’s correlation coefficient is used to detect the intensity moderated by some other factors which we did not measure.
and direction of the relation between numerical characteris-
tics. In this paper, Pearson’s correlation was used between TABLE 3. Regression coefficients for predicting password related
behavior.
each of the two individual scores to further assess the relation-
ship between cyber security perceptions, knowledge, experi-
ences, and behaviors. There is a clearly significant negative
correlation between cyber security breach experiences and
password behavior (those who experienced cyber security
breaches more often use less secure passwords), as well as
a positive correlation between cyber security breach expe-
riences and knowledge (those who were more frequent vic- We also used multiple regression analysis to test the pre-
tims, scored higher on knowledge), as is shown in Table 2. diction of cell phone related behavior based on cyber security
The last claim is consistent with the Protection Motivation perceptions, IT usage, cyber security breach experiences and
Theory [29]. Although, these correlations are significant, knowledge. As in the previous analysis, we tried to discover
their intensity is low (below 0.2), so the relations are weak. whether there is any combination of predictors which can
As shown in Table 2, there is no significant correla- best describe how we predict cell phone related behavior.
tion between cyber security perceptions and the behavioral The analysis showed that there is significant prediction,
aspects of cyber security. i.e., cell phone related behavior can be explained by some
Since Pearson’s correlation shows the correlation of indi- of the aforementioned predictors. It was shown that 13.6%
vidual scores, 2 by 2, (i.e., each one with the other), we tried (r2 =0.136; F=5.353; df=4, 141; p<0.01) of cell phone

VOLUME 8, 2020 125145

 A. Kovačević et al.: Factors Related to Cyber Security Behavior

behaviors depend on knowledge and IT usage only. This The most important finding is that the difference between
indicates that although greater knowledge results in better the two models also appeared significant (r2change =0.12;
cell phone behaviors, more frequent IT usage leads to less Fchange =5.05; df=4,138; p<0.01). This means that cyber
secure behaviors (Table 4). This can be explained by the fact security perceptions, knowledge, and experiences addition-
that the participants may feel more confident because they ally improve the prediction of cell phone related behavior,
use technology more, but they are not aware of the threats in even after controlling for socio-demographic characteristics.
cyberspace. In addition, we could see that the effects of cyber secu-
rity perceptions, knowledge, and experiences are stronger
TABLE 4. Regression coefficients for predicting cell phone related than the effects of socio-demographics, 12% in comparison
behavior.
to 6.3%. According to the regression coefficients, we could
conclude that only IT usage and knowledge about cyber
security appear as significant predictors of cell phone related
behavior, as shown in Table 5. The effects are such that the
more the participants knew about security, and the less they
used IT, the more they tended to behave securely with cell
phones.
The finding that increased IT usage is related to less
secure behaviors is in line with the research conducted by TABLE 5. Regression coefficients for predicting cell phone related
Ovelgönne et al. [30], who collected data longitudinally from behavior, in two steps.
users’ computers about cyber attacks and antivirus soft-
ware, and reported that software-developers were attacked
most often, followed by gamers and professionals, and then
‘‘regular’’ users. In addition, Grimes et al. [31] reported that
younger users are less secure than older ones, because they
are more confident, and believe that they are more tech-savvy.
Finally, in order to control the effects of the socio-
demographic characteristics, we carried out the prediction
in two steps, i.e., by means of hierarchical multiple regres-
sion analysis. Hierarchical multiple regression analysis also
tests the criterion prediction, but allows for the possibility
to control for certain effects, such as those related to socio- Hierarchical multiple regression analysis was used in our
demographic characteristics. In all the performed analysis we attempt to predict password behavior in two steps:
adopted a significance level of 0.05. In the first step we tested 1) In the first step based on socio-demographic character-
the effects of gender and school type, and in the second we istics: gender and school type.
added cyber security perceptions, IT usage, cyber security 2) In the second step, beside gender and school, we added
breach experiences, and knowledge. In that way, we could cyber security perceptions, IT usage, cyber security
differentiate effects of cyber security perceptions, knowledge, breach experiences, and knowledge.
and experiences from socio-demographic characteristics, i.e., The analysis showed that there is no significant prediction
we could discover whether individuals behave more securely in either step, i.e., that password related behavior cannot
because of their gender and education, or because of better be predicted on socio-demographics (r2 =0.013; F=0.967;
security knowledge and experiences. Hierarchical multiple df=2, 142; p=0.383) or by combined socio-demographics
regression was used to try to predict cell phone related behav- and cyber security perceptions, knowledge, and experiences
ior in two steps: (r2 =0.04; F=0.961; df=6, 138; p=0.454).
1) In the first step based on gender and type of school Knowledge is a dominant factor in cyber security behavior
2) In the second step, beside gender and school, we added on cell phones, and is not significant for password behavior,
cyber security perceptions, IT usage, cyber security thus providing the answer to our third research question as to
breach experiences and knowledge. how knowledge of cyber security is related to the behavioral
The analysis showed that there is a significant prediction aspects of cyber security.
in both steps, with socio-demographics only (r2 =0.063;
F=4.789; df=2,142; p<0.05), and with cyber security per- V. CONCLUSION
ceptions, knowledge, and experiences added (r2 =0.183; The environment is a very important factor when analyzing
F=5.147; df=6,138; p<0.01). In the first step only type cyber security, as stated in [15], and this is the first sur-
of school previously attended turned out to be significant vey conducted among university students in Serbia (in par-
(students from grammar schools behave more securely when ticular freshmen), which analyzes the factors relevant for
it comes to cell phones) and it remained significant even after cyber security awareness in depth. In addition, our survey
adding new predictors in the second step. also analyzed unreported correlations; how various factors in

125146 VOLUME 8, 2020

A. Kovačević et al.: Factors Related to Cyber Security Behavior

particular and together, such as socio-demographic character- [10] D. M. Bada, ‘‘Cyber security awareness campaigns why do they fail to
istics, cyber security perceptions, cyber security breach expe- change behaviour?’’ Global Cyber Secur. Capacity Centre, Univ. Oxford,
Oxford, U.K., Tech. Rep., 2014. [Online]. Available: http://discovery.
riences, IT usage, and knowledge influence security behavior. ucl.ac.uk/1468954/
It was shown that the effects of cyber security perceptions, [11] H. Suryotrisongko and Y. Musashi, ‘‘Review of cybersecurity research
knowledge, and experiences are stronger than the effects of topics, taxonomy and challenges: Interdisciplinary perspective,’’ in
Proc. IEEE 12th Conf. Service-Oriented Comput. Appl. (SOCA),
socio-demographics for cell phone related behavior, or in Kaohsiung, Taiwan, Nov. 2019, pp. 162–167, doi: 10.1109/SOCA.
particular, IT usage and knowledge appeared as significant 2019.00031.
predictors of cell phone related behavior. However, any sig- [12] H. Kruger, L. Drevin, and T. Steyn, ‘‘A vocabulary test to assess infor-
mation security awareness,’’ Inf. Manage. Comput. Secur., vol. 18, no. 5,
nificant predictors have not been discovered for password pp. 316–327, Nov. 2010, doi: 10.1108/09685221011095236.
related behavior, which will be the focus of our future anal- [13] S. Al-Janabi and I. Al-Shourbaji, ‘‘A study of cyber security aware-
ysis. Even though our participants perceived that their data ness in educational environment in the middle east,’’ J. Inf. Knowl.
Manage., vol. 15, no. 1, Mar. 2016, Art. no. 1650007, doi: 10.1142/
were not safe, this did not serve as a trigger for them to learn S0219649216500076.
more about cyber security so as to find out how to behave [14] D. Jeske and P. van Schaik, ‘‘Familiarity with Internet threats:
more securely in cyberspace. Beyond awareness,’’ Comput. Secur., vol. 66, pp. 129–141, May 2017,
doi: 10.1016/j.cose.2017.01.010.
None of the participants answered all of the questions cor- [15] M. Gratian, S. Bandi, M. Cukier, J. Dykstra, and A. Ginther, ‘‘Correlating
rectly in the part of the questionnaire regarding knowledge, human traits and cyber security behavior intentions,’’ Comput. Secur.,
which led us to the conclusion that students do not have vol. 73, pp. 345–358, Mar. 2018, doi: 10.1016/j.cose.2017.11.015.
[16] S. Egelman and E. Peer, ‘‘Scaling the security wall: Developing a security
the required knowledge or adequate awareness of threats in behavior intentions scale (SeBIS),’’ in Proc. 33rd Annu. ACM Conf. Hum.
cyberspace. Although there are considerable resources on Factors Comput. Syst. (CHI), 2015, pp. 2873–2882.
the Internet, as well as numerous tutorials, these have not [17] A. Moallem, Cybersecurity Awareness Among Students and Faculty.
Boca Raton, FL, USA: CRC Press, 2019.
proved to be effective tools for students to learn. So, this can [18] K. Parsons, A. McCormac, M. Butavicius, M. Pattinson, and
be a signal to educational institutions to take a more active C. Jerram, ‘‘Determining employee awareness using the human aspects of
approach to improve cyber security knowledge in a structural information security questionnaire (HAIS-Q),’’ Comput. Secur., vol. 42,
pp. 165–176, May 2014, doi: 10.1016/j.cose.2013.12.003.
way and to teach students to protect themselves against cyber [19] A. McCormac, T. Zwaans, K. Parsons, D. Calic, M. Butavicius, and
attacks. The practical implications of our research are that in M. Pattinson, ‘‘Individual differences and information security aware-
future students should have effective training in high school ness,’’ Comput. Hum. Behav., vol. 69, pp. 151–156, Apr. 2017, doi: 10.
1016/j.chb.2016.11.065.
regarding more secure behavior. Future research should be [20] M. Anwar, W. He, I. Ash, X. Yuan, L. Li, and L. Xu, ‘‘Gender difference
focused on developing more effective training to encourage and employees’ cybersecurity behaviors,’’ Comput. Hum. Behav., vol. 69,
young users to behave more securely. pp. 437–443, Apr. 2017, doi: 10.1016/j.chb.2016.12.040.
[21] A. A. Cain, M. E. Edwards, and J. D. Still, ‘‘An exploratory study of cyber
hygiene behaviors and knowledge,’’ J. Inf. Secur. Appl., vol. 42, pp. 36–45,
REFERENCES Oct. 2018, doi: 10.1016/j.jisa.2018.08.002.
[1] Miniwatts Marketing Group. (2020). World Internet Users Statistics [22] K. Olmstead and A. Smith, ‘‘Americans and cybersecurity,’’ Pew Res.
and 2020 World Population Stats. [Online]. Available: https://www. Center, Washington, DC, USA, Tech. Rep., 2017. [Online]. Available:
internetworldstats.com/stats.htm https://www.pewinternet.org/2017/01/26/americans-and-cybersecurity/
[2] Ratel. Belgrade. Serbia. (2018). Digital Literacy and Internet Security. (in [23] K. Olmstead and A. Smith, ‘‘What the public knows about cybersecurity,’’
Serbian). [Online]. Available: https://www.cert.rs Pew Res. Center, Washington, DC, USA, Tech. Rep., 2017. [Online].
[3] F.-J. Hinojo-Lucena, I. Aznar-Diaz, M.-P. Caceres-Reche, Available: https://www.pewresearch.org/internet/2017/03/22/what-the-
J.-M. Trujillo-Torres, and J.-M. Romero-Rodriguez, ‘‘Factors influencing public-knows-about-cybersecurity/
the development of digital competence in teachers: Analysis of the [24] M. Anderson and E. Vogels, ‘‘Americans and digital knowledge,’’ Pew
teaching staff of permanent education centres,’’ IEEE Access, vol. 7, Res. Center, Washington, DC, USA, Tech. Rep., 2019. [Online]. Available:
pp. 178744–178752, 2019, doi: 10.1109/ACCESS.2019.2957438. https://www.pewresearch.org/internet/2019/10/09/americans-and-digital-
[4] ‘‘Cost of data breach study: Global overview,’’ Ponemon Inst. LLC., knowledge/
North Traverse City, MI, USA, Tech. Rep., 2017. [Online]. Available: [25] IBM SPSS Statistics for Windows, version 22.0, IBM Corp, Armonk, NY,
https://www.ibm.com/downloads/cas/ZYKLN2E3 USA, 2013.
[5] Joint Task Force (JTF) on Cybersecurity Education, ‘‘Cybersecurity cur- [26] D. Florencio and C. Herley, ‘‘A large-scale study of Web password habits,’’
ricula 2017-curriculum guidelines for post-secondary degree programs in in Proc. 16th Int. Conf. World Wide Web (WWW), Banff, AB, Canada, 2007,
cybersecurity,’’ Version 1.0, Tech. Rep. ACM/IEEE-CS/AIS SIGSEC/IFIP p. 657, doi: 10.1145/1242572.1242661.
WG 11.8, Dec. 2017. [Online]. Available: https://europe.acm.org/binaries/ [27] G. Notoatmodjo and C. Thomborson, ‘‘Passwords and perceptions,’’ in
content/assets/education/curricula-recommendations/csec2017.pdf Proc. 7th Australas. Inf. Secur. Conf. (AISC), Wellington, New Zealand,
[6] K. Parsons, D. Calic, M. Pattinson, M. Butavicius, A. McCormac, and 2009, pp. 71–78.
T. Zwaans, ‘‘The human aspects of information security questionnaire [28] A. Adams and A. M. Sasse, ‘‘Users are not the enemy,’’ Commun. ACM,
(HAIS-Q): Two further validation studies,’’ Comput. Secur., vol. 66, vol. 42, pp. 40–46, Apr. 1999, doi: 10.1145/322796.322806.
pp. 40–51, May 2017, doi: 10.1016/j.cose.2017.01.004. [29] R. W. Rogers, ‘‘A protection motivation theory of fear appeals and attitude
[7] B. D. Sawyer and P. A. Hancock, ‘‘Hacking the human: The prevalence Change1,’’ J. Psychol., vol. 91, no. 1, pp. 93–114, Sep. 1975. [Online].
paradox in cybersecurity,’’ Hum. Factors, J. Hum. Factors Ergonom. Soc., Available: https://www.tandfonline.com/doi/abs/10.1080/00223980.1975.
vol. 60, no. 5, pp. 597–609, Aug. 2018, doi: 10.1177/0018720818780472. 9915803
[8] B. K. Wiederhold, ‘‘The role of psychology in enhancing cybersecu- [30] M. Ovelgönne, T. Dumitraş, B. A. Prakash, V. S. Subrahmanian, and
rity,’’ Cyberpsychol., Behav., Social Netw., vol. 17, no. 3, pp. 131–132, B. Wang, ‘‘Understanding the relationship between human behavior and
Mar. 2014, doi: 10.1089/cyber.2014.1502. susceptibility to cyber attacks: A data-driven approach,’’ ACM Trans.
[9] D. E. de Zafra, S. I. Pitcher, J. D. Tressler, J. B. Ippolito, and M. Wilson, Intell. Syst. Technol., vol. 8, no. 4, pp. 51:1–51:25, Mar. 2017, doi: 10.1145/
‘‘Information technology security training requirements?: A role- and 2890509.
performance-based model,’’ Nat. Inst. Standards Technol., Gaithersburg, [31] G. A. Grimes, M. G. Hough, E. Mazur, and M. L. Signorella, ‘‘Older
MD, USA, Tech. Rep. NIST SP 800-16, 1998, doi: 10.6028/NIST.SP. adults’ knowledge of Internet hazards,’’ Educ. Gerontol., vol. 36, no. 3,
800-16. pp. 173–192, Feb. 2010, doi: 10.1080/03601270903183065.

VOLUME 8, 2020 125147

 A. Kovačević et al.: Factors Related to Cyber Security Behavior

ANA KOVAČEVIĆ was born in Belgrade, Serbia, OLIVER TOŠKOVIĆ received the Ph.D. degree in
in 1969. She received the B.S. degree in electri- anisotropy of perceived space from the Depart-
cal engineering and the M.S. degree in software ment of Psychology, University of Belgrade.
systems from the School of Electrical Engineer- He is currently an Assistant Professor with
ing, University of Belgrade, in 1993 and 2004, the Department of Psychology, University of
respectively, and the Ph.D. degree in software Belgrade, and also lectures part time at the Faculty
engineering from the Faculty of Organizational of Philosophy, Kosovska Mitrovica. He teaches
Sciences, University of Belgrade, in 2010. Statistics in Psychology, Statistics in Educational
From 1994 to 2004, she was involved in all Research, Multivariate Statistics, Academic Skills,
phases of the software development in busi- and Perception. He has participated in various
ness application systems in ‘‘Jugobanka’’ and the Public Enterprise projects regarding basic cognitive processes and also projects, such as PISA,
‘‘Elektroprivreda’’ Serbia. Since 2004, she has been with the Faculty of TIMSS, the academic motivation of students in Serbia, and the ACE-Serbia
Security Studies, University of Belgrade, where she is currently an Associate project. He has attended additional training in hierarchical linear modeling,
Professor. She has taught several undergraduate and graduate courses, such dynamical systems in psychology, structural equation modeling, IRT anal-
as computer science, information security, project management, and analysis ysis, and multi-level modeling. He has published 44 scientific articles and
and visualisation of data. She has authored three books, several book chap- 138 conference abstracts, which have been cited 277 times (h-index = 7), and
ters, and articles published in international journals. Her research interests has organized ten public exhibitions on experimental psychology topics. His
include information security, data mining, data bases, and information research interests include perception, statistics, and research methodology.
visualization. Dr. Tošković was granted the Psychological Society of Serbia Žiža Vasić
Dr. Kovačević is a member of GOOD-OLD-AI, a society for Award for the popularization of psychology, in 2012. From 2012 to 2018,
object-oriented design and artificial intelligence. he was an Action Editor for the international journal Psihologija and a
Reviewer for many international journals.

NENAD PUTNIK was born in Belgrade, Serbia,

in 1977. He received the B.S. degree in philoso-
phy from the Faculty of Philosophy, University of
Belgrade, in 2002, and the M.S. and Ph.D. degrees
from the Faculty of Security Studies, University of
Belgrade, in 2008 and 2012, respectively.
From 2004 to 2012, he was an Instructor with
the Faculty of Security Studies, University of
Belgrade, on the following graduate and postgrad-
uate courses: conflict theories, conflict manage-
ment, and methodology of scientific research. From 2013 to 2018, he was an
Assistant Professor on the courses: conflict theories, conflict management,
and designing data protection systems. Since 2018, he has been an Associate
Professor with the Faculty of Security Studies, University of Belgrade, on the
aforementioned courses. He also lectures at postgraduate level studies, where
he teaches the course cybercrime and national security. He also teaches cyber
security at the Diplomatic Academy of the Serbian Ministry of Foreign
Affairs. He has published a number of academic articles, book chapters,
and encyclopedic determinants in the field of cyber security, cyber warfare,
conflict theories, and human security. He has authored the book Cyber
Space and Security Challenges (Faculty of Security Studies, University of
Belgrade, 2009).

125148 VOLUME 8, 2020