Exploring Age and Gender Differences in ICT Cybersecurity Behaviour

Abstract

Known age differences exist in relation to information and communication technology (ICT) use, attitudes, access, and literacy. Less is known about age differences in relation to cybersecurity risks and associated cybersecurity behaviours. Using an online survey, this study analyses data from 579 participants to investigate age differences across four key cybersecurity behaviours: device securement, password generation, proactive checking, and software updating. Significant age differences were found; however, this is not a straightforward relationship. Older users appear less likely to secure their devices compared to younger users; however, the reverse was found for the other behaviours, with older users appearing more likely to generate secure passwords and show proactive risk awareness and regularly install updates. Gender was not a significant predictor of security behaviour (although males scored higher for self-reported computer self-efficacy and general resilience). Self-efficacy was identified as a mediator between age and three of the cybersecurity behaviours (password generation, proactive checking, and updating). General resilience was also a significant mediator for device securement, password generation, and updating; however, resilience acted as a moderator for proactive checking. Implications of these findings are twofold: firstly, helping to guide the development of training and interventions tailored to different cybersecurity behaviours and secondly informing cybersecurity policy development.

The Use of Digital Media and Security Precautions in Adulthood

“…In the first part of the results section, we report the bivariate correlations and focus on the relationship between use of digital media, security precautions, and technology commitment, flexible goal adjustment, and age. 1) replicate the finding from an earlier study [10] in which age was a positive predictor of security precautions (password generation, proactive checking, and updating). They show the expected negative association between the use of social networks and age, but emailing/surfing was positively associated with age.…”

“…Few studies focused on age differences. Positive age correlations were found for all domains except for device securement [10], but the effects were only small or modest. A study on online privacy perception showed that older adults reported a significantly higher awareness of privacy than younger users and protected their data more actively [16].…”

“…Contributing to the fast adoption of digital media among younger generations is the implementation of new technologies in lessons and schools. Older adults may lack motivation, openness to innovation, or confidence in their abilities [10][11][12]. Studies on age differences have shown that older adults have greater anxiety about using new technologies and are less confident in their abilities to learn about new technologies [13].…”

“…Given the increased frequency of use, a potential problem for all age groups arises in regard to cybersecurity. Studies on age differences in the vulnerability to threats (e.g., to phishing attacks) are still scarce and not conclusive [10]. In the following article, we refer to security precautions as self-reported adherence to computer security advice [3].…”

Informational inequality: the role of resources and attributes in information security awareness

“…Researchers have focused on how personality characteristics, such as the tendency to be impulsive, may be associated with more risky online behaviors and therefore present an opening to attacks (Hadlington, 2017). Other work focused on age and gender has examined whether individuals engage in certain secure practices and found that older individuals were less likely than others to secure their devices but more likely to generate secure passwords and update their devices and no differences by gender (Branley-Bell et al , 2022). While the findings are important, as they highlight the utility of understanding public cyber behavior, they do not offer insight into the extent to which public users are objectively aware or knowledgeable about secure cyber techniques nor does it explore other demographics such as education and income.…”