Education, Online Presence and Cybersecurity Implications: A Study of Information Security Practices of Computing Students in Saudi Arabia

Abstract

Information technology is considered as a key enabler to achieve “education for all” as a sustainable development goal; however, involvement in the education sector has introduced security risks along with benefits. Students’ exposure to the internet has increased the probability of cybersecurity attacks. To foster a more sustainable use of technology, it is crucial that students are made aware of information security risks and can keep themselves protected in the online sphere. In this paper, we present the results of a cross-sectional study that explores information-security awareness among students in Saudi Arabia. Empirical data were collected using an online questionnaire and a factor analysis was conducted using partial least-squares structured equation modelling. Based on the existing literature, we focused on four key constructs: password management, infrastructure management, email management, and the perception of security. The results of this study have highlighted that email management and infrastructure management were seen as relevant factors, whereas password management and the perception of security were not considered relevant factors by the respondents. We have also chalked out recommendations to improve cybersecurity awareness among students. The findings of this study will potentially help educational institutions and parents to prepare students in adopting security practices while they are online.

1. Introduction

The 2030 agenda for sustainable development by the United Nations has laid out seventeen goals to improve the quality of life for all humans on earth. The fourth of these goals emphasizes improving the quality of education and aims for inclusive and equitable quality education and enhancing lifelong learning opportunities for people [1]. To achieve this goal, academic institutions and other stakeholders are jointly carrying out efforts to improve education quality, with a focus on inclusivity, imparting lifelong learning skills, and providing resources for lifelong learning. Information technology can play a key role toward achieving this goal; however, there is a need to understand the implications of technology to design and develop sustainable solutions to achieve the “education for all” goal.

Technology has revolutionized the education sector, where internet connectivity and audio-visual aids have not only transformed conventional education but have also paved the way for online degrees and open courseware. [2]. Initial technological interventions in education include e-portfolios, cyber infrastructures, digital libraries, and online learning object repositories that have improved the quality of the learning experience [3]. To establish sustainability, however, such technological interventions and practices need not be copied directly from developing countries, but rather these need to be aligned and appropriated to local culture and national needs [4]. For instance, the use of artificial-intelligence-based technologies is on the rise in different domains but the adoption of such systems in academia has ethical, pedagogical, and technical implications which need to be researched extensively [5]. Educational technologies are complex and embedded in social context and learners and teachers can employ diverse ways and objectives to interact with these educational technologies [6]. Recently, during the COVID-19 pandemic, transition to online education has remained the only possibility for educational institutions to impart education.

Furthermore, an excessive online presence of students for engaging in online learning also poses additional threats in terms of cybersecurity. Therefore, to foster a more sustainable use, it is crucial that users are highly aware of cybersecurity threats and can protect themselves while being online. Recent literature reviews highlight that an increased awareness of security concerns improves the cybersecurity of end users [7,8,9]. Keeping this in view, in this paper, we are exploring the cybersecurity awareness of university students in Saudi Arabia, registered in undergraduate computing programs.

The Kingdom of Saudi Arabia is an important case setting due to the large student population and internet density. Saudi Arabia has a total population of 35.59 million [10]. There are more than 6 million students, in around 33,500 schools, 29 government universities and 14 private universities alongside many institutes [11]. During January 2022, there were a total of 34.84 million internet users, amounting to 97.9 percent of the population. Furthermore, the number of social media users is 29.30 million, constituting 82.3 percent of the population [10]. We specifically investigated a university in the Eastern Province of Saudi Arabia and collected data from undergraduate students registered in computing programs. The students were exposed to online learning during COVID-19. Normally, technically advanced users have higher cybersecurity sensitivity due to their technological background [12], so the findings will help to understand the cybersecurity awareness of this segment of the student body, which is supposed to be a technically advanced user set. Therefore, in our model, we have used infrastructure management, email management, password management and perception of security as key constructs. Our core finding is to identify which factors are considered relevant by students for their information security and how the information security behavior of students can be further improved.

The rest of the paper is structured as follows: Section 2 discusses related work followed by the research methodology in Section 3. Section 4 presents the findings of the study, followed by a discussion in Section 5 and a conclusion in Section 6.

2. Information Security and Online Education

In this section, we discuss related work from three different aspects. Initially, we highlight how sustainability is relevant to information security; secondly, we discuss online learning and cybersecurity implications, and this is followed by information security studies conducted in the context of Saudi Arabia.

2.1. Information Security and Sustainability

Sustainability has been explored in the information security literature in different contexts. Some researchers have highlighted the sustainability of technological infrastructure as a measure of security. For instance, Zegzhda [13] discussed how cyber-physical systems integrate computing with executive processes, so availability, privacy and integrity are not effective controls because executive systems cannot be reversed. Therefore, they proposed the sustainability of cyber-physical systems to be a criterion to measure the persistence of a cyber-physical system under destructive information security actions. On the other hand, some researchers have termed information security to foster sustainable technological infrastructure in an organizational context. For example, Choi [14] termed information security a critical barrier to foster sustainable computing and proposed that a transformational leadership approach by information security managers can improve information security. Similarly, Chu and So [15] also discussed the importance of sustainable information systems requiring appropriate information security management and stated that information security managers need to identify which information security behaviors will lead employees to report information security beaches. Some researchers have established that sustainability is an important factor contributing toward the continuity of information security practices within an organizational context. For example, Wang et al. [16] discussed how employee awareness is a key factor in fostering a sustainable security protection mechanism in organizations. In our work, we also use Wang et al.’s views on sustainability to highlight that employing optimal information security practices leads to a more sustainable use of technology for students.

2.2. Cybersecurity and Online Learning

Technological adoption in the education sector has been explored by many researchers. Kosasi et al. [17] carried out a literature review and discussed how, although there are a number of blockchain-based technologies available, there is still a significant potential for more blockchain technologies in the higher education sector. Similarly, Alam [18] discussed how blockchain-based digital certificates can be employed for learners to access online learning resources. Vlachogianni and Tselios [19] adopted a system-usability scale to evaluate the usability of different educational resources and found that the majority of online resources, university websites, and tutoring platforms have good usability. Lai et al. [20] identified the critical factors in evaluating the use of technology in the education sector, developed an instrument comprised of twenty-eight items belonging to eight different factors and evaluated its validity over a large set of students. Minamatov and Nasirdinova [21] highlighted that teachers need mastery in using digital technologies, such as text editors, spreadsheets, emails, browsers and multimedia equipment, to deliver quality education. Chen et al. [7] carried out a bibliometric analysis of papers published during 2000–2019 to understand the adoption of artificial intelligence in education domains. It found data mining for student performance prediction, automated special education tutoring systems, intelligent educational robots, computer-supported collaborative learning and recommended systems for learning as core topics of interest.

Recently, COVID-19 has changed not only the way we live but also the way we teach and learn [22]. In the post-COVID period, higher education institutions have strengthened their online infrastructure to support students’ learning, and a variety of other learning resources are publicly available on the internet. This transformation has increased the online time of students which has made them more susceptible to cybersecurity threats. Arampatzis and O’Hagan [23] highlighted that increased digitalization during the pandemic period has increased the probability of cybersecurity threats due to human factors. Bukauskas et al. [24] presented their findings on how an extensive digital transformation and specialized computing skills are required by the workforce to keep their infrastructure secured. They remapped cybersecurity competencies for small nation states to enable the desired security competencies in the computing workforce. Sabillon [25] carried out an empirical study in a Canadian higher education institute and presented a cybersecurity-awareness training model for corporate sector. They also stressed the need for continued research on cybersecurity awareness to keep users abreast with changing cybersecurity challenges. Hewitt and White [8] discussed how, when people’s fear of becoming a cyber victim grows, they report more security problems, and visiting unreliable websites is positively correlated with reported security events in home computers. Furthermore, they did not find any evidence of correlation between the education and cyber-optimistic bias of respondents. Olayinka and Win [26] found extensive digital transformations within business, and using diverse applications to monitor COVID-19 has introduced many security implications which require innovative solutions. Sintema [27] carried out a study in Zambia and highlighted that school closure due to COVID-19 was going to result in a higher failure rate in the national examination. Aykan and Yıldırım [28] investigated the implications of embedding the lesson-study model in online STEM education during COVID-19 and found that it resulted in improved lesson planning; however, lack of lesson planning experience, time and environmental conditions were quite challenging. Snell-Rood et al. [29] used a bio-inspiration approach to teach a biology course themed around the COVID-19 pandemic. Initially, students used mind mapping to model the problem and sub-problems relevant to the content, and later conducted an in-depth review of the literature as part of a student project. They proposed that such an approach could be used to teach a variety of topics using this inquiry-based pedagogy. Baptista et al. [30] examined how physics teachers used a STEM activity in the context of the pandemic and found that teachers who were able to innovate pedagogical approaches, integrate scientific and technical knowledge, and motivate students were able to deliver scientific knowledge to students effectively.

COVID-19 induced a transition to online learning which has made cybersecurity for students an interesting research area. Triplett [31] carried out a review study to find out how children’s cybersecurity awareness was important, and concluded that the adoption of game-based strategies to increase children’s awareness could be effective. Zorlu [32] conducted an empirical study with students of Bartin University, Turkey, and found that college students required awareness to keep themselves protected against cyberbullying and cybersecurity threats. The results highlighted that female students had higher awareness as compared to male students. It was also found that the intended use of the internet, cyberbullying exposure and online catfishing activities are key factors in determining awareness. Khan et al. [33] carried out an empirical study with undergraduate students and found that protection motivation theory-based training can positively change cybersecurity behavior, so practitioners should target the inclusion of a self-efficacy component of protection motivation theory in their training modules. Kasunic and Bracun [34] carried out an empirical study on applied science students at Zagreb University of Applied Sciences and found that there was cybersecurity awareness among students exhibited by careful accessing of email links, social media posts and websites. However, there was no significant difference in cybersecurity awareness between employed students and full-time students’ security behavior. Lourenço et al. [35] highlighted that, in the post covid era, students and teachers are exposed to increased use of technology, and a rise in cybercrime in society advocates for more awareness and training to enhance the knowledge of the public. Eltahir and Ahmed [36] conducted an empirical study on Sudanese university students and found that the male students had relatively higher cybersecurity awareness in comparison to the female students. Furthermore, the cybersecurity behaviors of advanced computer users were different than those of moderate ones.

English and Maguire [37] explored student expectations in two UK universities to understand the concerns with cybersecurity curricula in a bid to improve the cybersecurity modules. Netshakhuma [38] carried out a cybersecurity assessment study in South African universities and found poor implementation of cybersecurity strategies by employees and students. Conducting similar studies in other geographical regions to enrich the body of knowledge has been stressed. Hong et al. [39] conducted an empirical study in China and found that education level has a significant impact on cybersecurity behavior. They found significant differences in the cybersecurity behavior of non-final year students, final year students and working graduates. Adamu et al. [40] explored cybersecurity awareness in the northeastern region of Nigeria and found that students had limited cybersecurity awareness in areas like internet banking while in cases of cyberbullying, self-protection, and internet addiction, there was reasonable awareness. Garba et al. [41] investigated Nigerian universities and found a lack of skills in protecting their data even though they claimed to be aware of cybersecurity. Furthermore, many universities did not prepare students to protect their personal data. Senthilkumar and Easwaramoorthy [42] investigated cybersecurity awareness among students in Tamil Nadu, India and found that students had a good level of awareness to keep themselves secure from cyber-attacks. Slusky and Partow-Navid [43] conducted an empirical study with the business students at California State University and found that problems with security awareness were not due to lack of security knowledge; rather students lacked application of their security knowledge in real life situations. Therefore, the academic curricula need to adopt context-based security awareness to students.

2.3. Information Security Studies in the Context of Saudi Arabia

There has been little research exploring cybersecurity implications in Saudi Arabia. Johri and Kumar [44] carried out an empirical study to evaluate the cybersecurity satisfaction of banking customers in Saudi Arabia and found that there was a need for more cybersecurity awareness for customers to ensure safe online transactions. Saeed investigated information security practices of office employees in Saudi Arabia and outlined a set of recommendations to improve information security [45]. Almarhabi et al. [46] presented a framework for the Saudi government to balance system restrictions, privacy concerns and risks of security due to a Bring your own device approach by users. Aljedaani et al. [47] empirically investigated the security perception of end users of two mobile health applications in Saudi Arabia and found that the majority of respondents were unaware of security features, so a set of usable security guidelines was proposed. AlGhamdi et al. [48] presented a model to identify factors affecting the perception of employees in adhering to information security compliance and applied it in Saudi Arabian government organizations. Mohammed and Bamasoud [49] conducted a literature review and found that there was an innate need to enhance cybersecurity awareness among university students in Saudi Arabia. Alghamdi [50] outlined a set of security threats relevant to high school students in Saudi Arabia and highlighted regular communication among schoolteachers and parents to control the negative implications of information technology. Alqahtani [51] highlighted that passwords, the use of web browsers and social media are key factors contributing toward the cybersecurity awareness of students. Alotaibi and Mukred [52] conducted an empirical study in the city of Riyadh in Saudi Arabia and identified the factors contributing to cyber-violence behaviors among university students.

Although there has been some literature focusing on cybersecurity aspects, the diversity of students’ academic and geographical background and technological and cultural environment provides different challenges for cybersecurity awareness. Therefore, it is scientifically interesting to enrich this body of knowledge by developing more case studies in different geographical and cultural contexts to document best practices. Therefore, in this paper, we have explored cybersecurity awareness among computing university students in Saudi Arabia to understand their information security awareness.

3. Materials and Methods

This study is a part of a long-running project where we have been exploring information security behaviors among different types of users. In our earlier work, we investigated e-commerce shoppers [53] and office employees [45]. In this study we have focused on students to understand their information security behaviors. In the literature, we have found infrastructure management [54], password management [55], email management [56] and security perceptions of users [57] as key factors in fostering a positive information security behavior; therefore, our model is comprised of these four constructs. We have used questionnaires as a data collection tool for this cross-sectional study. In the literature [58,59,60,61], there are some cybersecurity awareness questionnaires, so for each construct of our model, we identified potential questions from these questionnaires. Furthermore, we designed additional questions for each of these four constructs. Once the questionnaire was prepared, the final version was reviewed by two colleagues for content accuracy, and it was further refined based on the feedback of reviewers. Once the questionnaire was finalized it was uploaded online in Google forms. The link was shared with potential students in the University and our qualification criteria was that respondents needed to be enrolled in a computing program. Before starting the questionnaire, the respondents were asked for their willingness to participate in the study, and told that they could leave the survey at any time. The survey did not ask for any identifiable information from respondents to keep the confidentiality of the respondents. We received a total of 198 responses. There were 56 male students and 142 female students. Based on the model in Figure 1, we formulated the following 4 hypotheses for our study.

H1: 

Effective password management practices lead to effective information security behavior of university students in Saudi Arabia.

H2: 

Employing appropriate measures to secure computing infrastructure leads to effective information security behavior of university students in Saudi Arabia.

H3: 

Employing secure email management practices leads to effective information security behavior of university students in Saudi Arabia.

H4: 

A positive perception of computer security leads to effective information security behavior of university students in Saudi Arabia.

After the data collection phase, to validate our hypotheses, we coded the Excel data into numeric form and performed a factor analysis using Smart PLS 4 [62]. The bootstrapping method was applied with 5000 iterations and p-values were extracted to accept or reject a hypothesis.

4. Results

In our survey, there were four important sections. In the first section there were questions relevant to infrastructure management, password management, email management and perception of security related questions. As shown in

Table 1. Responses for Infrastructure-Management-related Questions.

Survey Question No	Infrastructure Management (ISM)-Related Questions	Strongly Agree	Agree	Neutral	Disagree	Strongly Disagree
Q4	My personal computer has an anti-virus program installed. (ISM 1)	37%	44%	3%	7%	10%
Q5	The antivirus program is regularly updated. (ISM 2)	37%	33%	1%	16%	12%
Q6	I have a firewall installed on my computer. (ISM 3)	33%	31%	2%	21%	13%
Q7	I use an anti-spyware tool on my computer. (ISM 4)	15%	16%	2%	31%	37%
Q8	I allow “scripting” on my computer. (ISM 5)	13%	21%	5%	31%	30%
Q9	I always log off or lock the computer when I step away from it. (ISM 6)	29%	24%	4%	21%	22%
Q10	I use a password protected screensaver. (ISM 7)	35%	35%	5%	15%	11%

, most of the respondents had an antivirus program installed on their computers which was regularly updated as well. Empirical data also highlighted that more than 60% of respondents had a firewall installed on their computers and only 31% respondents had any anti spyware software installed. Only 34% of respondents allowed scripting on their computers. Furthermore, 53% respondents reported that they locked their computers while they stepped away from the computer and 70% respondents mentioned that they used password protected screensavers.

Related to password management, we asked seven questions in our questionnaire whose results are in

Table 2. Responses to Password-Management-related Questions.

Survey Question No	Password Management (PM)-Related Questions	Strongly Agree	Agree	Neutral	Disagree	Strongly Disagree
Q11	If I use a wireless network at home, I secure my wireless network connection (e.g., encryption enabled or access restriction) (PM 1)	29%	24%	2%	25%	21%
Q12	I use the same password to access multiple systems. (PM 2)	29%	32%	1%	12%	26%
Q13	I change my password when it is mandatory to change due to application requirements. (PM 3)	34%	36%	5%	14%	12%
Q14	When I change my password, I use my old password as a basis. (PM 4)	27%	25%	2%	24%	23%
Q15	I keep my username/passwords in an electronic file or write them down. (PM 5)	24%	26%	4%	23%	24%
Q16	I use software to keep track of my passwords. (PM 6)	51%	39%	1%	4%	6%
Q17	I share my password with other colleagues. (PM 7)	20%	21%	2%	26%	30%

. In the first question we asked, in the case of wireless network connection, whether encryption or access restrictions were applied. In total, 29% respondents strongly agreed, and 24%respondents agreed to the fact that they secure their home wireless network. In response to the second question, 29% respondents strongly agreed and 32% agreed that they use same password to access multiple systems. Furthermore, 34% respondents strongly agreed, and 36% respondents agreed that they only changed their passwords when it was enforced by the policy of the respective platform/application. In the next question, 27% respondents strongly agreed, and 25% respondents agreed that they used their old password as a basis for their new password; similarly, 24% strongly agreed and 26% agreed that they documented their usernames/passwords in a written form or an electronic file. Usernames and passwords could be stored in software applications, such as internet browsers. In our survey, 51% respondents strongly agreed and 39% agreed that they used software applications to store their password. Password sharing is very dangerous for security and in our survey 20% of respondents strongly agreed and 21% agreed that they shared their passwords with other colleagues.

As shown in

Table 3. Responses to Email-Management-related Questions.

Survey Question No	Email Management (EM)-Related Questions	Strongly Agree	Agree	Neutral	Disagree	Strongly Disagree
Q18	I open emails even if I do not know who the sender is. (EM 1)	24%	67%	1%	3%	5%
Q19	I even open attachments from the emails where I do not know who the sender is. (EM 2)	50%	46%	1%	2%	2%
Q20	I use encryption when sending emails. (EM 3)	9%	9%	2%	30%	51%
Q21	While using web-based email or calendar software, I pay attention to the security settings of the web-based software. (EM 4)	26%	21%	2%	28%	22%

, in the context of email management, we asked four questions. In the first question we asked whether you would open emails from unknown senders. A total of 24% of respondents strongly agreed and 67% agreed that they might open emails from unknown senders. Furthermore, 50% respondents strongly agreed and 46% agreed that they might even access email attachments from unknown senders. Only 9% of respondents strongly agreed and another 9% agreed that they might use encryption to secure email communication. In the last question in this section, we asked respondents whether they reviewed the security settings of web-based email applications and only 26% strongly agreed and 21% agreed that they would review security settings.

In this perception-of-security-related section of the questionnaire, we asked seven questions related to the perception of security of users and the results are shown in

Table 4. Responses for Perception-of-Security-related Questions.

Survey Question No	Perception of Security (POS)-Related Questions	Strongly Agree	Agree	Neutral	Disagree	Strongly Disagree
Q22	I think I can protect my computer from hackers/phishers, if I take good care of computer security. (POS 1)	33%	44%	17%	3%	4%
Q23	It does make a difference if I pay special attention to computer security, such as installing a browser that is less vulnerable. (POS 2)	24%	39%	22%	11%	5%
Q24	The information that I keep on my computer is not interesting enough for people to try and hack into my computer. (POS 3)	13%	28%	35%	14%	10%
Q25	It does not matter what I do; if people have bad intentions, they will be able to hack into my computer and our network. (POS 4)	7%	23%	32%	26%	12%
Q26	Attention to computer security is needed, but people should not overreact. (POS 5)	5%	38%	35%	19%	4%
Q27	I do not like to use the Internet for financial transactions. (POS 6)	12%	39%	34%	11%	4%
Q28	Computer security worries me. (POS 7)	4%	13%	28%	40%	15%

. In the first question we asked, do you think that you can protect your computer from hackers? In total, 33% strongly agreed and 44% agreed that they thought that they could protect their computer from hacking/phishing. A total of 24% of respondents strongly agreed and another 39% agreed that paying special attention to security aspects did not make any difference in securing computers. A total of 13% of respondents strongly agreed and another 28% agreed that the information contained in their computer was not interesting for hackers. Furthermore, 7% respondents agreed and another 23% agreed that if people had bad intentions, they would be able to hack into the computer and network. In response to the question stating that attention to computer security is needed, but people should not overreact, only 5% of respondents strongly agreed and another 38% agreed. A total of 12% of the respondents strongly agreed and 29% agreed that they did not use internet for financial transactions. In the last question, 4% of respondents strongly agreed and another 13% agreed that they were worried about computer security.

Factor analysis was performed on the empirical data and as shown in Figure 2, infrastructure management, password management, email management, and perception of security were used as main constructs. The R-square value for the model was 0.969, which is considered acceptable [63]. Path coefficient analysis highlighted that email management to security behavior has a value of 0.621 showing a strong positive association. In the case of infrastructure management to security behavior the path coefficient value of 0.544 highlights a moderately positive association. In the case of password management to security behavior, the path coefficient value of 0.105, and for perception of security-to-security behavior the path coefficient value of 0.076, show a very weak or no association. To check the discriminant validity of the model we used the Fornell–Larcker criterion [64]. As shown in

Table 5. Discriminant validity using Fornell-Larcker Criterion.

	Email Management	IS Management	Password Management	Perception of Security
Email Management	0.517
IS Management	0.261	0.524
Password Management	0.242	0.222	0.411
Perception of Security	0.171	0.221	0.178	0.416

, the value of email management (0.517) is higher than the value of all the other constructs in the same column, which is true for all other columns. As a result, hypotheses H1 and H4 were rejected, whereas H2 and H3 were approved.

The mean, standard deviation, t statistics and p values of the model are given in

Table 6. Mean, Standard Deviation, T Statistics and p Values.

	Sample Mean (M)	Standard Deviation (STDEV)	T Statistics (O/STDEV)	p Values
Email Management-to-Security Behavior	0.561	0.097	6.373	0.000
IS Management-to-Security Behavior	0.502	0.099	5.470	0.000
Password Management-to-Security Behavior	0.153	0.145	0.726	0.468
Perception of Security-to-Security Behavior	0.129	0.132	0.573	0.567

. In the case of email management and infrastructure management the mean values are around 0.5, whereas in the case of password management and perception of security its value is on the lower side. Similarly, in case of T statistics, a value greater than +2 and less than −2 is considered acceptable so in our case email management and infrastructure management were seen as relevant factors for security behavior, whereas password management and perception of security were not considered relevant. In the case of the p-value [65], a value lower than 0.05 is considered significant and again it was seen that email management and infrastructure management were relevant factors whereas password management and perception of security proved insignificant.

Normally, it is recommended that for a factor to be significant the factor loading value should be at least 0.2; however, the higher the value, the higher the significance is. We kept the cutoff point as 0.5 and revised the model which is shown in Figure 3.

5. Discussion

“Education for all“ is an important sustainable development goal and during the pandemic online education proved to be a crucial enabler to impart education to learners. However, virtual learning environments require students to be online for an extended period which makes them prone to cyber-attacks. To foster a more sustainable use of online resources, a secure online learning environment needs to be enabled by providing students with a higher level of cybersecurity awareness. Cybersecurity is very critical to the storage of online data [66] and like other business domains [67] the education sector also needs to deal with this aspect optimally to enhance online learning. Therefore, it is imperative that while designing software systems for education, it is considered that systems need to be secure and usable. To be usable, a user-centric design approach may be adopted so that systems are aligned with user practices [68,69]. In our study, factor analysis highlighted that respondents reported infrastructure management and email management to be the key factors in their information security behaviors. In our earlier work [45], business employees did not consider infrastructure management as a key factor, and the reason could be that majority of business organizations have an IT department dedicated to maintaining the IT infrastructure, so therefore business respondents did not feel infrastructure management to be a key issue in their information security behaviors; however, earlier literature [70,71] has highlighted that this is relevant. Email management was also considered a relevant factor, which is in line with the earlier studies [56,72,73]. The perception of security and password management were not considered a relevant factor by our respondents; however, earlier studies [45,74] outlined them as a relevant factor. Password management was considered relevant by business employees in our earlier study [45] but computing students did not think it was a relevant factor. One of the potential reasons could be that the respondents were computing students who considered themselves technically advanced so they might have assumed that they were more aware of security threats, so the perception factor was irrelevant.

5.1. Theoretical Implications

Many theoretical frameworks have been established within the literature, such as protection motivation theory [53,75], and the theory of planned behavior [45,76] used in the cybersecurity literature to understand the information security behaviors of users. Protection motivation theory highlights how users respond to different security threats while working with information technology applications. On the other hand, the theory of planned behavior focuses more on when a user perceives a certain action to be useful, has the required skills and acquires appropriate support from his peers, and then it is expected that they will indulge in their desired behavior. In our case, we can refer to password management, email management and infrastructure management as perceived behavioral controls whereas perception of security could be termed as a behavioral attitude. In our case, we found that email management and infrastructure management contribute to students’ intentions to engage in secure behavior.

5.2. Managerial Implications

The results of our study are helpful for educational managers, students, and policymakers. Even though our respondents were technically advanced students, we believe students from other disciplines may not have had such a high level of cybersecurity agility; therefore, we have presented a set of guidelines, shown in Figure 4, to ensure students improve their information security behavior. Students should ensure that the network from where they connect, the applications they use, operating systems and devices are secure. Additionally, the students should use online payments only on secure websites and adopt secure browsing behavior by avoiding risky sites. Educational institutions should also contribute to improving the information security behavior of students. Academic institutions need to have training programs for students to keep themselves secure while being online. Academic institutions need to have a documented institutional security policy so that students are aware of expected online behavior while on institutions’ networks. This will also help them in adopting a similar cautious approach while they connect from their personal networks. This could be followed up with rewards and punishment policies for students to strictly enforce information security policy. Academic institutions can also arrange different events like hackathons, awareness workshops, secure browsing days etc. to reinforce secure behavior among students.

5.3. Study Limitations and Future Directions

One of the limitations of our work is that the student sample was not large enough and was not representative of the whole student population of Saudi Arabia. Therefore, the findings may not be generalized for the entire student population of Saudi Arabia. However, our study provides an interesting insight which can be further explored in depth with a large dataset. Furthermore, in the future, we intend to extend the work in different geographical regions of Saudi Arabia and would complement it with a qualitative study to understand the motivators and demotivators of information security behaviors among students. It is also scientifically very interesting to compare student perceptions in different geographical regions to understand the cultural implications on cybersecurity awareness and perceptions of students.

6. Conclusions

Quality education is crucial in attaining sustainable development goals and technology has huge potential to improve education quality and its reach. Information security, however, is a critical issue for the sustainable use of technology. In the post-pandemic era, online education has become an integral tool for academic institutions and learners and thus information security has become a major factor for students as well. In this paper, we have explored the information security behavior of computing students in a university in Saudi Arabia. We have collected the empirical data with the help of a questionnaire which was analyzed using a partial least-squares method. The findings highlighted that the respondents did not consider password management and security perception as relevant factors for information security; however, they considered email management and infrastructure management as key issues for secure information security behaviors. We further drilled down in these four categories to identify the sub-factors and found many factors which were highlighted as important in the literature but considered not relevant by our respondents. Therefore, we have identified actions to be taken by students as well as their institutions to foster secure behavior among students. The findings are of interest to academic institutions, students, and government agencies to improve information security in society.