The password practices that users apply have a direct effect on the level of security of computer systems. While certain password users are proficient in their password practices, proper security measures and guidelines are often ‘unknown, neglected, or avoided’ by other computer users (Notoatmodjo & Thomborson 2009:71). Garrison (2008:70) determined that many computer users are ignorant and uninformed about how to select usable and secure passwords. In addition, many computer users are unaware of their vulnerability and the possible consequences associated with improper password use and control. Chandarman and Van Niekerk (2017:134) regard the untrained user as one of the weakest links in a security system.

Security should be a foremost concern when creating new passwords (Huth, Orlando & Pesante 2012; Zhang-Kennedy, Chiasson & Van Oorschot 2016). Ominously, human memory limitations place a strain on computer users’ memory and they experience difficulties in remembering numerous passwords (Furnell & Esmael 2017:5; Shen et al. 2016:131). Notoatmodjo and Thomborson (2009:71) refer to this as ‘password overload’, a term widely used in the literature, which often results in weak password behaviour. Yan et al. (2004:25) found that many users rarely choose passwords that are both hard to guess and easy to remember. A conflict between two opposing principles, convenience (memorability and usability) and security, therefore, exists.

Kothari et al. (2015:15) reasoned that password practices encompass the measures that computer users apply when choosing or creating passwords (which involves aspects such as the origin of the password and the characters used in its composition), as well as managing passwords (measures that relate to the safekeeping of passwords). Groupings of common proper and improper password practices that were the topic of various studies are presented in Table 1.

Although authors propose that interventions should focus on the educational requirements of particular target audience groups, they do not explain how to design custom-made SETA interventions. As ‘very few’ studies focussing on computer security awareness in South Africa have been conducted (Chandarman & Van Niekerk 2017:136), the extent to which SETA programmes should focus on the proper password practices in Table 1 remains somewhat elusive in academic literature.

Research into computer security often focusses on ‘particular user communities’ and does not necessarily report on the effects of demographics, despite the fact that basic demographic information is often obtained, and commented upon, in these studies (Howe et al. 2012:210). Some studies commented on notable differences between different demographical groupings for security in general, not passwords in particular.

While McCormac et al. (2017:152) noted small differences in individuals’ information security awareness and their age and gender, Pattinson et al. (2015) found that gender has no significant influence on information security behaviour but that age seems to improve secure behaviour. Sheng et al. (2010) found minor variances between males and females and different age groups regarding susceptibility to computer security threats such as phishing. Chaudhary et al. (2015) found female respondents more susceptible to poor online behaviour, in this instance phishing attacks, than male respondents. It was found that age reduces the risk perception associated with a loss of data confidentiality (Milne, Labrecque & Cromer 2009) and increases vulnerability to threats such as spyware (Fox 2006), while males seem to have a tendency to engage in more risky online behaviour (Byrne et al. 2012).

Chen, Paik and McCabe (2014:135) reported on different levels of defensive measures taken by online consumers based on education levels. Redmiles, Kross and Mazurek (2016:666) found that users with higher education levels are significantly more likely to learn from negative experiences. These groups also have access to more credible sources of security-related information, potentially leading to more secure behaviour online.

The literature for demographics impacting passwords in particular is scarce. Gender as a distinguishing factor did feature in research by Bryant and Campbell (2006), determining that females are more likely to use meaningful information in the composition of their passwords, while males are more likely to use similar passwords for more than one purpose (Bryant & Campbell 2006:90). Shay et al. (2010) noted a decrease in password sharing as respondents grew older. Bryant and Campbell noted a slight decrease in respondents who did not use a proper combination of characters in the composition of passwords as age increased. The literature indicates that age does not negatively impact upon all practices; Bryant and Campbell also established that older participants were not more, or less, likely to change their passwords more often than younger users.

According to Karlsson, Åström and Karlsson (2015:246) existing research into online security has focussed on a broad set of research topics but with limited depth. More importantly, an extensive part of the research is descriptive, philosophical or theoretical, lacking a structured use of empirical data, making it quite immature.

The goal of SETA interventions is to change and improve user behaviour. Although many organisations show compliance in running security awareness programmes, this does not necessarily result in a behavioural change. Merely complying, and not dealing with the actual deficiencies, can result in people being more averse to change than before, according to Skinner et al. (2018).

According to Michie and Johnston (2012), basic psychological research over the last century has demonstrated that behaviour and behavioural change follow predictable patterns and that it is, therefore, vital that interventions be guided by accumulated science. This is supported by work from Curry et al. (2018:49) indicating that the motivational antecedents of intent are separate from the volitional drivers of behaviour. They suggest that ‘appropriately differentiated treatments’ to support behavioural change should ‘inform practical security behaviour improvement initiatives’.

User behaviour concerning passwords has a direct effect on computer security (Gehringer 2002:369). Using the determinants of human behaviour, based on the model of McCloy, Campbell and Cudeck (1994), Butler and Butler (2014) defined three determinants for individual password performance, namely relevant knowledge of password practices, the capability to successfully combine password-related knowledge with knowing how and being able to apply proper password practices, and the motivation to behave securely. Their password performance model is used as theoretical construct for this research.

The primary objective of this study was to determine the individual SETA needs in South Africa by analysing the following:

The results of this study are presented as relative focus areas per poor password practice (Figure 1), as well as a demographical variance heat map to indicate deficiencies in password practices displayed for different demographic groups. These results should be useful to practitioners defining appropriate SETA programmes. Future research in this space could be focussed on the complex interrelatedness of the different demographic factors that sometimes display an interesting cyclic nature, especially with years of Internet experience and number of sites visited that require authentication.

Recommendations made from the observed differences and literature on appropriate interventions make a contribution for practitioners designing SETA interventions.

A survey design that targets a large sample of responses, to potentially cover different demographics across five dimensions, was deemed appropriate. Ethical clearance for the research project was obtained from the Departmental Ethical Screening Committee at the academic institution of the authors.

The following steps were followed in the research process:

The survey instrument was pilot tested on a sample population of both technology literate and less literate users to ensure construct validity and meaning options for each question or statement. After two rounds of pilot testing and confirmation that all questions were valid, the survey was administered using an online survey tool and distributed via social media (Twitter) and institutional email. Given a desire for a large sample, yet no inferential statistics that would impose strict sampling decisions, a snowball distribution method was used.

A total of 737 useful responses were obtained for analysis. As the survey questions asked for the prevalence of the different antecedents of poor password practices as indicated in Table 1 via a single question each, statistical validity for multiple statements per construct can thus not be determined.

The analysis was conducted using descriptive statistics (Figures 2–7) and no inferential statistics to any confidence level were performed. Figure 8 represents the performance heat map, indicating the reported difference in behaviour for the different demographic groupings for three defined levels of performance.

The demographic composition of the population is presented in Table 2.

Comparison of the demographic data with that of South African Internet users shows a potential bias in terms of education levels. This is to be expected given the method of distribution from within the database of an academic institution. Gender and age distribution was deemed representative, and no comparative data sets are available to determine potential bias in terms of the numbers of sites visited nor years of Internet experience.

Research about passwords is often conducted within a particular context, such as an organisation that the author has access to. This is often an academic institution (Kruck & Teer 2008; Yan et al. 2004) or particular industry that imposes additional regulatory challenges, like health care (Ghazvini & Shukur 2017), or where the assets protected are particularly attractive, such as financial services.

This research did not aim for, nor was it limited to, a particular context. Practitioners from a broad sphere of applications may be interested in the results. However, the intent is not to use the results to design differentiated SETA programmes but rather to acknowledge the potential difference that may exist in every context and incorporate that into a learning process design. Academics may wish to test for these differences within specific contexts.

Analysis revealed that respondents vary significantly in their password practice proficiency levels. Furthermore, a discrepancy between users’ perceptions of their password practices and the reality (practices measured) was evident. A total of 39 respondents (5.3%) perceived that they possessed absolute knowledge of proper password practices. However, only a single respondent (0.1%) was able to demonstrate flawless ability to apply proper password practices and only 21 respondents (2.8%) displayed a perfect ‘security first’ aptitude when selecting and managing passwords.

The password creation and management practices of respondents were analysed to distinguish between secure and weak password behaviour. Numerous instances of weak password creation and management practices were evident (Figure 1).

The most prevalent poor practices were the simultaneous use of the same passwords (90.1%) and password reuse (77.3%). This was not unexpected because studies by Das et al. (2014) and Wash et al. (2016) highlighted that users have fewer passwords than the number of websites they visit, indicating password reuse. Shay et al. (2010) found that more than 80.0% of their respondents reused or slightly altered passwords for multiple purposes. Wash et al. concluded that 85.0% of respondents reused passwords. The reuse and simultaneous use of passwords is thus an extremely important focus area for SETA, especially where the same passwords are used to protect valuable assets (like online banking) and less valuable, and often less well-protected, Internet sites of a general nature.

The analysis for the customisation of SETA programmes followed a dual approach. Firstly, it was determined which of the weak password practices were more prevalent across the entire population to ensure that these aspects were highlighted across the board for all demographics (Figure 1). Secondly, the prevalence of weak password behaviour within different demographic groups was analysed. The results are presented in Figures 2–7.

The variation within each demographic group was used to determine if a particular demographic group displayed a higher, or lower, prevalence for the particular measure. A confidence interval of 10% was selected for a medium focus. Where any demographic group displayed a prevalence of 5% higher than the mean, it is indicated as high and conversely a measure of 5% below the norm indicate a low focus. Figure 8 indicates the extent of the focus for the different improper password practices per demographic group.

From Figure 8 it is evident that areas of higher and lower focus exist within all the demographic groups, meaning that all demographic groups are in need of SETA. Furthermore it shows that the various demographic groups require tailored SETA programmes with different focus areas.

The results confirm that a one-size-fits-all approach for SETA programmes is not ideal. Although it could be argued that ‘covering all bases’ would be appropriate, relevance is a cornerstone for education and care should be taken to hide the specific knowledge required by an individual user, within a sea of non-relevant information that already shapes a user’s behaviour.

However, there is also opportunity within this variance: the construct of social influence is well appreciated in the behavioural change and technology literature and allowing a natural transfer of good practices within diverse groups, although challenging, could have significant impact.