Differences in IT Security Behavior and Knowledge of Private Users in Germany

Abstract

The German Federal Office for Information Security (Bundesamt für  Sicherheit in der Informationstechnik) offers advice and recommendations for  private users on how to behave securely. Based on these recommendations we  investigate the IT security knowledge and behavior of private users with a rep-resentative study of the German population (N = 1.219). Additionally, we ana-lyze the role of socio-demographic factors (gender, age, education, political ori-entation) for security knowledge and behavior. Results show that German pri-vate users have only moderate IT security knowledge and behavior, with as-pects as gender, age, education and political orientation partly having an influ-ence. Men, higher educated and politically moderately oriented participants  show higher security knowledge, whereas young people and those less knowl-edgeable about security behave less security-conscious. Additionally, security  knowledge and behavior correlate moderately. Therefore, to increase private  users’ IT security we suggest to increase education and training especially for users being young, politically right-wing or female.

Introduction

With the advancing digitalization more than 90% of Germans currently use the Inter-net and share an increasing amount of data – including sensitive data – which needs to be protected [1]. The importance of IT security1 is illustrated, for example, by  Deutsche Telekom (Europe’s largest telecommunications company) reporting 46 mil-lion attacks on their honeypots in April 2019, an increase of 12 million and 4 million  attacks respectively compared with the years 2018 and 2017 [2]. In 2017 the German  Federal Criminal Police Office (Bundeskriminalamt) recorded around 86.000 inci-dents of cybercrime, 4% more than in 2016, and a total damage in excess of  71 million euros with an increase of 54% on mobile malware [3]. This shows the  increasing threat to security.

One reason for this is the disuse or improper use of security mechanisms and thus  the need for an extended security knowledge and behavior for all users, including  private users. In order to contribute to security in Germany, the Federal Office for  Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI)  offers advice for German citizens on how to secure their computer, smartphone and  online generated data which we used as the basis for our questionnaire [4]. A repre-sentative study by the BSI in 2017 showed that 97% of German Internet users consid-er security to be very important but only a third of Germans specifically inform them-selves about security [5]. Just 75% use anti-virus software, 45% of Germans care  about the secure transfer of personal data and only 37% install updates right away [5].  Hence, similarly to the frequently studied privacy paradox (e.g. [6-8]), a security  paradox seems to exist, as users claim to care about their security, but do not inform  themselves about it and thus do not act accordingly. Therefore, security knowledge  and behavior might not correlate, as security knowledge might not translate into be-havior. Furthermore, the study by the BSI found that 59% of participants state to have  never been victims of cybercrime and that only about 19% of those affected by cyber-crime filed a police complaint [5]. According to the BSI, the actual number of cyber-crimes is much higher than the reported numbers [5]. This underlines the ambivalent  behavior of people concerning security and shows that not all attacks and crimes are  recorded, especially when it comes to private users. Additionally, some studies have  lately suggested that security behavior differs regarding demographic aspects such as  age and gender [9-11] and call for more research on security behavior [12, 13].  

In order to check if the described lack of IT security knowledge and behavior still  exists and to identify which groups of people show how much security knowledge and  behavior we aim to investigate the security knowledge and behavior of Germans in  2019 regarding the demographic factors age, gender, education and political orienta-tion. We therefore raise the question: How do different subgroups of private users (e.g. gender, age groups) differ in their security knowledge and behavior?   To address this research question, we conducted an online study representative for  the German population with 1.219 participants. In the following sections related  works are presented, followed by the hypotheses and the used methods. After illus-trating the results, we discuss our findings.