Factors Affecting Cybersecurity Awareness among University Students

Abstract

One of the essential stages in increasing cyber security is implementing an effective security awareness program. This work studies the present level of security knowledge among Imam Abdulrahman Bin Faisal University college students. A module was created to assist the students in becoming more informed. The main contribution of this work is an assessment of cybersecurity awareness among the university students based on three essential aspects: password security, browser security, and social media. Numerous questions were designed and sent to them to evaluate their awareness. The current survey received as many as 450 responses with their answers. Various statistical analyses were applied to the responses, including the validity and reliability test, feasibility test of a variable, correlation test, multicollinearity test, multiple regression, and heteroskedasticity test, carried out using SPSS. Furthermore, a multiple linear regression model and coefficient of determination, a hypothesis test, ANOVA test, and a partial test using ANOVA were also carried out. The hypothesis investigated here concerns password security, browser security, and social media. The results of partial hypothesis testing using a t-test showed that the password security variable significantly affects cybersecurity awareness (p-value = 0.0001). The regression coefficient of the password security variable in the multiple linear regression model was found to have a beta value of 0.147. In addition, the browser security variable significantly affects awareness, with a p-value = 0.0001. The regression coefficient of the password security variable had a beta value of 0.188. The social media activities variable significantly affects cybersecurity awareness (p-value = 0.0001). The regression coefficient of the social media activities variable had a beta value of 0.241. Based on the research conducted, it is concluded that knowledge of password security, browser security, and social media activities significantly influences cybersecurity awareness in students. Overall, students have realized the importance of cybersecurity awareness.

1. Introduction

The rapid advancement of contemporary technology has altered our life, particularly the methods of communication utilized to provide information and interact with people. Everywhere in the world, several networking techniques have been developed. In response, both the social and commercial spheres have begun to offer additional services and embrace new technologies to give customers data access anywhere at any time and from any place. The primary motivation for automation operations and innovation is to help the diverse variety of customers, fast-expanding due to increased Internet usage [1].

As a result, the number of hackers and organized cybercrime gangs has skyrocketed. These cybercriminals have been exploring new ways to carry out cyber-attacks. The primary motivation for cyber criminals seems to be the personal benefit gained by acquiring sensitive information and retaining it for blackmail. Hackers may also benefit by supplying private information to competition on the dark web, making cyberspace insecure and presenting significant threats to businesses and customers. As a result, cyber security breaches have become a severe danger to world security and the economy, compromising essential infrastructure and wreaking havoc on company performance, resulting in significant cognitive property loss [2].

Cyber security should be emphasized throughout a business, not only in IT [3,4]. The global trend in cyber security issues is primarily due to the fact that most personnel do not adequately adhere to the specific security regulations and instructions supplied in the workplace. People represent a significant security vulnerability that exposes organizational assets to external and internal attackers; they are the weakest link [5,6]. The human factor is the most common way for hackers to get unauthorized access to vital systems in a protected environment [7,8]. As a result, implementing proactive cyber security measures is essential, particularly in developed nations where the Internet is a fundamental part of everyone’s life, such as Saudi Arabia. During 2007–2009, the ratio of Internet users improved significantly, rising from 43 percent to 51 percent. By 2018, the rate of Internet users was around 19% [9,10,11,12,13].

The Kingdom of Saudi Arabia has expanded its investment in boosting its security infrastructure, according to the Telecommunications Act of June 2001. Therefore, it is vital to strengthen and manage the telecommunications industry [14]. It was for this purpose that the Communications and Information Technology Commission (CITC) was established to supervise Internet regulation and network traffic. In addition, the Computer Emergency Response Team (CERT) was established in 2006 to provide organizations with the knowledge and skills needed to identify and prevent cyber-attacks through teaching and training activities [14]. As a result of the incorporation of cyber security in Saudi Vision 2030, the Kingdom’s standing in the sphere of technological advancement has rapidly increased in industrialized nations [15].

Cyber security awareness has received insufficient attention given the fast rise in cyber dangers and cybercrime in the Kingdom. The importance of security has not been examined among college students [16]. Since hacking attacks of data systems in schools and colleges are becoming more widespread, students must understand the implications and problems of cyber security and cybercrime. There is an urgent need to design a comprehensive training program to raise awareness of the consequences of personal information loss, which may undermine student confidence and institutional credibility [17,18,19,20].

It is the most basic and widely used safeguarding system. The first stage in obtaining safe access is to provide the user’s login and passcode. The main issue with passcodes is that we can forget them. As a result, we frequently search for ways to remember them, such as writing them in a notebook, using toolkits to organize and save passcodes (passcode managers or passcode keepers), or by using “Cookies”, which keep the user ID and passcode (hashed) to access the website. Another disadvantage of this method is that passcodes could be stolen or decrypted [21,22,23].

Increased Web Browser Attack—The services supplied by developing technologies are often delivered through web pages. Web browsers are undoubtedly the most widely adopted apps, allowing consumers to undertake a wide range of tasks that attach them to an outside world. As a result, Internet browsers are becoming an immensely crucial tool for millions of Internet users nowadays. Unfortunately, like every piece of software, Internet browsers have a variety of flaws [24,25]. The hackers use such defects to gain control of the user’s computer, hack the customer’s data, delete files and use the stolen machine to target other systems. According to an Osterman Research report [26], 11 million virus variants had been detected by 2008, with 90 percent of these viruses originating from covert downloads from prominent and often credible locations. If Internet browser consumers do not identify a rogue website, they risk disclosing personal details to a potentially hazardous party. Our survey focuses on active security indicators since active security measures are directly tied to automatic hacking identification in Internet browsers.

Social media are electronic connections (such as social networking websites and microblogging platforms) wherein people build online groups to exchange information, thoughts, or private messages. Privacy is defined as “independence from unapproved access” and the capacity to govern one’s data since only those whom the possessor desires to have access to them are permitted to use them. This encompasses both authorities with respect to what material is visible on social media and who may see it. Social media use is widespread across general culture and on school campuses. The growing reputation of social media websites has given rise to a new range of concerns and problems that now confront us in the twenty-first century. Since digital networks are their primary modes of communication, modern college youth are at a higher risk of image injury or loss of money than previous generations. As a result, we conducted an experimental evaluation of students’ cyber security understanding and activities, concentrating on the most frequent security vulnerabilities facing the overall ecosystem. Some of the key contributions are listed below:

• A cybersecurity awareness assessment was carried out with the college students of Imam Abdulrahman Bin Faisal University based on a few key issues, such as password security, browser security, and social media;
• An investigation was conducted to analyze the students’ level of knowledge about security concerns, especially cybercrime;
• Statistical analysis was performed and, based on numerous tests, the results were estimated;
• The data was collected through the survey questionnaires and, based on the responses, SPSS and ANOVA tools were utilized to make the analysis.

The remainder of this paper is organized as follows: Section 2 contains a literature review, Section 3 discusses the research methodology, Section 4 presents the results which were subject to many tests, and Section 5 consists of a discussion of the results, after which the paper is concluded.

2. Literature Review

This section highlights previous findings undertaken to measure individual cyber security awareness levels. It should be noted, however, that only a few studies have aimed to determine the level of cyber security awareness among students and the associated significant challenges.

2.1. Cybersecurity Awareness

Cyber security awareness and training programs might be an element of national security and they should be well-structured to provide people with a basic grasp of cyber security. Al-Janabi and Al-Shourbaji [27] studied Middle Eastern security awareness, concentrating on school environments and examining cyber security within teaching faculties, among researchers and students. The authors revealed that participants in the Middle East do not have a basic understanding of the importance of cyber security. As a result, all users and administrators should be given safety awareness and training as part of an overall safety management strategy. Ahmed et al. [28] investigated cyber security recognition in the Bangladeshi population and evaluated the acquired data using Pearson’s chi-squared test [29]. According to these findings, governments fail to offer the necessary guidelines and awareness initiatives. As a result, most individuals are uninformed about cybercrime and cyber security risks.

Most academic organizations’ business strategies do not incorporate active cyber security awareness and training initiatives. Slusky and Partow-Navid [30] examined the results of security testing for a group of pupils at California State University, Los Angeles, USA, College of Business and Economics. They discovered that the main issue with cyber security awareness is not a lack of essential knowledge, as one might think; instead, it is the methods pupils use when coping with these issues in real-world situations. The results were meant to aid the institution in developing its curriculum, which included extra information security training.

2.2. Students’ Knowledge

Alotaibi et al. [31] investigated the level of cyber security knowledge among college students. Their investigation revealed that cyber security awareness in Saudi university students is poor since most students were unaware of their data protection. Correspondingly, Senthilkumar and Easwaramoorthy [32] studied university students in Tamil Nadu’s key towns to examine their attentiveness to cyber security. They concentrated on particular cyber security risks, such as malware-infected websites, phishing, and the theft of personal information. According to their findings, students’ awareness of cyber security and related threat problems was above average, with 70% of respondents having a basic understanding of cyber security dangers. As a result, the authors proposed that security awareness and training programs be launched at a higher level to guarantee that learners can protect their data from cyber-attacks.

Moallem [33] investigated students’ opinions regarding cyber security in California’s Silicon Valley. Since learners’ behavior is variable, the author assessed the cyber security level in the largest and most influential technology environment. Even when they were aware that their actions were being seen and tracked, college students were unaware that their data was not safely transported across university systems. As a result, institutions should offer training regularly to influence students’ behavior and increase their awareness of the basics of cyber security and cyber threats [34]. In addition, Moallem [35] discussed the level of security awareness and theft mindfulness. Fraudsters may not always utilize the same cyber-attacks, according to the author.

Instead, they switch between phishing scams, network traffic, and other methods of deceit. As a result, it is vital to develop a plan to raise cyber security awareness and secure critical data. Zwilling et al. [36] investigated the relationship between cyber security awareness, comprehension, and activity with protection product users in Turkey, Israel, Poland, and Slovenia. The findings showed that although familiar users possessed adequate cyber security awareness, it was seldom used in practice. Preliminary research results at Nigerian institutions revealed that students possessed basic cyber security knowledge but were unsure how to secure their information [37]. Al said et al. [38] aimed to measure end-user awareness of phishing attempts, emphasizing understanding and reactions to cyber security risks. Several writers have demonstrated experimentally that consumers with limited information may be readily duped [39,40,41].

2.3. Password Security

As a result of the increasing number of passcodes to recall, users either choose simple but default passcodes [42] or reprocess their possibly strong passcode [43,44,45], occasionally with slight adjustments or merely by pursuing predetermined building activities [46]. According to one survey, 80% of users retained their existing passcodes wherever feasible whereas 16% changed them to one of the passcodes they had been using on some other website, while 4% used passcodes that were more or less fresh [47]. One of the most severe security issues caused by passcode repetition arises in the context of data theft. Consumers are warned that when a website they use is hacked by the European Union’s General Data Protection Regulation (GDPR), they are strongly advised to change their passcodes. Even if the user accomplishes this, however, other identities secured with the same credentials are also vulnerable. It has been claimed that about eight billion records were released in different data thefts in the first nine months of 2019 alone [48], possibly opening the gates to many more companies, some of which are vital for the user or the community. According to an American study of users of various backgrounds and ages [49], consumers have a skewed knowledge of safety features. According to the findings of this study, respondents overvalued the safety enhancement provided by adding digits to their passcodes while underestimating the reliability of employing keyboard rhythms and frequent terms. In a poll conducted by [50], individuals not only overvalued the enhanced safety of attaching characters or numbers at the end of passcodes but often reused passcodes or portions of passcodes. Another prevalent occurrence is the incorporation of private details into user-chosen passcodes.

In research by [51], which examined over 20 million chunks of information from Chinese users, it was discovered that experts used passcodes with a standard size of 8–11 characters, whereas pupils used shorter passcodes. In terms of passcode protection, they found that more than half of consumers had passcodes that merely consisted of numbers and less than a third contained a mix of special typescripts. The research also indicated that more than 12 percent of corporate users utilize their birthdays and cell phone numbers in their passcodes, while 11.5 percent use their username and e-mail to generate their passcodes. Another study of Chinese passcodes [52] found that the usage of Chinese characters, alone or in conjunction with dates and numerals, accounted for 26% of the whole, suggesting that the use of English alphabets is prevalent. It was also noted that genuine Chinese character logins were created using only two to four Chinese characters.

2.4. Social Media

“Users’ comprehension of dangers and how to defend themselves against computer hackers is consequently crucial in modern existence”, writes [31]. As per a Pew Research Centre [53] study, 69 percent of US people use Facebook and 73 percent use YouTube. Instagram, Pinterest, Snapchat, LinkedIn, Twitter, Reddit, and WhatsApp have much smaller percentages of users. Eighty percent of people aged 18–24 use at least one social networking site. Specifically, 94% use YouTube, 81% use Facebook, 78% use Snapchat, 71% use Instagram, and 45% use Twitter. In Richardson’s [54] (2017) study, 90 percent of respondents used Facebook and Snapchat, while 70 percent used Instagram. Most users check their profiles many times every day [53] (Pew Research Center, 2019). Knight-McCord [55] (2016) researched which social networking sites were most popular among students. They administered a survey to 363 pupils online and in person. Previous research discovered that Instagram was the most popular site, with Snapchat and Facebook second. LinkedIn and Pinterest, on the other hand, were less popular. According to Sharma, Jain, and Tiwari [56], 84 percent of students believe that posting personal information on social networking sites (SNS) is harmful. Moallem [33] (2018) researched cyber security knowledge among students at two California State universities in Silicon Valley.

3. Materials and Methods

A survey approach was utilized to meet the study’s goals and collect qualitative data on the degree of cyber security awareness among Imam Abdulrahman Bin Faisal University students. The study was carried out online to ensure that a mixed group of male and female pupils’ responses were collected quickly and responsibly. There were 20 items in the survey covering all aspects of cyber security, including five demographic items.

The questions in the Internet use section were designed to elicit information about students’ online behavior. The questions about the usage of security technologies were designed to assess current security practices in IAU University students. The browser security component was designed to evaluate students’ comprehension of the security of the browsers they often use. Finally, the networking sites and cyber security knowledge portions examined students’ understanding of the risks of utilizing various social networking platforms and how to respond to a cybercrime occurrence. As a result, we investigated the students’ cyber security awareness, abilities, behavior and attitudes, and self-perceptions. These questions were distributed to undergraduate and post-graduate students, and a total of 450 responses were received. These responses were again categorized according to the hypothesis and analysis. The following are the categories of questions: Questions based on password, browser, and social media activities. The responses to these questions were multiple-choice answers, with the following choices: Strongly Agree, Agree, Neutral, Disagree, Strongly Disagree.

The following are the questions drafted:

• Q1. Passwords are made up of 12 letters and a combination of letters, digits, or signs.
• Q2. Change password periodically.
• Q3. Use previously used passwords whenever needed to create a password.
• Q4. Use a single secure passcode for all web pages and logins.
• Q5. It is inconvenient to have a different long and solid passcode for every webpage and account.
• Q6. I do not mind sharing my passwords with my friends.

The questions related to browser security are as follows:

• Q7. The web browser should be updated regularly.
• Q8. Avoid installing extensions from third-party websites.
• Q9. Examine the web browser’s privacy controls and parameters regularly.
• Q10. Examine browsing history for any unusual activity.

The questions related to social media activities are as follows:

• Q11. It is OK to publish private photographs on social networking sites.
• Q12. Accepting invitations from outsiders seems OK.
• Q13. There is no concern with openly posting one’s present location on social networking sites.
• Q14. No problem with adding all personal information to social media.
• Q15. Learn how to submit any danger or questionable conduct on social networks.

The passcode is an essential security element that protects data and information while allowing access to authenticated systems. A passcode should be at least 12 characters, including letters and numerals, capital and lowercase letters, and at least one symbol or unique character [43]. Given this, we investigated the students’ understanding of the fundamental concepts of password security and how they handle their passwords.

4. Results

4.1. Demographic Data

Demographic data in this research is in the form of respondent data: gender, age, education level, computer skills, and how often respondents make online purchases. The distribution of demographic data can be seen in

Table 1. Distribution of research respondent demographic data (n = 450).

Variable	Category	Number	Percentage (%)
Gender	Male	238	52.8%
	Female	212	47.2%
Age	<20	178	39.5%
	20–35	240	53.3%
	36–49	28	6.2%
	50–65	4	1%
Education	Diploma	16	3.6%
	Bachelor’s Degree	417	92.6%
	Master’s Degree	10	2.2%
	PhD	7	1.6%
Computer Skill	Beginner	67	14.9%
	Intermediate	237	52.7%
	Advance	146	32.4%
Purchase Online	Rarely	132	30%
	Frequently	318	70%

.

In Table 1, it can be seen that the number of female respondents (52.8%) is greater than that of male respondents. Most of the respondents were aged 20–35 years (53.3%), followed by respondents aged less than 20 years (39.5%). A large number of respondents were in this age group because the main target of this research is students, the level of education attained by most of the students in this study being a bachelor’s degree (92.6%). Based on computer skills, most respondents have skills in using computers at an intermediate level (52.7%), followed by respondents who are proficient in using computers (32.4%). In the field of online purchasing, it can be seen that most of the respondents often purchase online (70%).

4.2. Description of the Independent Variable (X) Used

4.2.1. Password Security (X₁)

A password is a secret set of characters or words used to authenticate access to digital systems and computer systems. A password is one of the most critical factors in protecting data and information, but it is also hazardous because it is vulnerable to attack [55]. In good computer security practice, passwords must be between 8 (eight) and 24 (twenty-four) characters long and include at least one uppercase letter, one number, and one unique character [57]. These are usually formed from frequently used words, although this is not recommended as they are easier to guess or decipher.

From the information in

Table 2. The questions about the password security variable.

Question	Totally Disagree	Disagree	Neutral	Agree	Totally Agree
Passwords are made up of 12 letters and a combination of letters, digits, or signs.	4%	17%	18%	32%	29%
Change password periodically.	18%	41%	20%	14%	7%
Use previously used passwords whenever needed to create a password.	10%	18%	17%	39%	16%
Use a single secure passcode for all web pages and logins.	10%	23%	19%	30%	18%
It is inconvenient to have a different long and solid passcode for every webpage and account.	10%	11%	13%	34%	32%
I do not mind sharing my passwords with my friends.	54%	23%	12%	8%	4%

, it is known that as many as 32% of students agree and 29% even strongly agree that one ought to use a strong password. However, most students (41%) disagree that passwords should be changed periodically; most students (39%) use their old passwords to create new passwords. Most students (30%) are also more likely to use one password for all websites/accounts and consider using long passwords very inconvenient. However, students are not willing to tell or share their passwords with friends. Based on these results, students still lack awareness of password security.

4.2.2. Browser Security (X₂)

Browser Security is essential for securing user data and information. The browser is considered to be the main door in conducting online activities, so the browser is the main target for hackers or cyber thieves to access sensitive information [58]. Keeping up-to-date with the latest version is one of the most effective ways to help secure your browser or another system.

From the results in

Table 3. The questions about the browser security variable.

Question	Totally Disagree	Disagree	Neutral	Agree	Totally Agree
The web browser should be updated regularly.	1%	5%	15%	40%	39%
Avoid installing extensions from third-party websites	2%	8%	18%	34%	38%
Examine the web browser’s privacy controls and parameters regularly.	4%	12%	22%	35%	27%
Examine the browsing history for any unusual activity.	6%	11%	20%	36%	27%

, it is known that as many as 40% of students agree and 39% even strongly agree that the web browser must be updated regularly. As many as 38% of students strongly agree that installing extensions from third-party websites should be avoided. Most of the students (35%) agreed that the security settings and configurations of the web browser should be checked periodically, and as many as 36% of students studied browser history to find any suspicious activity. Based on these results, it is shown that students have a good level of awareness of browser security.

4.2.3. Social Media Activities (X₃)

In the era of increasingly advanced use of technology, surfing on social media has become a part of our daily life. People can access information in various fields, share their daily activities, and have non-face-to-face interactions through social media.

From the results in

Table 4. The questions about the social media activities variable.

Question	Totally Disagree	Disagree	Neutral	Agree	Totally Agree
It is OK to publish private photographs on social networking sites.	23%	25%	25%	21%	6%
Accepting invitations from outsiders seems OK	21%	26%	28%	21%	4%
There is no concern with openly posting one’s present location on social networking sites.	49%	28%	12%	8%	3%
No problem with adding all personal information to social media.	33%	22%	22%	18%	5%
Learn how to submit any danger or questionable conduct on social networks.	4%	14%	14%	37%	31%

, it can be seen that most students disagree (25%) or strongly disagree (23%) to upload personal photos on social media. Meanwhile, most students are neutral about accepting friendships from strangers on social media. However, some students strongly disagreed that one ought to share one’s current social media location and disagreed that one ought to add all one’s personal information on one’s social media pages. As many as 68% of students already know how to report suspicious activity on social media.

Figure 1 shows the most used social media by people around the world. For example, it can be seen that Facebook is the most used social media application with almost 2700 million or 2.7 billion active users every month in 2021.

4.2.4. Data Analysis

Validity and Reliability Test

The validity test [57,58,59] results for each item from 450 respondents in this study are presented in

Table 5. Validity test results.

Variable	Question Item	r-Value	r-Table
Password Security (X1)	Q1	0.334	0.092
	Q2	0.183
	Q3	0.509
	Q4	0.596
	Q5	0.481
	Q6	0.513
Browser Security (X2)	Q1	0.552
	Q2	0.605
	Q3	0.826
	Q4	0.791
Social Media Activities (X3)	Q1	0.683
	Q2	0.692
	Q3	0.717
	Q4	0.740
	Q5	0.298
Cybersecurity Awareness (Y)	Q1	0.590
	Q2	0.657
	Q3	0.339
	Q4	0.598

.

Table 5 shows the results of testing the validity of each item from the 450 respondents studied. The results of the validity test show that all questions about the independent variables, namely, password security (X₁), browser security (X₂), social media activities (X₃), and also the dependent variable, namely, cybersecurity awareness (Y), have a correlation value (r-value) > r table (0.092). This indicates that each question is valid. So, it can be concluded that all questions used in this study are suitable for further research. After obtaining the results on the validity, the reliability test was carried out to determine the reliability of each statement presented in

Table 6. Reliability Test Results.

Cronbach’s Alpha	Number of Items	Description
0.596	19	Reliable enough

.

Table 6 shows the reliability testing results, namely, the Cronbach’s Alpha value of 0.596. Cronbach’s Alpha value is between 0.5–0.6. This indicates that every statement used in the variable is reliable enough, with the result that all statement items used in this study are suitable for further research.

Feasibility Test of a Variable

This stage tested the correlation between variables using Bartlett’s test and the Kaiser–Meyer–Olkin (KMO) test. This test is carried out to assess the feasibility of a variable analyzed using factor analysis [60].

Table 7. KMO and Bartlett’s Test.

Kaiser–Meyer–Olkin Measure of Sampling Adequacy		0.783
Bartlett’s Test of Sphericity	Approximate Chi-Square	1795.927
	Df	171
	Sig	0.000

shows that the significance value of Bartlett’s test of sphericity is 0.000, the p-value (0.000) < α (0.05), which means that there is a correlation between variables. Furthermore, it can be seen that if the KMO value is 0.783, the KMO value is between the values 0.5–1, which means that the variables are homogeneous. Both tests have been met so that the variables can be predicted and further analysis can be carried out.

Correlation Test

A Correlation test [61] is a process to test the independent and dependent variables to determine the level of closeness of the relationship between two variables.

Table 8. Correlation component matrix.

Variable	Password Security	Browser Security	Social Media Activities	Level of Awareness
Password Security	1
Browser Security	0.023	1
Social Media Activities	0.298	−0.074	1
Level of Awareness	0.277	0.184	0.366	1

shows the correlation component matrix containing the correlation values between the variables used in the study. The main focus of this test is to determine the relationship level between each independent variable—password security (X₁), browser security (X₂), and social media activities (X₃)—and cybersecurity awareness (Y). To make it easier to interpret the strength of the relationship between the two variables, the authors provide the following criteria (Sarwono, 2006).

Based on Table 8, Password Security is positively related to cybersecurity awareness (r = 0.277). However, the correlation value is between 0.25–0.5, indicating a moderate level of relationship between password security and cybersecurity awareness. Browser Security is positively related to cybersecurity awareness (r = 0.184). The correlation value is between 0–0.25, indicating a low relationship between browser security and cybersecurity awareness. Social media activities positively relate to cybersecurity awareness (r = 0.366). The correlation value is between 0.25–0.5, indicating a moderate relationship between social media activities and cybersecurity awareness

Table 9. Guidelines for providing an interpretation of correlation coefficients.

Correlation Value (r)	Interpretation
0	No correlation
>0–0.25	Low Correlation
>0.25–0.5	Moderate Correlation
>0.5–0.75	High Correlation
>0.75–0.99	Very High Correlation
1	Perfect Correlation

.

4.2.5. Multiple Tests

Assumptions Test

The residuals are assumed to be generally distributed in multivariate normality–multiple regression. However, no multiple regression presupposes that the independent variables are not substantially connected. The variance inflation factor (VIF) values are used to test this assumption [62].

Normality Test

The normality assumption is related to the residual distributions. This is considered customarily distributed, and the regression line is fitted to the data so that the mean of the residuals is zero.

The normality test [63] results using the normal p-plot with 450 respondents can be seen in Figure 2. The normal p-plot shows that all data points are spread around the line. This indicates that the data has met the assumption of normality.

Multicollinearity Test

The results of the multicollinearity test using the VIF (variance inflation factor) value can be seen in

Table 10. Multicollinearity Test.

Variable	VIF Value
Password Security (X1)	1.100
Browser Security (X2)	1.008
Social Media Activities (Y)	1.105

.

The VIF value in Table 10 shows that the VIF value of the three variables is less than 10 (VIF < 10), so it can be concluded that all the independent variables used in this study do not experience multicollinearity.

Heteroskedasticity Test

This study detects the occurrence of heteroskedasticity [64] by looking at the pattern of data points on the scatter-plot graph. Figure 3 shows that the observation points spread randomly and do not form a design or line. The plot also indicates whether the data distribution is around the zero point. This suggests that the regression model is free from heteroskedasticity problems, and the heteroskedasticity assumption has been fulfilled.

Multiple Linear Regression Model and Coefficient of Determination (R2)

All classical assumption tests have been fulfilled; the next step is to build multiple linear regression model equations. The regression model equation that is produced can be used to analyze the effect of password security, browser security, and social media activities on cybersecurity awareness. The regression coefficient values are shown in

Table 11. Multiple linear regression coefficient.

Variable	Regression Coefficient (β)
Intercept	4.301
Password Security (X1)	0.147
Browser Security (X2)	0.188
Media Social Activities (X3)	0.241

.

The multiple linear regression model formed based on the regression coefficients in Table 11 is as follows:

Cybersecurity Awareness = 4.301 + (0.147) X₁+ (0.188) X₂+ (0.241) X₃

The regression coefficient value above can be explained such that if the level of student knowledge of password security increases by 1%, then the level of cybersecurity awareness will increase by 14.7%. Likewise, if the level of student knowledge of browser security rises by 1%, then cybersecurity awareness will increase by 18.8%. Finally, if student knowledge of social media activities increases by 1%, then cybersecurity awareness will increase by 24.1%.

The coefficient of determination is the value used to measure how much the ability of the independent variable included in the model can explain the variation of the dependent variable. Based on

Table 12. Correlation Coefficient and Determination.

Model	R	R2	Adjusted R2
Regression	0.454	0.206	0.201

, the coefficient of determination (R2) is 0.206, meaning that password security, browser security, and social media activities contribute to the influence of cybersecurity awareness by 20.6%, while the residual value of 79.4% (100% − 20.6%) indicates that other factors that affect cybersecurity awareness are not included in the model.

4.2.6. Hypothesis Test

ANOVA Test (F-Test)

The following is an F-test to see whether the independent variable has a simultaneous effect on the dependent variable [65]. The hypothesis in this test is as follows:

Hypothesis 0.

1: 

Password Security (X₁), Browser Security (X₂), and Social Media Activities (X₃) together are not significantly related to Cybersecurity Awareness (Y).

2: 

Password Security (X₁), Browser Security (X₂), and Social Media Activities (X₃) together are significantly related to Cybersecurity Awareness (Y).

Table 13. F-test Results.

Model	F	Sig (p-Value)
Regression	38.666	0.000

shows the results of the p-value (0.000) < 0.05, so it can be concluded that Password Security (X₁), Browser Security (X₂), and Social Media Activities (X₃) together have a significant effect on Cybersecurity Awareness (Y).

Partial Test (t-Test)

A partial test [66] using the t-test is used to determine the significant effect of each independent variable on the dependent variable. The hypothesis in the partial test is as follows:

Hypothesis 1.

1: 

Password Security (X₁) is not significantly related to Cybersecurity Awareness (Y).

2: 

Password Security (X₁) is significantly related to Cybersecurity Awareness (Y).

Hypothesis 2.

1: 

Browser Security (X₂) is not significantly related to Cybersecurity Awareness (Y).

2: 

Browser Security is (X₂) is significantly related to Cybersecurity Awareness (Y).

Hypothesis 3.

1: 

Social Media Activities (X₃) is not significantly related to the Cybersecurity Awareness (Y).

2: 

Social Media Activities (X₃) is significantly related to Cybersecurity Awareness (Y).

Table 14. Results of t-test.

Variable	t-Value	Sig (p-Value)
Password Security (X1)	3.931	0.0001
Browser Security (X2)	4.839	0.0001
Social Media Activities (X3)	7.428	0.0001

shows the results of partial hypothesis testing (t-test). Based on these results, the conclusions are:

(1)

The Password Security variable (X₁) has a p-value (0.0001) < (0.05), so it can be concluded that Password Security (X₁) has a significant effect on Cybersecurity Awareness (Y).

(2)

The Browser Security variable (X₂) has a p-value (0.0001) < (0.05), so it can be concluded that Browser Security (X₂) has a significant effect on Cybersecurity Awareness (Y).

(3)

The Social Media Activities (X₃) variable has a p-value (0.0001) < (0.05), so it can be concluded that Social Media Activities (X₃) have a significant effect on Cybersecurity Awareness (Y).

5. Discussion

The results of partial hypothesis testing using the t-test (Table 14) show that the password security variable significantly affects cybersecurity awareness (p-value = 0.0001). The regression coefficient of the password security variable in the multiple linear regression model (Table 11) shows the beta value of 0.147. Therefore, it can be concluded that password security has a positive and significant effect on cybersecurity awareness. The positive impact shows that using passwords will increase cybersecurity awareness by 14.7%. The browser security variable significantly affects cybersecurity awareness (p-value = 0.0001). The regression coefficient of the password security variable shows a beta value of 0.188. Therefore, it can be concluded that browser security has a positive and significant effect on cybersecurity awareness. The positive impact shows that knowledge of browser security will increase cybersecurity awareness by 18.8%. The social media activities variable significantly impacts cybersecurity awareness (p-value = 0.0001). The regression coefficient of the social media activities variable shows a beta value of 0.241. Therefore, it can be concluded that social media activities positively and significantly affect cybersecurity awareness. The positive effect shows that using social media will increase cybersecurity awareness by 24.1%.

The results of simultaneous hypothesis testing using the F-test (Table 13) show that password security, browser security, and social media activities have simultaneously significant effects on cybersecurity awareness (p-value < 0.05). The magnitude of the influence of the two variables can be seen based on the value of the coefficient of determination (R2) obtained in this study, which is 0.206, indicating that password security, browser security, and social media activities contribute to the influence of cybersecurity awareness by 20.6%. Meanwhile, the residual value of 79.4% indicates that other factors that affect cybersecurity awareness are not included in the model. It should be emphasized that not all models with a low R2 are bad models. According to [67] (2019), regression models with R2 values below 50% can be accepted in several fields, such as the social field and the study of human behavior. Suppose the value of R2 is low but the independent variable has a significant effect. In that case, the model can still provide conclusions about the relationship of the independent variable to the dependent variable.

The p-value (p-value < 0.05) indicates that the respondents in this study already have an awareness of cybersecurity awareness, but it is still low; this is because they do not take more or actual actions to implement cybersecurity in their daily life (R2 = 0.206). Several reasons were thought to affect the results, probably because most respondents in this study (53%) were women. According to (Alotaibi et al., 2017), men have a higher awareness of cybersecurity than women. The research that supports the results of this study is research conducted by Alharbi and Tassaddiq (2021) among students at Majmaah University, Saudi Arabia, which included 60% male respondents and stated that students at Majmaah University already have a high level of awareness of cybersecurity awareness. It is proven by the high R2 value reaching 55% (R2 = 0.55) and the variables used, such as security tools, browser safety, social networking, and other cybersecurity knowledge, have a positive effect (p-value < 0.05).

Based on the three variables used, the password security variable has the lowest coefficient value (β = 0.147), implying that students still lack awareness of password security. It can be seen that most students (41%) disagree that passwords must be changed periodically; most students (30%) are more likely to use 1 password for all websites/accounts and think that using long passwords is very inconvenient. According to [68], users may have difficulty in remembering a long and complex password. Yildirim (2019) [69] said that instead of requiring users to follow strict password policy rules, motivating and directing them to create solid, easy-to-remember passwords seem to be a more efficient and helpful way. Users can also use strong passwords only if the system or account requires a high level of security [70].

6. Conclusions

Based on the research conducted, it can be concluded that knowledge of password security, browser security, and social media activities significantly influence cybersecurity awareness in students. Overall, students have realized the importance of cybersecurity awareness. However, in practice, students’ levels of cybersecurity awareness are still lacking, especially when it comes to password security. Students usually do not pay much attention to using good and correct passwords to protect their accounts or websites. Based on the research results explained in the previous chapter, the summary is obtained as follows: Password Security variable (X₁) has a significant and positive effect on Cybersecurity Awareness (p-value = 0.0001, = 0.143). This shows that a good knowledge about password security could increase awareness because passwords are the main means of accessing and maintaining accounts or other systems. The knowledge about student password security in this study is still deficient. Students usually do not pay much attention to using good and correct passwords to protect their accounts or websites. Browser Security variable (X₂) has a significant and positive effect on Cybersecurity Awareness (p-value = 0.0001, = 0.188). This shows that good knowledge about browser security can increase awareness. The level of knowledge about student browser security in this study is good; it can be seen from the number of students who always update their browsers regularly and tend to pay attention to the security of the browsers they use. The Social Media Activities (X₃) variable has a significant and positive effect on Cybersecurity Awareness (p-value = 0.0001, = 0.241). This shows that proper and correct social media activities can increase awareness. The activity of using social media by students in this study was good and can be seen from the number of students who prefer to keep their personal information from being too widely spread through social media. The students also know how to report suspicious threats on social media. Password Security (X₁), Browser Security (X₂), and Social Media Activities (X₃) variables simultaneously have a significant effect on Cybersecurity Awareness (p-value = 0.000), with a correlation coefficient of 20.6% (R2 = 0.206). This shows that the independent variable used can explain the level of cybersecurity awareness of 20.6%. All the SPSS analysis tables are listed in the Appendix A.

7. Limitations of the Work

Based on these results, several things can be done to increase cybersecurity awareness in students by means of socialization and campaigns related to cybersecurity. It should be noted that this research still has several limitations, such as the level of question reliability, which is still not decent, and limited use of the independent variables. This research, also, did not always represent another more comprehensive cybersecurity topic. In future research, it is recommended to add more variables that might affect cybersecurity awareness.

8. Comparative Analysis

There are several works in the literature wherein a similar methodology is applied to assess student’s awareness for cybersecurity, as discussed in the literature review section. The following are the works sharing this perspective: Senthilkumar and Easwaramoorthy [32] studied university students in Tamil Nadu’s key towns to examine their attentiveness to cyber security. They concentrated on particular cyber security risks, such as malware-infected websites, phishing, and the theft of personal information. According to their findings, students’ awareness of cyber security and related threat problems was above average, with 70% of respondents having a basic understanding of cyber security dangers. Another work conducted by Moallem [33] investigated students’ opinions regarding cyber security in California’s Silicon Valley.

Similarly, Knight-McCord [53] (2016) researched which social networking sites were most popular with students. They administered a survey to 363 pupils online and in person. Previous research discovered that Instagram was the most popular site, followed by Snapchat and Facebook. LinkedIn and Pinterest, on the other hand, were less popular. According to Sharma, Jain, and Tiwari [54], 84 percent of students believe that posting personal information on social networking sites (SNS) is harmful. Finally, Moallem [33] (2018) researched cyber security knowledge in students at two California State universities in Silicon Valley.