Project – Assessment of Cybersecurity Awareness Among University Students: A Case Study of Selected Universities in Ogun State.

CHAPTER ONE

INTRODUCTION

1.1 Background to the Study

The development of information and communication technology has transformed the way people communicate, learn, conduct financial transactions, and access information. Universities increasingly depend on digital platforms for course registration, online learning, electronic examinations, research, communication, library services, and the storage of students’ personal information. Although these technologies provide significant benefits, they also expose users to cybersecurity threats that can compromise their privacy, finances, academic records, and digital identities. Cybersecurity refers to the processes, technologies, and practices used to protect computers, networks, applications, and information against unauthorised access, damage, theft, and disruption. Cybersecurity awareness, on the other hand, involves understanding potential digital threats, recognising unsafe online activities, and knowing the appropriate measures to prevent or respond to security incidents. The National Institute of Standards and Technology (NIST, 2024) emphasises the importance of integrating cybersecurity considerations into organisational risk management. Within universities, this makes cybersecurity awareness an important aspect of responsible digital participation, particularly for students who routinely use institutional and personal digital services.

The expansion of internet-based services has created opportunities for cybercriminals to exploit human behaviour through deceptive messages, fraudulent websites, malicious attachments, identity impersonation, and social engineering. These threats do not necessarily depend on sophisticated technical attacks; they may succeed because users fail to recognise warning signs or unknowingly disclose confidential information. Phishing, for example, involves deceptive communications designed to persuade individuals to reveal sensitive information, transfer money, or open malicious content. Other threats include account takeover, identity theft, malware infection, online financial fraud, cyberbullying, and the misuse of personal information. The Verizon 2024 Data Breach Investigations Report identifies the human element as an important factor in many security breaches, illustrating why user behaviour remains central to cybersecurity protection. University students may encounter these risks through email, social media, messaging applications, online marketplaces, and academic portals. Consequently, assessing cybersecurity awareness requires examining not only whether students have heard about cyber threats but also whether they can identify risky situations and make informed decisions when using digital platforms.

University students are important participants in the digital environment because they frequently use smartphones, laptops, social media, online banking applications, electronic learning platforms, and digital communication services. These technologies support academic research, assignment submission, collaboration, access to learning materials, and interaction with lecturers and fellow students. However, frequent internet use does not necessarily mean that students possess adequate cybersecurity knowledge or consistently practise safe online behaviour. Students may reuse passwords across multiple accounts, connect to unsecured wireless networks, click suspicious links, download unverified applications, or disclose personal information without considering the possible consequences. Garba, Sirat, Hajar, and Dauda (2020), in their study of cybersecurity awareness among Nigerian university students, reported that although respondents claimed to possess basic cybersecurity knowledge, their understanding of how to protect personal data was inadequate. The researchers also identified a need for more active cybersecurity awareness programmes within universities. This finding demonstrates the importance of investigating students’ actual awareness and protective practices rather than assuming that exposure to digital technology automatically produces cybersecurity competence.

Cybersecurity awareness is multidimensional and includes knowledge of common threats, recognition of suspicious online activities, understanding of protective technologies, and the ability to apply appropriate security practices. Password security, multifactor authentication, phishing recognition, privacy management, software updates, safe browsing, data protection, and incident reporting are among the areas relevant to university students. For example, students should understand why strong and unique passwords are important, how authentication codes protect accounts, and why passwords or one-time passwords should not be disclosed to other people. They should also recognise suspicious messages that create urgency, promise unrealistic rewards, or request sensitive information. The National Institute of Standards and Technology (NIST, 2024) provides a risk-management framework that supports the identification, assessment, and management of cybersecurity risks. Applying this perspective to higher education suggests that awareness should be assessed through specific knowledge and behavioural indicators. A student may recognise the term phishing but still fail to identify a convincing fraudulent email; therefore, effective assessment should distinguish general awareness from practical ability to recognise and respond to threats.

In Nigeria, university students increasingly depend on digital technologies for academic activities, financial transactions, social interaction, and access to administrative services. Electronic portals, online learning platforms, institutional email accounts, digital library systems, and mobile financial applications have become important components of university life. These developments make digital security relevant to students across disciplines, including those who are not studying computer science or information technology. Garba et al. (2020) investigated cybersecurity awareness among Nigerian university students and found a gap between students’ claimed basic knowledge and their understanding of personal data protection. Similarly, Garba et al. (2021), in their analysis of cybersecurity awareness among university students in northeastern Nigeria, considered issues including cyberbullying, personal information, internet banking, internet addiction, and self-protection. These studies indicate that cybersecurity awareness should be understood as a broad educational and behavioural concern rather than a responsibility limited to technical departments. They also support the need for further research in other Nigerian university environments, where differences in institutional policies, digital resources, students’ backgrounds, and exposure to awareness programmes may produce different levels of cybersecurity preparedness.

Ogun State is an important setting for investigating cybersecurity awareness because it hosts universities serving students from different educational, social, and geographical backgrounds. Institutions such as Covenant University, located in Ota, provide higher education in an environment where students engage with digital technologies for academic and administrative purposes. Okokpujie et al. (2023) investigated students’ susceptibility to phishing attacks and safe email usage in the academic environment of a Nigerian university, using Covenant University in Ogun State as their case study. Their research highlights the relevance of phishing awareness and the risks students may encounter when using email for academic communication. This local evidence provides a useful foundation for investigating cybersecurity awareness in selected universities in Ogun State. However, evidence from a single institution cannot automatically represent the experiences of students across other universities in the state. A broader assessment of selected institutions may therefore provide a more informative picture of students’ awareness of cybersecurity threats, their knowledge of preventive measures, and the security practices they report using in their everyday digital activities.

Despite growing dependence on digital platforms, important questions remain about whether university students possess adequate knowledge to identify cyber threats and protect their personal and academic information. Some students may be familiar with cybersecurity terminology but lack practical skills in recognising phishing messages, managing passwords, protecting their privacy, or reporting suspicious activity. Okokpujie et al. (2023) examined susceptibility to phishing attacks in a Nigerian university environment, while Garba et al. (2020) identified concerns about students’ ability to protect their data despite their reported basic knowledge. More recent research by Okokpujie et al. (2025) also investigated students’ vulnerability and awareness regarding phishing attacks in educational institutions, further demonstrating the continuing relevance of this issue in higher education. Nevertheless, cybersecurity awareness may vary according to students’ academic disciplines, levels of study, previous training, frequency of internet use, and exposure to security incidents. It is therefore necessary to assess cybersecurity awareness among students in selected universities in Ogun State, focusing on their knowledge of common cyber threats, awareness of protective measures, online security practices, and the challenges affecting their ability to remain safe online. The findings may help universities identify areas requiring additional education, practical training, and institutional support.

1.2 Statement of the Problem

The increasing use of digital technologies in university education has made cybersecurity awareness an important concern for students, university administrators, and other stakeholders in higher education. Students depend on digital platforms to access academic materials, communicate with lecturers, register for courses, conduct research, and manage personal and financial information. However, these activities may expose them to phishing, identity theft, account compromise, online fraud, malware, and other cyber threats. The problem is that access to digital technology does not necessarily mean that students understand how to protect themselves against these risks. Garba et al. (2020) found that Nigerian university students reported basic cybersecurity knowledge but demonstrated limitations in understanding how to protect their personal data. This raises concerns about the adequacy of students’ cybersecurity awareness and the extent to which they can identify and respond appropriately to online threats.

A second problem concerns the difference between knowing about cybersecurity and practising safe online behaviour. Students may have heard about phishing, password security, online fraud, and privacy protection but may still engage in risky activities, such as clicking suspicious links, reusing passwords, downloading unverified files, or sharing confidential information. Okokpujie et al. (2023) investigated students’ susceptibility to phishing attacks in the academic environment of a Nigerian university and highlighted weaknesses in students’ ability to recognise phishing threats. This suggests that cybersecurity awareness should not be assessed solely by asking students whether they have heard about particular threats. It is also necessary to examine their understanding of protective measures and the extent to which they apply these measures when using email, social media, online banking, and university digital platforms.

Another problem is that university students may differ in their cybersecurity knowledge and practices because of differences in academic disciplines, previous exposure to cybersecurity training, digital experience, and access to institutional awareness programmes. Students studying computer science or information technology may encounter security-related concepts during their studies, while students in other disciplines may have fewer formal opportunities to learn about cybersecurity. Garba et al. (2021) examined cybersecurity awareness among university students in northeastern Nigeria, focusing on issues such as cyberbullying, personal information, internet banking, and self-protection. Their work illustrates the broad range of issues involved in students’ digital safety. However, findings from universities in northeastern Nigeria cannot automatically be generalised to students in Ogun State, where institutional conditions and students’ experiences may differ. This creates a need to investigate cybersecurity awareness within the specific university environments selected for the present study.

Furthermore, although previous research has examined cybersecurity awareness and phishing susceptibility among Nigerian university students, it remains important to establish the level of awareness among students in selected universities in Ogun State. Okokpujie et al. (2023) focused on phishing susceptibility in an academic environment in Ogun State, while Garba et al. (2020) examined cybersecurity awareness among Nigerian university students more generally. These studies provide a useful foundation, but they do not eliminate the need to assess students’ knowledge of current cybersecurity threats, their use of preventive measures, their online security practices, and the challenges they encounter in protecting their digital identities and information. The problem addressed by this study is therefore the need to establish the level of cybersecurity awareness among students in selected universities in Ogun State and identify areas where cybersecurity education and institutional support may be strengthened.

1.3 Objectives of the Study

The main objective of this study is to assess cybersecurity awareness among university students in selected universities in Ogun State, Nigeria.

The specific objectives are to:

1. Determine the level of cybersecurity awareness among students in selected universities in Ogun State.

2. Examine students’ knowledge of common cybersecurity threats, including phishing, malware, identity theft, and online fraud.

3. Assess the cybersecurity practices adopted by students to protect their personal information and digital accounts.

4. Identify the factors and challenges affecting cybersecurity awareness and safe online behaviour among students in selected universities in Ogun State.

1.4 Research Questions

The following research questions will guide the study:

1. What is the level of cybersecurity awareness among students in selected universities in Ogun State?

2. What do students know about common cybersecurity threats, including phishing, malware, identity theft, and online fraud?

3. What cybersecurity practices do students adopt to protect their personal information and digital accounts?

4. What factors and challenges affect cybersecurity awareness and safe online behaviour among students in selected universities in Ogun State?

1.5 Research Hypothesis

The following null hypothesis will be tested at the 0.05 level of significance:

H₀: There is no statistically significant relationship between cybersecurity awareness and the adoption of safe online security practices among students in selected universities in Ogun State.

1.6 Significance of the Study

The findings of this study are expected to be beneficial to university students, university management, information technology departments, cybersecurity professionals, policymakers, and future researchers.

University students: The study may help students understand the importance of cybersecurity awareness in their academic and personal lives. By identifying common knowledge gaps and unsafe online practices, the findings may encourage students to adopt stronger passwords, use multifactor authentication, protect personal information, recognise suspicious messages, and report potential security incidents.

University management: The findings may provide university administrators with information about students’ cybersecurity awareness and the challenges they face when using digital platforms. This information may assist institutions in developing cybersecurity policies, organising awareness campaigns, and incorporating digital safety guidance into student orientation programmes.

Information technology departments: The study may help university ICT departments identify areas where students require additional cybersecurity education. The findings may inform the development of practical training on password management, phishing recognition, account protection, secure internet use, and the safe handling of academic information.

Cybersecurity professionals: The research may provide useful information for professionals involved in digital safety education and risk management. Understanding students’ knowledge and reported practices may help these professionals develop awareness activities that address the particular threats and behaviours identified in university environments.

Government and policymakers: The findings may provide evidence to support broader cybersecurity education initiatives in Nigerian higher education. Relevant government agencies and education authorities may use the results to consider measures that strengthen digital literacy, privacy protection, and responsible internet use among university students.

Researchers and future scholars: The study may contribute to existing literature on cybersecurity awareness in Nigeria, particularly in Ogun State. It may also provide a basis for further investigations into differences in awareness across academic disciplines, universities, levels of study, and previous exposure to cybersecurity training.

1.7 Scope of the Study

The study focuses on cybersecurity awareness among students in selected universities in Ogun State, Nigeria. The geographical scope is limited to the universities selected for the investigation. The particular institutions will be identified during the research design and sampling process.

In terms of content, the study will examine students’ overall cybersecurity awareness, knowledge of common cyber threats, adoption of protective security practices, and the factors affecting safe online behaviour. Specific areas will include phishing, malware, password management, multifactor authentication, online financial fraud, identity theft, privacy protection, suspicious links, and the reporting of cybersecurity incidents.

The study will cover students from selected academic departments and levels of study, depending on the sampling strategy adopted. It will examine their knowledge and reported practices when using social media, email, online banking applications, learning management systems, and other digital platforms. The research will focus on awareness and protective behaviour rather than conducting technical penetration tests or investigating confidential university security systems.

1.8 Limitations of the Study

The study may encounter certain limitations during data collection and analysis. First, because the research will involve selected universities rather than every university in Ogun State, the findings may not be generalisable to all university students in the state or Nigeria.

Second, the study may rely on questionnaire responses, which can be affected by respondents’ willingness to provide accurate information. Some students may overestimate their cybersecurity knowledge or report safer online behaviour than they practise. To reduce this limitation, the questionnaire should use clear questions and practical examples of cybersecurity situations wherever appropriate.

Third, cybersecurity threats and attack techniques continue to evolve, meaning that students’ awareness may change over time. The findings will therefore reflect the period during which the data are collected. In addition, differences in academic discipline, access to technology, previous cybersecurity training, and internet-use patterns may influence the results.

Finally, a cross-sectional survey can describe students’ awareness and examine associations between awareness and security practices, but it cannot by itself establish that awareness causes particular behaviours. These limitations will be considered when interpreting the results and making recommendations.

1.9 Definition of Key Terms

Cybersecurity: The practices, technologies, and processes used to protect digital devices, computer systems, networks, and information from unauthorised access, attack, damage, or disruption.

Cybersecurity Awareness: The knowledge and understanding individuals possess about cyber threats, digital security risks, and the measures required to protect their devices, accounts, and personal information.

University Students: Individuals formally enrolled in undergraduate or other eligible programmes at the universities selected for the study.

Phishing: A form of cyberattack in which an attacker uses deceptive messages, websites, or communications to trick individuals into disclosing sensitive information or performing unsafe actions.

Malware: Malicious software designed to damage systems, disrupt operations, steal information, or obtain unauthorised access to digital devices.

Safe Online Security Practices: Actions taken by individuals to reduce digital security risks, including using strong and unique passwords, enabling multifactor authentication, checking suspicious messages, updating software, and protecting personal information.

Cyber Threats: Potential malicious activities or events that may compromise the confidentiality, integrity, or availability of digital systems and information.

Personal Information: Information relating to an identifiable individual, including names, contact details, identification information, financial details, account credentials, and other private data.

Cybersecurity Training: Organised educational activities intended to improve individuals’ understanding of cybersecurity threats and their ability to apply appropriate protective measures.

Project – Assessment of Cybersecurity Awareness Among University Students: A Case Study of Selected Universities in Ogun State.