Information Security Awareness and HBCU Students: A Preliminary Exploration of Attitudes and Behaviors Tiren A. Parker & Scott M. Debb Norfolk State University/Virginia Consortium Program for Clinical Psychology

Introduction Interest in understanding the weakest link in information security We know about organizational issues and insider threat What do we know about the next cohort of professionals? What do we know about culturally-diverse students? Importance of social AND developmental theories Cognitive development Decision making Motivation Psycho-social development Early vs. late adolescence Adolescence vs. teens Teens vs. adults Cultural differences

Current Study Examining student attitudes and behaviors Understanding the information security awareness culture of the next cohort of undergraduate students, especially African Americans (attending an HBCU) Compare AA to C samples to examine differences in responding Help distinguish between being tech savvy and being a potential security risk What attitudes and behaviors need to be augmented by education Can we transfer this to opportunities for early education (e.g., K-12) For today, some preliminary results

Method Norfolk State University & Old Dominion University IRB Approvals Participants recruited through convenience sampling Participants completed an anonymous online survey Instrumentation assessed: Information security attitudes and behavior Personality Social media engagement and smotivation Standard demographic screener

Measures Computer Skills Internet Skills Prior Experience Information Security Attitudes and Behaviors (Anwar, He, Ash, Yuan, Li, & Xu, 2016) 75-items 12 domains: Computer Skills Internet Skills Prior Experience Perceived Vulnerability Perceived Severity Perceived Benefits Perceived Barriers Response Efficacy Cues to Action Security Self-Efficacy Peer Behavior Cybersecurity Behavior

Measures The Big Five Inventory (BFI; John, Donahue, & Kentle, 1991) 44-items Five domains: Extraversion Agreeableness Conscientiousness Neuroticism Openness

Measures Instagram Motivation Questionnaire (see Keep & Amon, 2017) 40-items Instagram use Engagement e.g., How often do you engage with Instagram to: Behavior e.g., I go on Instagram to....

Preliminary Results 90 undergraduate students Freshman (N=7); Sophomores (N=17); Juniors (N=26); Seniors (N=40) 18-62 years old 58% < 20 86% < 30 53% African American; 32.2% Caucasian 74% Female; 24% Male 93% use social media 64% employed

Preliminary Results Self-reported Cybersecurity Behaviors 38.9%- Use different passwords 40%- Review privacy/security settings 53.3%- Keep antivirus up to date 62.2%- Watch for unusual behavior 55.5%- Never sent sensitive information 50%- Back-up important files 47.8%- Always act on malware alerts 40%- Don’t click on short URLs

African Americans (N=48) Preliminary Results African Americans (N=48) Caucasians (N=29) M (SD) General Computer Skills 4.82 (.71) 5.08 (.52) Prior Experience 4.90 (1.32) 5.36 (1.36) Perceived Vulnerability 4.33 (1.28) 4.79 (1.05) Perceived Severity * 5.52 (1.25) 4.91 (1.34) Perceived Benefits 5.72 (1.06) 5.87 (.86) Perceived Barriers 3.34 (1.49) 3.34 (1.11) Perceived Response 5.64 (1.18) 5.88 (.76) Cues to Action 4.92 (1.31) 4.96 (.95) Security Self-Efficacy 4.11 (1.43) 4.34 (1.45) Peer Behavior 3.92 (1.14) 3.56 (1.33) Cybersecurity Behavior 5.03 (1.14) 5.51 (.86)

Preliminary Results African Americans Caucasians M (SD) Extraversion 3.34 (.66) 3.25 (.76) Agreeableness 4.02 (.65) 3.93 (.73) Conscientiousness 3.95 (.69) 3.95 (.62) Neuroticism 2.67 (.92) 3.05 (.20) Openness 3.75 (.55) 3.70 (.58)

Preliminary Results Correlations between information security attitudes/behaviors and personality Extraversion Computer Skills, Prior Experiences, Perceived Severity, Response Efficacy, Cues to Action, Security Self-Efficacy, Cybersecurity Behavior Agreeableness Perceived Severity, Perceived Benefits, Response Efficacy, Cues to Action, Cybersecurity Behavior Conscientiousness Computer Skills, Prior Experiences, Perceived Severity, Perceived Benefits, Perceived Barriers*, Response Efficacy, Cues to Action, Security Self-Efficacy, Cybersecurity Behavior Neuroticism Computer Skills*, Prior Experiences*, Perceived Severity*, Perceived Barriers, Cues to Action*, Security Self-Efficacy*, Cybersecurity Behavior* Openness * Indicates a negative correlation

Preliminary Results 71.1% use Instagram (N=61) Years of use: 1-9 years 46.9% use Instagram “several times per day” Like posts   N % Never 1 1.1 A few times a year 2 2.2 Once a month 2-3 times a month 7 7.8 Once a week Multiple times a week 21 23.3 Once a day 10 11.1 Multiple Times per day 16 17.8 Make comments on posts   N % Never 5 5.6 A few times a year 2 2.2 Once a month 10 11.1 2-3 times a month 17 18.9 Once a week 7 7.8 Multiple times a week 11 12.2 Once a day 4 4.4 Multiple Times per day

Discussion Correlation ≠ causation Examine younger cohorts UG Freshman Teens Elementary school Compare cross-culturally; cross generationally Is the next generation technologically “at-risk” If so, how? Can empirical evidence influence public policy? Proactive education (e.g., K-12) to create a more secure and trustworthy cyberspace in the future

References available upon request Thank you! Tiren Parker, M.A. tpark041@odu.edu Scott M. Debb, Ed.D. smdebb@nsu.edu References available upon request