Content area
Purpose
This research investigates mobile security awareness among university students in Hong Kong, who increasingly rely on mobile devices for their daily activities and academic needs. This research seeks to inform targeted educational strategies and policies to enhance mobile security practices among young adults, particularly in regions similar to Hong Kong, where mobile usage is extensively integrated into everyday life.
Design/methodology/approach
Utilizing an online survey, this research assessed the mobile security awareness of 407 university students from Hong Kong. The Mann-Whitney U-test and other statistical methods were employed to analyze differences in security awareness based on demographic factors such as IT background, gender, educational level and participation in mobile security courses.
Findings
The research revealed a generally high level of mobile security awareness compared to similar research in other regions. It also highlighted that despite no significant difference in awareness between genders, students from IT-related fields or those who participated in mobile security courses exhibit higher awareness levels. These findings underscore the impact of focused education and training on enhancing mobile security awareness.
Originality/value
This research contributes to the limited but growing body of literature on mobile security awareness from the end-user perspective, particularly among university students in the Asia Pacific region. It offers valuable insights for governments, educators and corporate policymakers worldwide, providing a basis for integrating mobile security education into broader academic and professional training programs.
Introduction
Many people worldwide possess one or more mobile devices since they have become more popular and affordable, including smartphones, tablets, laptops, and wearable devices (Delgado-Santos et al., 2022; Ezeamuzie et al., 2024). They can spend a lower price to gain high-quality mobile devices with high-speed processing, changing various information consumption habits of people, especially youths and students (Yu et al., 2022; Yip et al., 2021; Zhang et al., 2021). Also, people spend more time using their mobile devices because they can provide multi-functions to satisfy their daily lives, such as gaming, processing documents, learning, watching videos, listening to music, browsing social media sites, and using instant messaging applications to communicate with others (Cheng et al., 2024; Dong et al., 2021; Fan et al., 2020; Lau et al., 2020). The recent development of smart cities (Chang and Abdel-Basset, 2022), classrooms (Zhu et al., 2023), and libraries (Khan et al., 2023; Wang, 2024) has further increased the usage of mobile devices.
Due to the above reasons, malicious individuals and organizations widely directed against their mobile devices to launch different levels of attack, for example, phishing attacks, spyware, network spoofing, malware, DDoS, and Botnet, to retrieve or steal useful personal information and data (Hui et al., 2024; Ho et al., 2021; Sheila et al., 2015). They can also retrieve a vast amount of personal information in various forms and for multiple purposes via the vulnerabilities of mobile device sensors (Delgado-Santos et al., 2022). With the recent development of the Internet of Things (IoT), end-users use more and more devices connected to their multiple mobile devices, which may involve increasing security knowledge to prevent hacking (Cheung et al., 2023). Therefore, mobile security is becoming increasingly important nowadays, and more people are concerned about their privacy and security on their mobile devices (Ho et al., 2021, 2023; Jiang et al., 2022; Wang et al., 2021; Jain and Shanbhag, 2012).
Although young people and students are the most prevailing users of mobile devices, scant studies focus on university students' mobile information security awareness, especially in the Asia Pacific. In particular, students have increased their mobile device usage during the COVID-19 pandemic due to the massive lockdown of educational institutions and libraries (Huang, 2023; Huang et al., 2021, 2022, 2023; Istek and Ironsi, 2024; Yu et al., 2023). Besides, studies seldom reveal mobile information security from end-user perspectives but primarily focus on system and technology perspectives.
Thus, through a questionnaire survey, this research examines mobile information security awareness regarding university students' behaviors, attitudes, and knowledge. To reveal the similarities and differences among various demographic factors, we examine the target group of local students studying Information Technology (IT) versus non-IT related majors, genders, and educational levels. Our results suggest that educating security knowledge and enhancing their awareness are remedies in information literacy and information technology courses (Hui et al., 2024). Thus, the following research questions guide this research in accomplishing our objectives.
Literature review
Mobile devices
Mobile devices are becoming more powerful and multi-functional, necessitating more deeply integrated CPUs comparable to the computing power of desktop computers (Ko et al., 2015; Wai et al., 2018; Hui et al., 2024). All smartphones, tablets, and laptops have excellent performances for playing high-definition videos, playing interactive games, browsing the web, connecting to social media platforms, and using various applications (Ni et al., 2022; Ezeamuzie et al., 2024). There were more than 7.7 billion end-users or connections on mobile devices in 2016, and more than 3.7 billion mobile connections came from smartphone end-users (Koyuncu and Pusatli, 2019). Moreover, Bring Your Own Device (BYOD) is also on the rise, in which people utilize their mobile devices for personal and professional purposes, such as higher education, business, and healthcare (Harris et al., 2014; Ho et al., 2024; Stephens et al., 2017). However, Harris et al. (2014) mentioned that employees potentially take insecure mobile devices into the workplace, which might damage the organization’s information security.
Mobile information security
Mobile device security has been raised for over 15 years, and many people are only concerned with the Internet and mobile platform availability and performance rather than cyber and mobile information security (Hui et al., 2024). For example, Harris et al. (2014) revealed that mobile devices represent a risk to companies when utilized and taken outside physical borders because of their tiny size, memory capacity, and simplicity with which information may be accessed and removed from a facility. Recently, mobile information security is becoming more challenging. The widespread utilization of the Internet on mobile devices has raised issues of information leakage, sharing, tracking, and collection (Koohang et al., 2019), especially when data are automatically synchronized to cloud data storage (Hui et al., 2024). Various malware has recently increased, and more malicious individuals have exploited it to attack different mobile platforms. Besides, recently, jailbreaking and rooting, Wi-Fi security, and physical security are important issues for mobile information security (Ho et al., 2021).
Mobile malware
Mobile malware attacks are the most prominent risk end-users face when utilizing mobile devices. The adoption rate of Android mobile devices has rapidly increased in recent years as the Android operating system (OS) is very attractive and popular, but leading to many security concerns as many new malware attacks target the Android platform (Qamar et al., 2019). During the fourth quarter of 2017, 8,225 new malware samples attacked the Android operating system, with 744,065 malware samples identified. Also, 700,000 apps with malicious information were discovered, violating the Google Play Store’s security standard. Garg and Baliyan (2021) revealed that Android is more vulnerable to security breaches and malware assaults than iOS. Although iOS is more secure than Android OS, it is still susceptible to malware assaults, and the attack trend is increasing (Garg and Baliyan, 2021). Previous studies have discovered that iOS can be simply jailbroken while the SSH server is actively operating (Teufl et al., 2013). Moreover, different back doors, surveillance mechanisms, and attack points were identified. Thus, mobile malware is a massive security challenge on the leading mobile device platforms of Android and iOS.
Mobile malware or malicious software is designed to harm mobile device platforms by interfering with regular operations and access controls, collecting sensitive information, showing undesired advertisements, or taking control of the device without the user’s awareness (Qamar et al., 2019). Furthermore, most people have problems with malware and accidentally destructive software, including badware, worms, ransomware, viruses, Trojans, Botnets, rootkits, etc.
Mobile security awareness and student practices
As this research focuses on students' mobile security awareness, we reviewed some studies on their related information practices and habits. For example, Androulidakis and Kandus (2011) investigated Budapest students' mobile phone security awareness and practices in four universities and showed that many students were worried about security concerns and data interception, as well as the possibility of an attacker gaining illegal access to their equipment. Yet, they found no security culture among participants as they had no sophisticated technical understanding of their mobile devices, they did not have appropriate security education, and many did not back up the data on their mobile phones. A recent study found that students using cloud data for storage and backup still face many reliability and security issues (Hui et al., 2024).
Sabeeh and Lashkari (2011) studied users from Malaysia and explored the users' level of security awareness for existing threats, the user’s attitude concerning mobile security, and the necessity for more security. Their results indicated that approximately half of the respondents reported experiencing signs of infected devices, such as no response or strange activities, while a smaller percentage reported losing data without eliminating it. Alarmingly, almost half of the students did not use password protection and manual login when utilizing social network applications and email services, which enhances the risk of data compromise.
Moletsane and Tsibolane (2020) examined knowledge, attitudes, normative beliefs, and intentions influencing students' mobile security awareness at a South African higher education institution with the Knowledge-Attitude-Behavior (KAB) model and the Theory of Planned Behavior (TPB). Their results showed that the mobile security behavior of students was affected by knowledge about security intentions and threats to be security compliant. Moreover, the results highlighted a contradiction between doing and knowing, in which students with information security knowledge fail to apply it to safe information security practices.
Demographic comparison for the mobile device security awareness
Earlier research (Ho et al., 2021) suggested that cultural background and gender affect people’s adoption of computer security behavior. Parker et al. (2015) evaluated the students of a large research university on their security awareness of vulnerabilities, threats, and the application of security controls. Their results showed the adoption and perceived effectiveness of authentication and anti-theft measures and uncovered many relationships between these factors and smartphone OS, language, and gender. They also discovered male respondents are more aware and willing to adopt the security controls than females, aligning with recent findings of differences in information habits and preferences between genders (Ezeamuzie et al., 2024; Hui et al., 2024).
Harris et al. (2014) investigated the mobile security awareness of college students and demonstrated that participants lack mobile security awareness, whether they are studying IT or not. They also showed that both IT and non-IT students have weak security awareness and behavior. Both studies suggested that college students should attend the mobile device security course to enhance their security knowledge and improve their behavior. With newer technologies, like using cloud storage from mobile devices, further education and training in mobile security awareness are necessary (Hui et al., 2024).
Watson and Zheng (2017) researched user awareness of mobile security recommendations. Their result demonstrated that users, particularly those with little background in information technology, frequently overlook or are unaware of essential security alternatives. Moreover, they revealed that the participants with information technology or security training have better performance and higher awareness. Ophoff and Robinson (2014) explored end-user smartphone security awareness in South Africa and found that participants who had taken mobile technology courses had better smartphone security awareness. Koyuncu and Pusatli (2019) performed an exploratory case study on the security awareness level of smartphone users in Ankara. They found respondents' awareness levels were generally relatively low and needed significant improvement. The oldest age group, followed by the youngest, had the lowest level of awareness. Furthermore, they revealed that the degree of awareness is generally positively correlated with education level.
Methodology
This research applied a quantitative method to all the research questions described above. The survey instrument was modified from Anderson and Agarwal (2010) and Ho et al. (2021), as their research focused on desktop computer security but not mobile security. This adaptation was necessary to address the specific context of mobile security, which presents unique challenges and considerations not covered in the original research.
Theoretical framework
Anderson and Agarwal (2010) developed a research model to investigate security behavioral intention, which serves as the theoretical backbone for this research, providing a robust framework to examine security behavioral intentions. This model has been widely utilized to investigate how prospective individuals' perspectives, attitudes, and intentions toward new technology influence their adoption behavior. Ho et al. (2021) further adapted this framework to the context of home computers using data collected from Guam. The primary constructs included subjective norm, descriptive norm, self-efficacy, psychological ownership, concern regarding security threats, perceived citizen effectiveness, and intention to perform security-related behavior. Cognitive, social, and psychological factors impact an individual’s intention to engage in security-related activities. Subjective norms and other psychological aspects impact an individual’s security-related behavior. These constructs guide the design of the questionnaire, ensuring that each aspect of mobile security awareness is methodically assessed through targeted questions.
Questionnaire design
The survey consists of multiple-choice and Likert-scale questions organized into several parts that correspond to the theoretical constructs. Table 1 summarizes 70 questions in this survey, with Part A asking about respondents' demographics and Part B for the model-based questions (see Appendix for the detailed items). The faculty-level ethics committee approved this research.
Data collection and analysis
The online questionnaire first underwent a pilot test. Then, it was distributed to the target participants, university students in Hong Kong, via various channels like social media platforms (Facebook, Instagram, Twitter), instant messaging applications (WhatsApp, Signal, Telegram), and email in the summer of 2022, resulting in 407 completed responses. Because the questionnaire link was extensively distributed on social media and the number of recipients in many email distribution lists could not be accessed, the respondent rate for our sample cannot be calculated. Participants have a relatively diversified background in age, academic level (from an associate degree to a Ph.D.), and academic discipline (IT vs non-IT). All Cronbach’s Alpha values (Cronbach, 1951) exceeded 0.70, except for perceived citizen effectiveness (α = 0.69). According to Statistica’s 2022 figures (https://www.statista.com/statistics/708055/hong-kong-tertiary-education-full-time-enrollment-by-type-of-degree/), Hong Kong has around 92,000 undergraduate students, 47,000 postgraduate students, and 24,000 sub-degree (i.e. associate degree) students.
Using IBM SPSS for data analysis allowed for sophisticated statistical tests, including the Mann-Whitney U-Test and Kruskal-Wallis Test, to compare responses across different demographic and educational backgrounds. The survey research adopted the 7-point Likert Scale. The choice of the Mann-Whitney U-Test and Kruskal-Wallis Test is grounded in its effectiveness in dealing with skewed data distributions and its robustness in smaller sample sizes, which is particularly relevant when comparing subgroups within our sample where normality cannot be assumed. Descriptive statistics were used to analyze the data and compare the previous demographic variables. Mann-Whitney U-Test was used to compare the mean and standard deviation of questionnaire scores between IT and non-IT students, male and female, students attending mobile technology courses, and students not attending mobile technology courses. The Kruskal-Wallis Test was used to compare questionnaire mean scores and standard deviation among students with different education levels, providing a comprehensive view of how mobile security awareness varies with educational attainment without assuming a normal distribution.
Results
Demographic information
Table 2 shows the respondents' demographic information, including gender types, education level, majors, and whether they attended mobile security courses. Our participants included slightly more males (50.85%), with a majority with a Bachelor’s Degree (51.60%). Most were studying a non-IT discipline (67.37%) without much mobile security training (59.46%).
Gender comparison
We used the Mann-Whitney U-Test to compare respondents' mobile security awareness scores between gender types. There was no statistically significant difference between males (mean = 5.300, SD = 0.927) and females (mean = 5.161, SD = 1.069), with z-score = −1.096 (p > 0.10). Further analysis at the construct level showed that only security behavior self-efficacy (SE) had a statistically significant difference between males (mean = 5.205, SD = 1.283) and females (mean = 4.9110, SD = 1.337), with z-score = −2.796 (p = 0.005) (see Tables 3–6).
IT majors/non-IT majors student comparison
We used the Mann-Whitney U-Test to compare respondents' mobile security awareness scores between IT and non-IT majors. There was a statistically significant difference between IT majors (mean = 5.399, SD = 0.9885) and non-IT majors (M = 5.134. SD = 0.997), with z-value = −2.868 (p = 0.004). At the construct level, Concern (C), Descriptive Norm (DN), Psychological Ownership for the mobile Internet (POI), and Psychological Ownership for Own Mobile Device (POC) have no statistical difference.
Taken/not taken mobile technology course
A Mann-Whitney U-Test was also conducted to compare respondents' mobile security awareness scores between taken and not taken mobile technology courses. There was statistically significant difference between taken (mean = 5.417, SD = 0.9423) and not taken the courses (M = 5.105, SD = 1.021), with z-score = −3.388 (p < 0.001). At the construct level, our result demonstrated that only Concern (C) and Psychological Ownership for Own Mobile Device (POC) were no statistically significant difference.
Education level comparison
A Kruskal-Wallis H-Test was conducted to examine the effect of education levels on mobile security awareness. Education levels included four groups: Higher Diploma/Associate Degree (mean = 5.161, SD = 0.782), Bachelor’s degree (mean = 5.171, SD = 1.114), Master’s degree (mean = 5.322, SD = 0.790), Doctoral degree (mean = 5.495, SD = 1.264). Kruskal-Wallis H Test determined a statistically significant difference between groups (χ2 = 8.628, p = 0.035). After the breakdown into the construct level, the subjective norm (SN) is the most significant difference (χ2 = 19.718, p < 0.001), with the doctoral degree (mean = 5.200, SD = 1.510) higher than Higher Diploma/Associate Degree (mean = 4.970, SD = 1.068), Bachelor’s degree (mean = 4.468, SD = 1.468), and Master’s degree (mean = 5.128, SD = 1.113).
Discussion
Mobile security awareness between genders
Results showed no significant differences in overall mobile security awareness between genders, implying that they have similar levels of awareness in the demographic groups. However, breaking down into different constructs revealed that gender has a partial effect on security awareness, consistent with the research of Parker et al. (2015) that males have a higher mobile security awareness than females. For example, our results showed that males performed better on the Security Behavior Self-Efficacy, aligning with Parker et al. (2015) that males had a higher smartphone awareness and were more willing to adopt smartphone security controls.
Mobile security awareness between IT and non-IT majors
The previous part shows statistical differences between IT and non-IT majors, which means that IT majors generally have a higher mobile security awareness than non-IT majors. Nevertheless, our overall result contrasts with the research implemented by Harris et al. (2014). The overall result from Harris et al. (2014) illustrated that IT majors did not have better mobile device security awareness than non-IT majors; even IT majors had more risk as they like to root or jailbreak mobile devices. Nevertheless, after breaking it down into different constructs, we observed that four variables did not have significant differences: Concern, Descriptive Norm, Psychological Ownership for the Mobile Internet, and Psychological Ownership for Own Mobile Device between IT and non-IT majors. This discrepancy may be attributed to the different study populations, as Harris et al. (2014) focused on college students, while our research targeted university students.
Mobile security awareness between students who have taken and not taken mobile security courses
According to the previous part, there are significant differences between the university students who have taken mobile technology courses and those who have not, indicating higher security awareness among those with course experience. Research conducted by Watson and Zheng (2017) and Ophoff and Robinson (2014) got a similar result to this research that people who attended mobile technology or information security courses would have higher IT and security familiarity with following the security recommendations, as well as have more accurate judgment toward the application whether can be trusted. Breaking down different constructs revealed only Concern and Psychological Ownership for Own Mobile Devices got a similar result between taking and not taking mobile technology courses. Students who took mobile security courses got better security awareness because they learned the basic operations of mobile devices and the related application coding techniques, such as limiting the permissions that applications can use, what permissions are required, and how to obtain permissions through coding. Therefore, they have better awareness to protect their devices, while those who have not taken mobile technology courses should attend them to enhance relevant knowledge.
Mobile security awareness across education level
Our findings revealed that students at a higher education level have better mobile security awareness than more junior students, aligning with the results of Koyuncu and Pusatli (2019). Thus, mobile information security or cybersecurity education is essential. Another reason for this result is that higher education students can have better critical thinking, read more articles or news, and have more chances to receive information security information from courses than junior students. Breaking down different variables revealed the most significant difference was the subjective norm, showing that students with higher education levels scored significantly higher.
Implications and suggestions
This research revealed that gender is one of many factors influencing mobile security awareness. Other factors such as age, education, and experience with technology also play critical roles. This finding is consistent with prior findings (Alzaidi and Shehawy, 2022; Shahzad et al., 2021). In addition, it is essential to recognize that these gender differences may be influenced by societal factors such as gender stereotypes and gender expectations around technology use. Ultimately, more research is needed to understand better the complex relationship between gender and mobile security awareness.
The results also indicated that non-IT majors university students in Hong Kong who have not taken mobile technology courses and those at lower education levels have lower mobile security awareness and relevant knowledge to secure their mobile devices. As technology evolves, so do the risks and vulnerabilities associated with mobile devices (Hui et al., 2024). Therefore, they may have a higher risk and frequently be affected by various information security issues, such as security violations, easily being hacked, and information leakage. Individuals should stay informed about the latest mobile security threats and best practices to protect their devices and personal information.
To increase students' exposure, educational institutions should incorporate mobile security awareness and training into their curricula to address these gaps, especially in the foundation year and general education credits or, even more preferable, in K-12 education, as mobile security is nowadays an essential skill set in our daily lives (Sağlam et al., 2023). Studies demonstrate the significance of mobile device security awareness and training in the workforce. Mauri Medrano et al. (2023) stated that combining digital competence with ICT encourages problem-solving communication and collaboration skills. Mobile device security awareness should be added to the broader program (Nedungadi et al., 2018) in educational institutions, public libraries, and vocational training. Mobile device users should be knowledgeable about threats and necessary security measures and have the skills to protect their devices. Hollister et al. (2017) reported that mobile devices should have installed antivirus, firewall, and data wipe software. Woodley et al. (2015) emphasized the importance of security policies with mobile device components because more businesses are embracing online technologies and the Internet and have increased their use of various mobile devices.
Further, Koyuncu and Pusatli (2019) reflected from their research that educators should add mobile security courses or alter the existing courses' contents for all university students from different education levels to increase mobile security awareness and knowledge. Therefore, a mobile security course is recommended in higher education (compulsory in each major, i.e. a general education component) for every first-year university student because most already own one or more mobile devices with Internet access (Lau et al., 2017, 2020; Wai et al., 2018; Yip et al., 2021), and they are, nowadays, more used to engaging online learning through their devices (Ho et al., 2024). This may cause higher risks of damaging the university’s assets, other students' mobile devices, their own data and information. Mobile security courses should cover the essential operation of mobile devices on the various operating systems, such as how to limit the permission for particular mobile devices, using 8–12 characters with capital letters and special characters to protect confidential documents, provide tips on using public Wi-Fi, how to prevent data theft, avoid phone fraud, securing a wireless network, and protect mobile devices physically (Watson and Zheng, 2017).
Because educating a vast amount of mobile security information is necessary, the course duration should be the same as another regular course (i.e. a 3-credit course of 45 contact hours). Also, mobile security courses should include assessments, like quizzes and examinations in multiple-choice and short-question formats. Mobile security should be a part of the larger conversation about cybersecurity, and students should be equipped with the knowledge and skills to protect themselves and others from cyber threats. Thus, the university can ensure all students have learned the relevant knowledge and enhance their awareness, regardless of their major or field of study. Moreover, the grading system of this course should be similar to other compulsory courses in the university.
Ranasinghe (2014) and Riglietti (2017) claimed that holding mobile or cyber security talks with invited relevant experts could bring valuable opinions to the target audience to help them gain knowledge and improve awareness effectively. Hence, the second suggestion is to organize and conduct mobile security or technology talks or seminars at universities. They can try to invite professors who may come from other regions and implement research in the information security field to give the talk to the students. Furthermore, they can invite the company managers, consultants, and auditors to share their experience on information security tasks such as firewalls, DDoS protection, antivirus programs, etc. Thus, they can catch up with the mobile security trend and the world’s latest security information.
Moreover, such courses provide a good channel for guest speakers, possibly from the practice, to share their security knowledge and experience in maximizing protection to secure mobile devices on different operating systems, like iOS, Android, Windows, and macOS. The mobile security or technology talks should be launched periodically, like once a month. These talks should be open to the public, no matter whether the students come from different universities, secondary school students, general adults, and other worldwide people, to have better security awareness and knowledge to protect themselves and others, as well as Internet safety.
Implementing these suggestions can help university students enhance their security awareness and knowledge, regardless of their gender, education level, and whether they are IT or non-IT students who have taken or not taken mobile technology courses. By increasing mobile security awareness and knowledge, students can better protect themselves and others, as well as Internet safety, and help reduce the risk and frequency of various information security issues. After graduation, with proper training, they can bring their good practices into the workplace to benefit businesses and society. Further, when these courses mature, leading universities can offer them on MOOC platforms (Cheng et al., 2023), benefiting a broader audience that includes the general public, especially for workplace training, school students, parents, and teachers.
Conclusion
This research provides valuable insights into the mobile information security awareness of university students in Hong Kong. It offers a comprehensive understanding of how factors such as gender, educational level, and academic background (IT vs non-IT) influence awareness levels. The result demonstrates that university students in Hong Kong have great mobile security awareness. Our findings indicate that while gender does not significantly impact mobile security awareness, students majoring in IT, those who have taken mobile technology courses, and those at higher educational levels demonstrate superior awareness compared to their non-IT counterparts, students who have not taken such courses, and those at lower educational levels. Mobile security awareness is vital as it is the most effective way to solve security issues since attack methods change continuously. It is also one of the essential ways to protect national security nowadays. The high level of awareness among Hong Kong university students underscores the effectiveness of current educational strategies and highlights areas for improvement. The findings emphasize the importance of enhancing mobile security education across various demographics to mitigate risks associated with rapidly evolving attack methods. This research supports the integration of mobile security courses as a compulsory component of the curriculum, reinforcing the need for continuous adaptation in educational strategies to address emerging security challenges. Furthermore, governments, policymakers, and academic educational institutions worldwide can reference the result to decide whether to implement the mobile information security course as a compulsory part of the curriculum and adjust the education policy.
This research utilized a survey approach, which may be subject to social desirability bias and varying levels of engagement from respondents, potentially affecting the results. Furthermore, this approach could not obtain in-depth findings into why IT majors and students who took mobile technology courses have higher mobile security awareness than non-IT majors who do not take mobile technology courses. These are potential topics for further research.
Future research should consider qualitative methods, such as interviews or focus groups, to understand better the underlying factors influencing mobile security awareness. Longitudinal studies could also be beneficial in tracking changes in awareness over time and assessing the long-term impact of educational interventions, especially due to changes during and after the COVID-19 pandemic (Huang et al., 2021, 2022, 2023).
In summary, while this research highlights significant trends and provides actionable insights, further research is essential to develop a more nuanced understanding of mobile security awareness and to inform the development of more effective educational programs and policies. By enhancing mobile security education, institutions can better prepare students to navigate and mitigate security threats, contributing to a safer digital environment.
Table 1
Questionnaire design
| Parts | Questions |
|---|---|
| Part A: Demographics | Age, Gender, Educational Level, Mobile Technology Course, Internet Experience, Security Violation, Media Exposure, Mobile Devices, Desktop Computer |
| Part B I: Concern | Harm HK government and corporations, steal data, Gain access to personal data, information and social media, unauthorized use of applications |
| Part B II: Security Behavior Self-Efficacy | Taking security measures: secure devices, limit threats, under control, resource and knowledge |
| Part B III: Perceived Citizen Efficacy | Adopt security measures, personal efforts, everyone can make a difference, no person can help to secure the Internet |
| Part B IV: Subjective Norm | Friends, the university, significant others, my peers |
| Part B V: Descriptive Norm | Believe and convince other people, the majority to take security measures on mobile devices, to protect the Internet, and prevent attacker attack |
| Part B VII: Psychological Ownership for Own Mobile Device | Mobile device and personal data |
| Part B VIII: Attitude Toward Performing Security-Related Behavior | Security measures, system and software updates, the importance of taking security measures, application updates and installation, Jailbreak or rooting |
| Part B IX: Intentions to Perform Security-Related Behavior (Internet) | Likely to take security measures to protect users, systems, and devices on the Internet |
| Part B X: Security-Related Behavior (Own Mobile Devices) | Likely to take system and software, protect data, take good care of physical mobile devices |
Source(s): Table created by authors
Table 2
Demographics (n = 407)
| Demographics | Number | |
|---|---|---|
| Gender | Male | 207 (50.85%) |
| Female | 200 (49.15%) | |
| Education Level | Higher Diploma/Associate Degree | 59 (14.50%) |
| Bachelor Degree | 210 (51.60%) | |
| Master Degree | 113 (27.76%) | |
| Doctoral Degree | 25 (6.14%) | |
| Major | IT | 145 (32.63%) |
| Non-IT | 262 (67.37%) | |
| Mobile security training | Yes | 165 (40.54%) |
| No | 242 (59.46%) | |
Source(s): Table created by authors
Table 3
Gender comparison
| Male (n = 207) | Female (n = 200) | Z-score | p-value | |
|---|---|---|---|---|
| Overall | 5.300 | 5.161 | −1.096 | 0.273 |
| Concern (C) | 5.603 | 5.406 | −1.097 | 0.273 |
| Security behavior self-efficacy (SE) | 5.205 | 4.911 | −2.796 | 0.005** |
| Perceived citizen efficacy (PCE) | 4.587 | 4.440 | −0.821 | 0.412 |
| Subjective norm (SN) | 4.672 | 4.870 | −1.187 | 0.235 |
| Descriptive norm (DN) | 4.581 | 4.793 | −1.794 | 0.073 |
| Psychological ownership for the mobile internet (POI) | 5.018 | 4.915 | −1.140 | 0.254 |
| Psychological ownership for own mobile device (POC) | 5.630 | 5.428 | −1.879 | 0.060 |
| Attitude toward performing security-related behavior (ATB) | 5.517 | 5.319 | −1.740 | 0.082 |
| Intentions to perform security-related behavior (Internet) (INTI) | 5.274 | 5.147 | −1.038 | 0.299 |
| Intentions to perform security-related behavior (own mobile devices) (INTC) | 5.670 | 5.453 | −1.430 | 0.153 |
Note(s): ***p < 0.001; **p < 0.01; *p < 0.05
Source(s): Table created by authors
Table 4
IT majors /non-IT majors students comparison
| IT (n = 145) | Non-IT (n = 262) | Z-score | p-value | |
|---|---|---|---|---|
| Overall | 5.399 | 5.139 | −2.868 | 0.004** |
| Concern (C) | 5.589 | 5.461 | −1.287 | 0.198 |
| Security behavior self-efficacy (SE) | 5.290 | 4.934 | −2.976 | 0.003** |
| Perceived citizen efficacy (PCE) | 4.698 | 4.413 | −2.635 | 0.008** |
| Subjective norm (SN) | 5.107 | 4.582 | −4.136 | <0.001*** |
| Descriptive norm (DN) | 4.740 | 4.655 | −0.639 | 0.523 |
| Psychological ownership for the mobile internet (POI) | 5.012 | 4.94 | −0.687 | 0.492 |
| Psychological ownership for own mobile device (POC) | 5.685 | 5.445 | −1.650 | 0.099 |
| Attitude toward performing security-related behavior (ATB) | 5.656 | 5.289 | −4.312 | <0.001*** |
| Intentions to perform security-related behavior (internet) (INTI) | 5.444 | 5.083 | −2.860 | 0.004** |
| Intentions to perform security-related behavior (own mobile devices) (INTC) | 5.748 | 5.461 | −2.697 | 0.007** |
Note(s): ***p < 0.001; **p < 0.01; *p < 0.05
Source(s): Table created by authors
Table 5
Taken/not taken mobile technology course
| Taken mobile technology course (n = 165) | Not taken mobile technology course (n = 242) | Z-score | p-value | |
|---|---|---|---|---|
| Overall | 5.417 | 5.105 | −3.388 | <0.001*** |
| Concern (C) | 5.600 | 5.443 | −1.633 | 0.102 |
| Security behavior self-efficacy (SE) | 5.316 | 4.886 | −3.115 | 0.002** |
| Perceived citizen efficacy (PCE) | 4.696 | 4.392 | −2.144 | 0.032* |
| Subjective norm (SN) | 5.120 | 4.530 | −4.389 | <0.001*** |
| Descriptive norm (DN) | 4.973 | 4.489 | −4.174 | <0.001*** |
| Psychological ownership for the mobile internet (POI) | 5.162 | 4.835 | −1.966 | 0.049* |
| Psychological ownership for own mobile device (POC) | 5.560 | 5.511 | −0.081 | 0.936 |
| Attitude toward performing security-related Behavior (ATB) | 5.592 | 5.302 | −3.005 | 0.003* |
| Intentions to perform security-related behavior (Internet) (INTI) | 5.509 | 5.008 | −3.934 | <0.001*** |
| Intentions to perform security-related behavior (own mobile devices) (INTC) | 5.808 | 5.397 | −3.856 | <0.001*** |
Note(s): ***p < 0.001; **p < 0.01; *p < 0.05
Source(s): Table created by authors
Table 6
Education level comparison
| Higher diploma/Associate degree (n = 59) | Bachelor’s degree (n = 210) | Master’s degree (n = 113) | Doctoral degree (n = 25) | Total | H (chi-square) test statistics | p-value | |
|---|---|---|---|---|---|---|---|
| Overall | 5.161 | 5.171 | 5.322 | 5.495 | 8.628 | 0.035* | |
| Concern (C) | 5.278 | 5.543 | 5.502 | 5.760 | 5.507 | 9.679 | 0.022* |
| Security behavior self-efficacy (SE) | 5.051 | 5.025 | 5.048 | 5.440 | 5.060 | 7.051 | 0.070 |
| Perceived citizen efficacy (PCE) | 4.547 | 4.425 | 4.522 | 5.160 | 4.515 | 10.632 | 0.014* |
| Subjective norm (SN) | 4.970 | 4.468 | 5.128 | 5.200 | 4.769 | 19.718 | <0.001*** |
| Descriptive norm (DN) | 4.864 | 4.532 | 4.918 | 4.490 | 4.685 | 8.418 | 0.038* |
| Psychological ownership for the mobile internet (POI) | 4.836 | 4.902 | 5.065 | 5.387 | 4.967 | 6.681 | 0.083 |
| Psychological ownership for own mobile device (POC) | 5.328 | 5.502 | 5.676 | 5.600 | 5.531 | 8.747 | 0.033* |
| Attitude toward performing security-related behavior (ATB) | 5.363 | 5.359 | 5.516 | 5.630 | 5.420 | 5.798 | 0.122 |
| Intentions to perform security-related behavior (internet) (INTI) | 5.271 | 5.100 | 5.295 | 5.627 | 5.211 | 7.974 | 0.047* |
| Intentions to perform security-related behavior (own mobile devices) (INTC) | 5.394 | 5.494 | 5.748 | 5.710 | 5.563 | 5.450 | 0.142 |
Note(s): ***p < 0.001; **p < 0.01; *p < 0.05
Source(s): Table created by authors
© Emerald Publishing Limited.