Lived Experiences, Challenges, and Coping Mechanisms of Undergraduate Students on Cybersecurity in Digital Environments

Abstract

Higher education students use digital devices for learning, entertainment, and financial transactions. The present study examines undergraduate (UG) students’ challenges faced in cyber security space amid digital environments. The study employed a qualitative research design with a narrative inquiry method to capture the lived experiences, challenges, and coping mechanism of UG students through semi structured interviews. The researchers analyzed the qualitative data of ten UG students using the inductive thematic analysis method. UG students shared overall that they face varied experiences, multiple challenges, and cope with cyber security issues in multiple ways. Findings from the study led to recommendations for stakeholders, which includes designing higher education classes in a more secure way. This may offer students orientation on cybersecurity knowledge which keeps them safe and helps them understand the digital environment overall.

Keywords:

• Cybersecurity
• digital learning
• digital safety
• incognito mode
• online privacy

1. Introduction

Currently, we are experiencing what is often referred to as the new “normal” for digitalization (De Laat & Dohn, 2019). This has resulted in an increase in the number of individuals using internet services and digital devices in their day-to-day lives. As of 2023, there are more than 692 million active internet users in India, with more than 460 million social media users (Kemp, 2023). While there are numerous benefits associated with these developments, they may also lead students into vulnerable situations, especially those with limited understanding of cyber security and digital literacy. Cyber-attackers are constantly looking at ways to infiltrate systems with a ‘lack of awareness’ and with flaws in application security (Jones & Chin, 2015). Cybercriminals utilize software and other means to hack into computers, mobile phones, and networks, making our cyber security vulnerable (Abawajy, 2014).

In recent years, there has been an increase in the use of mobile phones, which has positioned them as a common tool for communication, teaching, and learning in students’ lives (Siapera, 2017; Vanden Abeele, 2016). This trend is accompanied by an increasing demand for smartphone usage among the younger generation, who often overlook the importance of security on their devices (Alothman et al., 2017; Mi et al., 2020). This leaves the data on these devices vulnerable to hacking (Allam et al., 2014). Students frequently use publicly-accessible WI-FI through their mobile devices, including at their university, which makes the network more prone to risk and cyber-attacks regarding sensitive data (Yuan et al., 2016). Moreover, students are also frequently negligent in logging out of their devices and applications, refrain from adding passwords to their devices, and download applications from unknown sources (Jorgensen et al., 2015; Yuan et al., 2016). These practices put students at risk of cyber-attacks, and further suggest a lack of cyber security awareness (Jones & Heinrichs, 2012).

The contemporary cyber risks faced by emerging adults in the twenty first century are cyberbullying, social media, sexting, cyber-dating violence, scams, catfishing, and revenge porn (Paat & Markham, 2021). Bullying is another problem that must be addressed (Eyuboglu et al., 2021), necessitating the need for constant policies to mitigate its effect (Hatzenbuehler & Keyes, 2013), given its association with various health-related issues (Wolke & Lereya, 2015). While bullying is often seen in the traditional classroom setting (Hemphill et al., 2014), it can also manifest in virtual setting. This is known as cyberbullying (Canty et al., 2016). Lower levels of digital literacy results in failure to differentiate between digital scams and legitimate messages (Sarno & Black, 2024). Between the research and lived experience of youth, there is no doubt that they are at risk for cyberbullying attacks, which can lead to psychosocial distress, emphasizing the need for impactful training and awareness initiatives to mitigate these risks. Given the current reality and risks to students, there is a need for digital citizenship education, especially with a particular focus on cyberbullying (Prakasha et al., 2024). Although cyberbullying has existed over the last two decades, it has significantly increased in the post-pandemic times (Barlett et al., 2021; Zhu et al., 2021). Students are learning in digital environments and facing cyber security issues almost every day (Ulven & Wangen, 2021).

As such, a recent longitudinal study has also shown that regular digital literacy trainings is more effective in preventing falling prey to phishing attacks (Nguyen et al., 2023). Students often perceive the digitalized environment has coerced them into regularly engaging in digital processes (Dutt, 2023), and schools too can be a target of cyber-attacks (Langreo, 2023; Waldman, 2023). Internet consumption is an everyday occurrence for most youth; who consume social media and digital technologies at an early age (Livingstone et al., 2011; Winther, 2017), often without realizing the potential threats (Corradini & Nardelli, 2018). This includes sharing images and personal data, highlighting the need for cyber security awareness in schools (Schilder et al., 2016). A meta-analysis from Quayyum et al. (2021) analyzed 53 articles addressing privacy, cyberbullying, and inappropriate display of content as some of the potential risks faced by children (Paat & Markham, 2021). Therefore, creating awareness at an early age would greatly benefit students; this can be achieved by using text-based, video, or game-based pedagogy in classrooms (Alharbi & Tassaddiq, 2021). For example, Hart et al. (2020) suggested gaming as a tool to promote cyber security awareness. As another example, Al-Tawil (2024) advocated ethical hacking be taught to students to combat cyber security, alongside gaming for students to learn and engage in developing their cyber security skills and mastering the concepts (Trickel et al., 2017). Thus, we contend that ‘cybersecurity’ awareness and training against cyber threats should be implemented within institution (Green, 2015). Often, individuals within organizations contribute to its vulnerability to threats, with many concluding that ‘people’ are the most vulnerable factor in cybersecurity or posing the greatest threat (Safa et al., 2016). Cybersecurity awareness programs are necessary to bridge the gap between people and digital technology (Isabella Corradini, 2020). While many software options are employed to prevent cybersecurity breaches, they do not provide complete protection from all threats (Furnell et al., 2006; Parsons et al., 2014; Schultz, 2005). Additionally, new tools like ChatGPT raise concerns about malpractices in education (Lodge et al., 2023), which continue to create challenges in the academic sector (Hsiao et al., 2023). But in some cases, AI integrated into different fields has also created solutions to cybersecurity (Hammad et al., 2019; Sarker et al., 2021), such as using machine learning and deep learning to prevent cyberattacks (Al-Hawawreh et al., 2024; Farah et al., 2022; Xin et al., 2018). In addition, Khader et al. (2021) has proposed a cybersecurity awareness framework that colleges and universities can use to improve awareness.

Cybersecurity behavior is explained by scholars mainly using three theories: deterrence theory, protection motivation theory (PMT), and the theory of planned behavior (TBP) (An et al., 2023; Rogers, 1975). Deterrence theory suggests that negative interactions, in the form of punishments, can control cybersecurity behaviors (Ameen et al., 2021). TPB with three domains, including individual attitudes, subjective norms and perceived behavioral control, is also used for cybersecurity-related behavior (Dinev et al., 2007). PMT considers that motivation to protect comes from one’s perception of threat and one’s assessment to cope with such threats to ensure minimal harm from the threat (Hong et al., 2024). PMT is also widely used in the area of cybersecurity behavior (Chen et al., 2016) that considers that the protecting motivation is generated from threat appraisal and coping appraisal (Hong et al., 2024).

De Kimpe et al. (2021) highlighted the inverse relationship between feeling well informed about online safety and the inclination to adopt security measures, alongside the positive association with perceptions of cybercrime severity. Moreover, Tsai et al. (2016) emphasized the importance of coping appraisal variables and security coping factors, respectively, in predicting intentions to engage in protective behaviors. Furthermore, van Bavel et al. (2019) underscore the effectiveness of coping messages in promoting secure behavior, suggesting their prioritization in interventions. Compliance Theory can be applied to understanding individuals’ behaviors regarding online security practices such as complying (or not) with policies pertaining to cyber security at an individual level, organizational level, or at government deployed regulations (Salifu & Abdul, 2023).

A study conducted by Alsiddig et al., 2020 showed that students generally exhibit lower levels of security awareness compared to faculty members. Despite recognizing the importance of cybersecurity, students often fail to apply the same level of awareness when creating passwords (Alqahtani, 2022). Studies have shown that insufficient awareness can make users more vulnerable to potential threats (Al-Khater et al., 2020; Garba et al., 2020; Griffin, 2019). Additionally, a study by Matyokurehwa et al., 2021 highlighted the importance of cybersecurity in combating social engineering malware, social engineering, malware attacks, and the IoT (Internet of Things) attacks. Initiatives to create awareness among college students to better detect malware and promote cybersecurity awareness are crucial as digitalization continues to expand.

Due to the current threats highlighted above, this study aims to understand the positive and negative cyber experiences among UG students and the challenges they face while engaging in learning in a digital environment. The study further attempts to describe the coping mechanisms used by students to effectively manage the cyber security threats.

2. Method

Since there are both positive and negative experiences of cybersecurity phenomenon affecting the psychosocial wellbeing of people (Clandinin & Connelly, 2000; DeJonckheere & Vaughn, 2019), researchers have qualitative study design involving narrative inquiry. Narrative inquiry, as a method, elicits the lived experiences of participants through semi-structured interviews (Caine et al., 2013; Figgou & Pavlopoulos, 2015). Additionally, given that the cybersecurity phenomenon has affected the primary care (mental health) of individuals, in-depth interviews will help better understand the context (DeJonckheere & Vaughn, 2019). Accordingly, this approach was used in the study with narrative interviews undertaken to garner information on positive, and negative cyber experiences of UG students and the coping mechanisms they employed while in a digital environment. Thematic analysis of interview data captured the experiences and perceptions of the participants.

2.1. Participants

Researchers utilized the snowball sampling technique to invite ten undergraduate students to participate in this study (Wright & Stein, 2005). The participants were from eight different University colleges located across Bangalore, India. Out of the ten participants, five are male and five are female. The participants are studying mostly in their second year or final year with various subject streams from sciences, commerce, and Humanities. The participants’ age ranged from 20 to 23 years. Table 1 below summarizes the demographic details of the participants who agreed to participate in the study. Participants were assigned with pseudonyms P1, P2, P3, to P10 to ensure data privacy.

Table 1. Participants’ demographic details.

Participant	Gender	Age (Years)	UG program
P1	M	20	BSc
P2	F	20	BA
P3	F	21	BCom
P4	M	22	BCom
P5	M	21	BBA
P6	F	20	BSc
P7	M	22	BBA
P8	M	21	BSc
P9	F	23	BA
P10	F	20	BCom

Note: BSc – Bachelor of Science, BA – Bachelor of Arts, BCom – Bachelor of Commerce, BBA – Bachelor of Business Administration, M – Male, F – Female.

2.2. Data collection procedure

Researchers employed a semi-structured interview technique to gather data. At the outset of the face-to-face interview, the interviewer explained the purpose of the research and sought oral consent before asking any questions. Next, to establish rapport, the interviews were conducted in a free and fair setting, with participants given the option to withdraw from the interview if they felt socially uncomfortable sharing information at any time. The interviewer also gathered the demographic characteristics of each participant during the interview. Table 2 below outlines the interview questions used to elicit in-depth responses from each participant, each asked in a sequential manner. Responses were digitally recorded. Researchers transcribed the audio files for the purpose of data analysis and stored both audio files and transcript in a password-protected file.

Table 2. Semi-structured interview items.

What are your positive experiences on cyber security in a digital environment? Share few instances. What are your negative experiences on cyber security in a digital environment? Share few instances. What are the cyber security challenges you face while working in a digital environment? Explain few major challenges. What are the coping mechanisms followed by you while facing cyber security challenges? Explain a few of the best coping mechanisms you adopted.

2.3. Ethical considerations

Researchers obtained institutional review board (IRB) permission from the University before conducting the study. Informed consent was also obtained from each participant before conducting the interviews. Further, the researchers assured each participant that the data collected would be kept confidential and only used for the research and publication purposes.

2.4. Data analysis procedure

The present study adopted the procedures of narrative thematic analysis for the collected interview data. Narrative inquiry provides an opportunity to express the lived experiences of participants through semi-structured interview techniques (Caine et al., 2013). When narratives take a dialogic form and emphasize the why, who, and what of a phenomenon (Rodriguez, 2016), they offer valuable insights. Inductive thematic analysis is well suited for the present study, as the themes and sub-themes emerge directly from coding procedures rather than from a theoretical background (Mihas, 2023). In addition, thematic analysis of interview data captured th experiences and perceptions of the participants.

We carried out the data analysis through the following steps.

• Researchers read the interview transcripts several times to become familiar with the content. This helped them to understand participants’ thought process and impressions.

• Researchers produced a few initial code words directly from the data transcripts that represented significant ideas, concepts or patterns.

• Researchers started to search for connections between the code words with similarities, overarching ideas, implicit ideas, and differences. This exercise uncovered the main themes from the data.

• Researchers revisited the main themes several times to confirm whether it truly emerged from the data transcripts, and modified, merged, or split into sub-themes wherever necessary.

• Researchers defined the main themes and sub-themes accurately with consideration to the main concepts and ideas captured in the data.

• Researchers organized the themes and sub-themes in logical order. Table 3 in the result section of this paper presents the themes and sub-themes.

• Researchers carefully selected excerpts from the transcripts that were connected to the main and sub- themes.

• Researchers ensured rigor and trustworthiness of the evolved themes, sub-themes, and excerpts via peer feedback and member checking methods.

• Researchers’ selected two participants randomly to member check the descriptions.

• Lastly, the researchers wrote the findings and discussion sections of the paper connecting valid supporting evidence from the earlier research, excerpts, and theoretical frameworks.

Table 3. Showing interview parts and the emerged themes and subordinate themes.

Major interview parts	Themes and subordinate themes
Lived experiences of UG students	Navigation, awareness, and incidents Balancing security vs. inconvenience Lack of orientation on cybersecurity Cybersecurity threats in academic settings Psychological impact of cybersecurity incidents
Challenges faced by UG students in cybersecurity	Addressing and managing cybersecurity issues Limited access to resources and tools Cybersecurity skills Navigating complex regulatory compliance requirements Managing cybersecurity threats and responses Balancing academics and cybersecurity responsibilities
Coping mechanism employed by the UG students	Safe browsing skills and patience Seeking Social or peer support Continuous learning and skill development Utilizing technology tools Exercise self-control Engaging in relaxation techniques

3. Results

As planned, researchers addressed the research questions; (i) what are the positive and negative cyber experiences among UG students, (ii) the challenges they faced while engaging in learning in a digital environment, and (iii) the coping mechanisms they used to manage the cyber security threats through qualitative approach and analyzed the qualitative data using the narrative thematic analysis. Table 3 below presents the results from the narrative thematic analysis in terms of major themes and subordinate themes.

Researchers conducted the interview in three sections sequentially since the research questions included questions on lived experiences in the first part, the second part was focused on challenges, and the third part was focused on coping mechanisms. The detailed explanation of the themes, subordinate themes, and relevant excerpts from the interview transcripts are presented below.

3.1. Lived experiences of UG students

3.1.1. Main-theme 1: Navigation, awareness, and incidents

Participants shared that navigating privacy concerns has been a challenge for them. Many shared that they do not understand whether they should accept cookies, partially accept them, or reject all cookies. Most participants were not even aware of what cookies are. Additionally, many participants reported instances where their private data was available, yet they lack an awareness on how to protect it. For instance, they expressed uncertainty regarding Facebook’s privacy policies, including managing their public profile, locking the profile, and understanding the privileges of the account holder.

P6: Why almost for every new web page I am trying to browse I must accept cookies…

3.1.2. Sub-theme 1.1: Balancing security vs. inconvenience

Most participants mentioned the inconvenience of identifying the risks associated with various online websites and social media platforms. They expressed difficulties in managing their personal information online while protecting it from malicious actors, handling online account credentials, and managing social media accounts. Some participants mentioned that while verification processes used by many online sites seemed good, they could also be annoying at times.

P2: my computers log out and ask for SSL certificate authentication…

P9: […] …on you tube I get this message keep the ads, remove add…Skip and selecting any of these still force me watch an ad…

3.1.3. Sub-theme 1.2: Lack of orientation on cyber security

Participants shared that they began using email, social media, and online websites without receiving any orientation on cyber security. As their subscriptions to various apps, software, and web pages increased, they began receiving multiple verification, authentication, and fraudulent emails. They expressed uncertainty about whether they should agree to the terms and conditions outlined by various social media accounts, or if it was acceptable to deny them. The majority of participants accepted every condition put forth by a website or webpage without knowing their prerogatives or understanding the implications of what they had agreed to.

P6: I am annoyed, why is this asking OTP and verification code…

P3: […] …how many passwords I must remember, omg…

3.1.4. Sub-theme 1.3: Cyber security threats in academic settings

Participants shared that they regularly get received phishing emails to their college email address. Further, they stated that AI enabled social media platforms or webpages often seem to know exactly what they want to buy, search for, or even consider purchasing online. Consequently, they feel their personal data has been stolen without their permission, and they unsure how this occurred. Some participants recounted personal experiences of ransomware attacks and financial losses. They further expressed concerns about widespread cyberbullying affecting them and others, admitting they are unsure how to protect themselves from such harassment. This includes how to protect themselves from loan lending information, online-dating scam, fraudulent work from home opportunities, coercion into gambling, human trafficking, and many more threats.

P2: I feel something fishy here, what is in my mind is appearing on my mobile screen…

P8: I am getting online work from home job offers everyday…are they even real? […].

3.1.5. Sub-theme 1.4: Psychological impact of cybersecurity incidents

Most of the participant shared that privacy concerns and the fear of identity theft have led to experiences of anxiety and stress, leading to constantly living with a sense of insecurity. Many even resorted to antidepressant medication to with depression resulting from these negative emotional states. Additionally, some participants mentioned instances where their friends are being blackmailed due to various forms of online victimization, leaving them fearful that they too could become victims at any time.

P1: I feel I am forced…even though I am not interested…

P6: I am unable to focus on any work nor on my studies…

One participant mentioned an experience where an anonymous user threatened to share manipulated photos unless they paid money and performed a humiliating task. The participant felt tremendous emotional distress and demanded secrecy over the fear of social consequences.

3.2. Challenges faced by UG students in cyber security

3.2.1. Main-theme 2: Addressing and managing cyber security issues

One of the greatest challenges for college students in the twenty first century is managing their presence online without breaching any personal data. Most students have a presence on various social media platforms, application software, and mobile apps, and maintain multiple online accounts for different interests and needs. While most participants cited the importance of verification systems to protect their personal information and safeguarding against bullying, thy also found these systems to be annoying and hindering their efficiency in completing tasks. Many participants expressed the sentiment that while security checks are good, they can sometimes be excessive. A few participants mentioned inconvenient instances where they were forced to sign-up for several unwanted webpages and mandatory apps downloads just to access reading materials and to download a reading material.

P1: I feel I am forced…even though I am not interested…

P6: …I am wasting my time verifying these checks…

3.2.2. Sub-theme 2.1: Limited access to resources and tools

Most participants mentioned that they never received any opportunities to learn online-safety skills and competencies needed to protect themselves on online platforms. Many participants talked about using various application software, social media platforms, and online-learning platforms without much knowledge on their origins, authenticity, and overall trustworthiness. They also admitted to lacking knowledge about incognito mode, safe-mode, malware, firewall, Captcha, and anti-theft protection features. Most participants had never used tools related to cybersecurity. However, four participants were aware of specific software they could use to protect their personal information, such as Wireshark, Metasploit, Aircrack, Hashcat, Burpsuite, Nessus Professional, Snort etc.

P3: …why is my browser asking use Incognito mode…what is it? …

P8: …I know Aircrack…my dad uses it…

3.2.3. Sub-theme 2.2: Cyber security skills

Participants shared that they would benefit from a course in learning cybersecurity fundamentals, which could include topics such as creating safe passwords, implementing safe login protocols, understanding web cookies and encryption protocols, principles of network security, and adopting secure coding practices. In addition, they emphasized the need for knowledge in areas like online banking, identification of financial-scams, recognize swindlers, and understand embezzlement.

P5: …why my password must be 8 characters in length and must have…alpha numeric?

P10: …I really need someone to teach me on cyber safety skills…

3.2.4. Sub-theme 2.3: Navigating complex regulatory compliance requirements

Participants are not aware of cyber compliance policies at their institutions, which are intended to safeguard their privacy. Most participants found the multiple verification systems annoying, reporting that these systems slow them down when using online platforms. Students in India are not aware of digital personal data protection act (DPDPA) passed by Government of India. None of the interview participants was familiar with the Health Insurance Portability and Accountability Act (HIPAA). Even when installing banking apps, participants admitted to clicking “continue” and agreeing to everything asked of them. Yet, they continued to use both online banking and mobile banking services.

P2: …I do not know what HIPA act is…nor any policy…

P9: …I use pirated version of the window…thus… it asks for certificate verification…

3.2.5. Sub-theme 2.4: Managing cybersecurity threats and responses

Most participants in the study expressed their inability to identify what is cyber security breaches, necessary security compliances, and credible threats. They struggled with responding to timely verifications such as OTPs, CAPTCHA, etc. Many participants reported to having no understanding of concepts like two-factor verification or multifactor verification, despite spending many hours online every day. Related to this, adolescents’ personal data is at significant risk, with reported suicide incidents attributed to online activities, and much of the cybercrimes going unreported. Parents and teachers have limited knowledge of how students are using their devices and how to protect those (Alharbi & Tassaddiq, 2021).

P7: …My parents don’t understand computers…social media…

P4: …once I almost lost my money…luckily escaped…thanks to my friends…

3.2.6. Sub-theme 2.5: Balancing academics and cyber security responsibilities

Most participants mentioned that resources for learning about technology integration, online safety, and cyberbullying are available. However, accessing the contents is tedious and takes considerable time to find valuable resources. Some students also admitted they would rather spend their time on social media than learning about online safety.

Furthermore, participants generally lack awareness of copyrights and creative commons licensing. Many of them shared that they prioritize access to content and material over ensuring they are obtained legally or through institutional IDs. Some websites trick users into downloading unwanted software and application apps, leading participants to lose precious study time as they navigate through new tabs without understanding why they lost track of their original search

P3: …how do I know, which is the authentic learning material…

P6: …what is creative commons… […] …I don’t know where I am redirected to…

3.3. Coping mechanism employed by the UG students

3.3.1. Main-theme 3: Safe browsing skills and patience

Participants mentioned that they have never received any professional training on how to handle cybersecurity issues if they occur. If they are a victim of a cybersecurity threat, they reported dealing with it through trial and error. Most shared that they searched for information to determine the best way to address a cybersecurity issue when it arose. They (students) frequently stated that people need patience to proactively navigate security compliance and to ‘de-bug’ themselves from an unhealthy cyber security incident. However, when they took the time, they admitted to acquiring several skills, such as knowing when to accept cookies or verification codes on mobile devices.

P1: …I did not go to institute to learn browsing on the net…

3.3.2. Sub-theme 3.1: Seeking social or peer support

Most participants indicated that they would turn to their friends to understand a specific cybersecurity issue, as many had similar experiences and could offer some guidance on how to resolve it. Peer support seemed to work well for those that had experienced a cybersecurity issue. This included how to best navigate through cybersecurity compliance steps, as well as social and emotional issues, cyber bullying, cyber frauds, malicious emails, etc.

P8: I just ask my friends to trouble shoot…

3.3.3. Sub-theme 3.2: Continuous learning and skill development

Another coping strategy shared by participants was ongoing learning aimed at being proactive against cybersecurity threats. Participants reported learning frequently from resources such as Google Chrome help center and Microsoft Edge support. Specific resources from these sites included how to avoid subscribing to malicious application software and avoiding phishing emails. Some participants offered that after online training, they began implementing practices such as cleaning their desktop occasionally, clearing browsing history, setting up cookies, blocking and allowing certain websites, addressing certificate issues, dealing with piracy issues and illegal sites, navigating creative commons licensing, accessing open educational resources, and managing spam options.

P6: I read up as and when I face issues…

3.3.4. Sub-theme 3.3: Utilizing technology tools

Several participants mentioned that they have subscribed to antimalware to protect themselves from breaches of personal data. Many were using free antimalware programs such as Norton, Avira etc. However, many purchased antimalware such as Kaspersky, McAfee, etc. They further shared that there are several open resources available to support cybersecurity, such as Aircrack and Burp Suite.

P3: my computer has windows defender by default…I do not buy any…

3.3.5. Sub-theme 3.4: Exercise self-control

Another simple coping mechanism recognized by most participants was exercising self-control. It is they acknowledged that it is within an individual to understand whether a particular online source subscription is necessary or not. If needed, they must comply with cybersecurity credentials. Some participants admitted to being careless about sharing their personal information or account details. Others expressed innocence and confusion regarding what, how much, to whom, and where to share such information. The reason for rampant online theft, swindling, and fraud, is due to lack of knowledge about these fundamental questions among millions of people.

P8: …I believe in prevention is better than cure…

P6…omg…I just gave all my details to an account, and now it shows 404 error…

3.3.6. Sub-theme 3.5: Engaging in relaxation techniques

Participants offered that many UG students are addicted to several social media sites such as Instagram, Facebook, Snapchat, YouTube reels, etc. Thus, they tend to be careless about their data privacy and cybersecurity compliance on these platforms. Some mentioned that when they or their peers become frustrated or caught up with security issues and cyber bullying, they resort to relaxation techniques such as listening to soothing music, performing yoga exercises, meditation, breathing exercises, going for a walk, = swimming, or a Tea break. A recent study by Prakasha et al. (2023) supports this view and offers similar coping strategies.

P4: …I just go for a walk…after working more hours on the net…

P6: I do meditate regularly…however physical exercise not much…

4. Discussion

In this study, researchers highlighted both the positive and negative lived experiences of cybersecurity issues among UG students. The findings are transferable to other undergraduate students and university settings. The main theme that evolved from the lived experiences of UG students was the lack of navigation skills and lack of awareness about potential cybersecurity issues, leading to vulnerability to cyber bullying incidents (Craig et al., 2020).

Many studies have shown that cyber bullying often originates in primary school (Rodríguez-Álvarez et al., 2019). This study confirmed that it remains a negative lived experience for undergraduate students as well. The themes identified in this study confirm the challenge of balancing safety needs while accepting the inconveniences associated with cybersecurity compliance. Participants expressed how these efforts were often stressful. A recent study by Saeed A Alqahtani, & Erfani et al. (2021) further substantiates this observation among college students more widely.

The findings of this study clearly emphasize the need for orientation programs for all students to address cybersecurity threats and their nuances. A study by Aderibigbe and Ocholla (2020) found similar outcomes to those uncovered in this study. One program that may be useful is the respect, educate, and protect (REP) model, which highlights ways to include elements of digital citizenship within college-level classes (Curran & Ribble, 2017; Marinho & Carneiro, 2018; Ribble, 2015). The narratives shared by participants validate the increasing cases of phishing emails and instances of data theft. The recent study by Dharmavaram (2023) also found a rise in ransomware attacks on educational campuses, highlighting the imperative for universities to implement strong antimalware software tools to safeguard student data.

This study further revealed the psychological effects of cyber bullying and victimization on students. This often led to higher feelings of anxiety, stress, and depression. A recent study supported this phenomenon (Gohal et al., 2023). On the positive note, participants expressed a growing need for cybersecurity professionals and future job opportunities in the field. Alzahrani (2021) echoes this idea of future job opportunities in cybersecurity in a recent study. Upon graduation, undergraduates may play a role in improving cybersecurity programs for future generations of students.

Undergraduate students face several challenges with respect to cybersecurity within a digital learning environment. One of the major ongoing challenges unveiled in the study was students struggle to cope up with the constantly evolving nature of cyber security threats. Malicious actors create new ways to invade privacy every day, and even updated antimalware cannot always detect them. A study by Radhika et al. (2023) confirmed that regular threats have become a common experience for undergraduate student experience at most institutions.

Another major challenge unveiled from this study is the limited access to cybersecurity resources, technology tools, and training opportunities that could offset some risks and be proactive in developing key skills among undergraduate students. Recently Khamzina et al. (2022) expressed a similar argument, providing data on the resources available to increase cybersecurity.

Further, navigating through complex regulatory compliance requirements poses a challenge for many UG students. They lack an awareness of related policies, and therefore are unaware of compliance standards. A study by Stewart (2022) reveals the same is true for most undergraduate students. Students struggle to understand the subtle differences among secure coding practices, encryption protocols, and network security principles. Students regularly fail to recognize true cybersecurity breaches and struggle to trouble shoot such instances if they occur. Hewitt and White (2022) pointed out similar security incidents and the lack of awareness in how to deal with them. To complicate the issue, students pointed out that adhering to security compliances takes considerable time, detracting from valuable time to study. Participants recommended the need for efficient cybersecurity resources to comply with the regulatory bodies and networks. Duzenci et al. (2023) made similar observations in their study, outlining the ongoing issues and confirming the need for efficient resources to understand how to be safe in a digital environment.

The study revealed that students usually turn to their friends for help when trouble shooting cybersecurity compliance issues or dealing with malicious actors and fraudulent calls. Participants from this study offered five to six distinct coping mechanisms to manage cybersecurity issues that others may face. The first approach to dealing with cybersecurity issues is to stay current with the ongoing changes in digital learning environments and the resources available to combat cybersecurity threats. Further, participants recommended specific technology tools to handle the cyber issues if or when they arise. However, to avoid being a victim altogether, participants emphasized the importance of individual self-control and mindfulness for safe browsing. The latest book by Jarjoui (2023) also discusses similar coping mechanisms as those stated by participants in this study.

Many participants shared coping mechanisms that worked for them in addressing the ongoing stress that comes with working online. Relaxation techniques was the most commonly cited coping mechanism. Lodha (2022) mentions similar techniques in her study. Lifestyle management is key to maintaining a hygienic digital environment. A recent study also suggests that keeping devices safe with supporting apps, VPNs, updated credentials, and antivirus software are other ways to manage a safe and secure online workspace (Chakraborty et al., 2022).

5. Conclusion

This study captured participants’ lived experiences to understand the positive and negative cyber experiences they encounter as undergraduate students. The study further explored participants’ cybersecurity challenges while engaging in a digital learning environment. The findings emphasize the need for cybersecurity awareness, skill development and more efficient cybersecurity technologies to address threats. By addressing these key areas, undergraduate students could potentially have more time to devote to their studies and experience improved mental health. Findings from the study also offered some coping mechanisms students leveraged to navigate the cybersecurity space.

However, it is important to note that the present study was limited to exploring cybersecurity experiences among undergraduate students in India. Cyber insecurity experiences and incidents are too diverse, thus capturing all aspects in a single study proved challenge. Further, these experiences can be deeply personal and difficult to share, leading to an unintentional bias affecting the findings of the study. As technology continuous to play an increasing role in digital learning environments, and with the increase in fraudulent activities, incentivizing participants may yield more nuanced experiences and insights, thus aiding in addressing cybersecurity threats. Interdisciplinary studies are needed to understand the growing concern of cybersecurity issues. Further, this study gathered data through interviews to explore the research questions. Researchers suggest future research could explore in-depth case studies pertaining to cyberbullying, ransomware attacks in universities, and fraudulent activities on social media platforms to gain deeper insights into these specific areas of concern.

Acknowledgements

Sincere thanks to all the participants for their participation and cooperation throughout the study.

Disclosure statement

Authors have no competing interest.