Project – Cybersecurity Awareness and Protection of Personal Information among University Students: A Case Study of the University of Lagos.

CHAPTER ONE

INTRODUCTION

Research Topic: Cybersecurity Awareness and Protection of Personal Information among University Students: A Case Study of the University of Lagos.

1.1 Background to the Study

The rapid advancement of information and communication technology has significantly transformed the way individuals communicate, access information, conduct research, receive education, and interact with organisations. The widespread adoption of smartphones, computers, social networking platforms, online banking applications, electronic learning systems, and other internet-based services has created opportunities for faster information exchange and improved access to digital resources. However, the increasing dependence on these technologies has also exposed individuals to various cybersecurity threats, including identity theft, phishing attacks, malware, online fraud, hacking, unauthorised access, and personal information leakage. Cybersecurity has therefore become an important concern in contemporary society because the safety of individuals and organisations increasingly depends on their ability to protect digital systems, networks, accounts, and information from malicious activities. The International Telecommunication Union (ITU, 2021) explains that cybersecurity involves the development of policies, technologies, processes, and practices aimed at protecting cyberspace and its users against security threats. Similarly, the National Institute of Standards and Technology (NIST, 2024) emphasises the importance of identifying, protecting against, detecting, responding to, and recovering from cybersecurity risks. These developments demonstrate that cybersecurity awareness is necessary for individuals who regularly interact with digital platforms and electronic information systems.

Cybersecurity awareness refers to the knowledge and understanding individuals possess concerning digital security threats, vulnerabilities, preventive measures, and responsible online behaviour. It involves the ability to recognise suspicious activities, identify fraudulent messages, protect passwords, secure electronic devices, avoid unsafe websites, and understand the importance of safeguarding personal information. Cybersecurity awareness also includes knowledge of social engineering techniques, phishing emails, malicious links, identity theft, data breaches, and other forms of cybercrime. Individuals with adequate cybersecurity awareness are more likely to recognise potential online dangers and adopt protective measures before their personal information is compromised. Hadlington (2017), in examining human factors in cybersecurity, identifies the importance of understanding users’ knowledge, attitudes, and behaviours in relation to cyber risks. Similarly, Parsons et al. (2017) developed the Human Aspects of Information Security Questionnaire (HAIS-Q) to assess information security awareness and related behaviours, demonstrating that knowledge, attitudes, and practices are important dimensions of information security awareness. Consequently, cybersecurity awareness should be regarded as an essential component of digital literacy, particularly among individuals who frequently use online platforms for academic, social, and financial activities.

The protection of personal information is closely connected to cybersecurity awareness because individuals regularly provide sensitive information when accessing digital services. Personal information refers to data that identifies or can reasonably identify an individual, including full names, residential addresses, telephone numbers, email addresses, photographs, identification numbers, financial details, academic records, login credentials, and biometric information. Such information may be collected, stored, transmitted, and processed through university registration portals, electronic learning platforms, social media accounts, banking applications, and other digital services. When personal information is inadequately protected, it may be exposed to unauthorised access, identity theft, financial fraud, impersonation, harassment, and other forms of exploitation. The European Union’s General Data Protection Regulation (GDPR, 2016) establishes important principles for the lawful processing, security, and protection of personal data, while the National Institute of Standards and Technology (NIST, 2020) emphasises the need to identify and manage privacy risks associated with the processing of personal information. These frameworks demonstrate that protecting personal information requires both institutional safeguards and responsible practices by individual users.

University students constitute an important population in cybersecurity discussions because of their frequent engagement with digital technologies for academic, social, financial, and personal activities. Students use online platforms to register for courses, access lecture materials, submit assignments, communicate with lecturers, participate in virtual classes, conduct research, and interact with fellow students. They also depend on social networking platforms, electronic payment services, online marketplaces, and messaging applications for everyday activities. These interactions often require students to provide personal information, create online accounts, share photographs, and disclose other details that may expose them to cybersecurity risks. Gabra, Sirat, Hajar, and Dauda (2020), in their study titled Cyber Security Awareness Among University Students: A Case Study, examined cybersecurity awareness among students in Nigerian universities and reported that although students claimed to possess basic cybersecurity knowledge, many were not adequately informed about protecting their personal data. The researchers also highlighted the apparent absence of active cybersecurity awareness programmes in some universities. This suggests that university students may be technologically active without necessarily possessing sufficient knowledge and practical skills to protect themselves against cyber threats.

Furthermore, the increasing use of social media and online communication platforms has created additional cybersecurity concerns among university students. Platforms such as Facebook, Instagram, WhatsApp, TikTok, X, and other digital applications allow students to communicate, share information, establish social relationships, and participate in online communities. However, excessive disclosure of personal information, weak privacy settings, password sharing, acceptance of suspicious friend requests, and interaction with unverified accounts can expose students to cybercriminal activities. Cybercriminals may exploit publicly available information to impersonate individuals, manipulate users through social engineering, obtain login credentials, or carry out fraudulent transactions. Whitty (2015), in examining online romance fraud and its psychological and financial consequences, demonstrates how online deception can exploit users’ trust and personal information. Similarly, Hadlington (2017) identifies human behaviour and individual cybersecurity practices as important considerations in understanding vulnerability to cyber threats. These findings indicate that students’ social media activities and online communication habits make cybersecurity awareness particularly important for protecting personal information.

In Nigeria, the increasing adoption of digital services has made cybersecurity and personal information protection important national concerns. Individuals increasingly depend on electronic banking, mobile applications, digital identification systems, online registration platforms, telecommunications services, and internet-based communication. Although these services provide convenience and improve access to information, they also create opportunities for cybercriminals to exploit weak passwords, inadequate security practices, phishing messages, and personal information disclosed through digital platforms. The Nigerian government has introduced institutional and legislative measures to address these concerns, including the Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, as amended in 2024, and the Nigeria Data Protection Act, 2023. The Nigeria Data Protection Act, 2023, establishes a framework for protecting personal data and regulating its processing through the Nigeria Data Protection Commission. In addition, Salau (2024), in examining cybersecurity, state surveillance, and the right to online privacy in Nigeria, highlights the relationship between cybersecurity and the protection of individuals’ privacy rights. These developments demonstrate the importance of promoting cybersecurity knowledge and responsible personal information management among Nigerian internet users, particularly university students.

At the university level, cybersecurity awareness is particularly important because higher institutions increasingly rely on digital infrastructure to support academic administration, research, communication, and student services. University students routinely interact with student information systems, learning management systems, electronic libraries, institutional email accounts, online examination platforms, and digital payment portals. These systems may contain sensitive information such as students’ registration details, examination records, academic histories, financial information, and personal identification details. A security breach involving these platforms may expose students to identity theft, financial exploitation, unauthorised disclosure of academic records, and other privacy violations. The National Institute of Standards and Technology (NIST, 2024) emphasises that cybersecurity requires an organised approach to managing risks across technological systems and the individuals who use them. Furthermore, Gabra et al. (2020) demonstrate that students’ possession of basic cybersecurity knowledge does not necessarily mean they have adequate practical understanding of personal data protection. Therefore, universities need to promote cybersecurity education and responsible digital practices alongside the provision of technological infrastructure.

At the University of Lagos, the increasing use of digital platforms for academic and administrative activities makes cybersecurity awareness and personal information protection relevant areas of investigation. Students engage with electronic registration systems, institutional communication channels, online learning resources, research platforms, social media, and other internet-based services that may require the disclosure or processing of personal information. Their daily digital activities may expose them to risks such as phishing, fraudulent links, password compromise, identity theft, unauthorised access, online impersonation, and personal data leakage. Although some students may possess knowledge of common cyber threats, differences in digital literacy, cybersecurity training, awareness of privacy rights, and personal security practices may influence their ability to protect sensitive information. Parsons et al. (2017) establish that information security awareness involves knowledge, attitudes, and actual protective behaviour, while Salau (2024) emphasises the importance of safeguarding online privacy within Nigeria’s evolving digital environment. It is therefore necessary to examine the extent of cybersecurity awareness among University of Lagos students and determine whether such awareness translates into effective personal information protection.

Against this background, the present study seeks to examine cybersecurity awareness and the protection of personal information among university students, using the University of Lagos as a case study. The study focuses on students’ knowledge of cybersecurity threats, their awareness of personal information protection, their online security practices, and the challenges affecting their ability to safeguard personal information. It also considers protective practices such as the use of strong passwords, two-factor authentication, secure browsing, privacy settings, careful disclosure of personal information, and the recognition and avoidance of suspicious online activities. The study is informed by the understanding that effective cybersecurity depends not only on technological safeguards but also on the knowledge, attitudes, and behaviour of individual users. In line with the findings of Gabra et al. (2020), Parsons et al. (2017), and the provisions of the Nigeria Data Protection Act (2023), the study aims to provide an understanding of how cybersecurity awareness can contribute to improved personal information protection among students of the University of Lagos.

1.2 Statement of the Problem

The increasing dependence on digital technologies among university students has created serious concerns about cybersecurity awareness and the protection of personal information. Students regularly use smartphones, computers, social media platforms, online banking applications, electronic learning systems, and university portals for academic and personal activities. These platforms often require the submission of sensitive information, including names, email addresses, telephone numbers, passwords, photographs, financial details, and academic records. However, frequent use of digital platforms does not necessarily indicate that students possess adequate knowledge of cybersecurity threats or understand how to protect their personal information. Some students may unknowingly expose themselves to phishing attacks, identity theft, fraudulent websites, malicious links, and unauthorised access to their online accounts. Gabra et al. (2020) observed that university students who claimed to possess basic cybersecurity knowledge were not necessarily well informed about protecting their personal data. This situation raises concerns about the level of cybersecurity awareness among students and the adequacy of their personal information protection practices.

Another major problem is the possibility that university students engage in unsafe online activities that increase their vulnerability to cyber threats. Such activities may include using weak or repeated passwords, sharing login credentials, accessing unsecured websites, downloading applications from unverified sources, responding to suspicious messages, and disclosing excessive personal information on social media. Students may also fail to activate additional security measures such as two-factor authentication or regularly review the privacy settings of their digital accounts. These practices can expose their personal information to cybercriminals and increase the possibility of financial fraud, impersonation, account compromise, and privacy violations. Parsons et al. (2017) demonstrate that information security awareness involves not only knowledge but also attitudes and actual security behaviours. Consequently, the problem extends beyond whether students have heard about cybersecurity to whether they consistently apply appropriate protective measures when using digital platforms.

Furthermore, there are concerns about the adequacy of cybersecurity education, institutional awareness programmes, and students’ knowledge of their personal data protection rights. Although universities increasingly depend on digital platforms for academic and administrative activities, students may not receive sufficient practical education on recognising cyber threats, responding to security incidents, reporting suspected data breaches, and exercising their privacy rights. The existence of legislation such as the Nigeria Data Protection Act, 2023, does not automatically guarantee that students understand its provisions or know how to protect their personal information. Okoh (2025), in a study of audience knowledge, attitudes, and practices concerning the Nigeria Data Protection Act among Covenant University students, found that only 33.2% of the 400 respondents were aware of the Act before the study, while 41.6% were uncertain about its ability to protect personal data. Although this research was conducted in another university, it illustrates the importance of investigating students’ understanding of data protection within individual institutional environments. Therefore, there is a need to establish whether cybersecurity awareness initiatives and institutional support adequately prepare students to protect their personal information.

The specific problem this study seeks to address is the insufficient institution-specific empirical evidence concerning the relationship between cybersecurity awareness and the protection of personal information among students of the University of Lagos. Although Gabra et al. (2020) examined cybersecurity awareness among university students in Nigeria, and Parsons et al. (2017) established the importance of security knowledge, attitudes, and behaviours, there remains a need to investigate how these issues manifest among students of the University of Lagos. The increasing use of digital academic platforms, social networking applications, online financial services, and electronic communication systems makes it important to understand students’ exposure to cyber threats, their awareness of protective measures, and the challenges they encounter in safeguarding personal information. Without such institution-specific evidence, it may be difficult to determine the areas requiring improved cybersecurity education and awareness programmes. Consequently, this study seeks to examine students’ level of cybersecurity awareness, identify common cybersecurity threats encountered by them, assess their personal information protection practices, and determine the challenges affecting effective protection of personal information at the University of Lagos.

1.3 Objectives of the Study

The main objective of this study is to examine cybersecurity awareness and the protection of personal information among university students, using the University of Lagos as a case study.

The specific objectives are to:

1. Examine the level of cybersecurity awareness among students of the University of Lagos.

2. Identify the common cybersecurity threats encountered by students of the University of Lagos when using digital platforms.

3. Assess the personal information protection practices adopted by students of the University of Lagos.

4. Examine the challenges affecting students’ awareness of cybersecurity and their ability to protect personal information.

1.4 Research Questions

The following research questions are formulated to guide the study:

1. What is the level of cybersecurity awareness among students of the University of Lagos?

2. What are the common cybersecurity threats encountered by students when using digital platforms?

3. What personal information protection practices are adopted by students of the University of Lagos?

4. What challenges affect students’ cybersecurity awareness and their ability to protect personal information?

1.5 Research Hypothesis

The following null hypothesis is formulated to guide the study:

H₀₁: There is no significant relationship between cybersecurity awareness and the protection of personal information among students of the University of Lagos.

1.6 Significance of the Study

This study is expected to be beneficial to different stakeholders, particularly university students, university management, government agencies, cybersecurity professionals, policymakers, and future researchers. Its findings will provide useful information on the importance of cybersecurity awareness and the protection of personal information in the university environment.

1. University Students: The study will benefit students by improving their understanding of cybersecurity threats and the importance of protecting personal information when using digital platforms. It will encourage them to adopt safer online practices, including using strong passwords, activating two-factor authentication, avoiding suspicious links, securing their devices, and managing their social media privacy settings.

2. University Management: The findings will assist the management of the University of Lagos in understanding students’ cybersecurity awareness and the challenges they encounter when protecting personal information. It may encourage the introduction of cybersecurity awareness programmes, student orientation activities, digital safety campaigns, and improved institutional data protection policies.

3. Lecturers and Academic Staff: The study will provide lecturers and academic staff with information on the importance of promoting responsible digital behaviour among students. It may encourage the integration of cybersecurity education into relevant academic activities and help lecturers guide students on the safe use of online research platforms and electronic learning resources.

4. Government and Regulatory Agencies: The study will be useful to government institutions and regulatory bodies, particularly the Nigeria Data Protection Commission (NDPC) and relevant cybersecurity agencies. Its findings may support efforts to promote digital safety education, strengthen awareness of personal data protection rights, and encourage compliance with existing cybersecurity and data protection regulations.

5. Cybersecurity Professionals: The study will provide useful information to cybersecurity professionals concerning the security challenges experienced by university students. It may help them develop appropriate awareness campaigns, educational materials, and preventive strategies for reducing students’ exposure to cyber threats.

6. Future Researchers: The study will serve as reference material for researchers interested in cybersecurity awareness, digital literacy, online privacy, identity theft, and personal information protection. It will also provide a foundation for further research on cybersecurity practices among students in Nigerian universities.

1.7 Scope of the Study

This study focuses on cybersecurity awareness and the protection of personal information among university students, using the University of Lagos as a case study.

Geographically, the study is restricted to the University of Lagos, Akoka, Lagos State, Nigeria. It will focus on students enrolled in the institution and will not cover other universities or tertiary institutions.

In terms of content, the study examines four major areas:

1. Students’ level of cybersecurity awareness, including their knowledge of online security threats and preventive measures.

2. Common cybersecurity threats encountered by students, including phishing, identity theft, malware, online fraud, social engineering, and unauthorised access.

3. Personal information protection practices, including password security, two-factor authentication, privacy settings, secure browsing, and responsible sharing of personal information.

4. Challenges affecting cybersecurity awareness and personal information protection, including inadequate cybersecurity education, limited awareness campaigns, poor security habits, and insufficient knowledge of data protection rights.

The study will involve students of the University of Lagos because they are the primary users of the digital platforms and services being examined.

1.8 Operational Definition of Terms

The following terms are defined according to their usage in this study.

Cybersecurity: This refers to the practices, technologies, and measures used to protect computers, mobile devices, networks, digital accounts, and information systems against unauthorised access, cyberattacks, damage, and other security threats.

Cybersecurity Awareness: This refers to the knowledge and understanding students possess concerning cyber threats, online security risks, preventive measures, and responsible digital behaviour.

Personal Information: This refers to information that identifies or can be used to identify an individual, including names, telephone numbers, email addresses, photographs, residential addresses, identification numbers, financial details, and academic records.

Personal Information Protection: This refers to the measures and practices adopted by students to safeguard their personal information against unauthorised access, disclosure, misuse, alteration, or theft.

University Students: These refer to individuals currently enrolled in undergraduate or postgraduate academic programmes at the University of Lagos.

Cyber Threats: These refer to potential malicious activities that may compromise the confidentiality, integrity, or availability of digital information and systems. Examples include phishing, malware, hacking, identity theft, and online fraud.

Phishing: This refers to a fraudulent technique through which cybercriminals use deceptive emails, messages, websites, or other communication channels to trick individuals into disclosing sensitive information.

Identity Theft: This refers to the unauthorised use of another person’s personal information to impersonate that individual or carry out fraudulent activities.

Data Breach: This refers to an incident in which personal or confidential information is accessed, disclosed, altered, or obtained by unauthorised persons.

Digital Platforms: These refer to internet-based applications and services used for communication, academic activities, financial transactions, information sharing, and social interaction.

Password Security: This refers to the practices adopted by individuals to create, manage, and protect passwords against unauthorised access.

Digital Privacy: This refers to an individual’s ability to control how personal information is collected, shared, stored, accessed, and used within digital environments.

Two-Factor Authentication: This refers to a security process that requires two different forms of verification before granting access to an online account or digital service.

Project – Cybersecurity Awareness and Protection of Personal Information among University Students: A Case Study of the University of Lagos.