Cyber-aware but still exposed

A 2023 study of Windhoek residents suggests many people understand the risks of online life, but awareness alone may not be enough to keep them safe.

The research, conducted by Iyaloo Waiganjo and Edward Valungameka of the International University of Management (IUM), surveyed 267 Windhoek residents about their knowledge of cybercrime, online habits, and the steps they take to protect themselves.

The findings point to a highly connected population that is generally aware of cyber threats, but has much less awareness of the cybersecurity policies intended to address them.

For most respondents, the internet is not an occasional tool but part of everyday life. More than nine in 10 participants (91.4%) said they accessed the internet every hour, while 87.6% said they primarily used smartphones.

That level of connectivity brings convenience, but also creates potential exposure. Smartphones can contain personal photographs, videos, financial information and banking applications, meaning that a compromised device could have significant consequences for users.

The study found that 94.4% of respondents were aware that criminals operate online and can target internet users. However, just over a quarter (27.8%) said they had either been victims of cybercrime or knew someone who had been affected. A further 25.8% were unsure whether they or someone they knew had experienced cybercrime.

Phishing was among the threats respondents said they had experienced, or knew someone who had experienced. Identity theft and phishing-related malware were also reported, while some respondents identified scams. Smaller numbers referred to cyberbullying, denial-of-service attacks, man-in-the-middle attacks and cryptojacking.

The findings highlight a central challenge: as more people and devices connect to the internet, there are more potential opportunities for cybercrime.

The researchers argue that cybersecurity awareness can help people identify, recognise, avoid and prevent cybercrime and attacks.

Participants reported using a range of measures to protect themselves online. Strong passwords were the most common measure, with 181 participants reporting their use. Respondents also said they backed up their data and used antivirus applications, while 63 reported using firewalls.

These responses suggest that many participants were taking practical steps to protect themselves. However, the study notes that cybersecurity is not only about knowing which measures to take, but also about how people apply that knowledge in practice.

The researchers argue that awareness programmes should help people understand the risks associated with their online activities while encouraging a stronger security-conscious culture.

In practical terms, this includes how users manage passwords, respond to suspicious messages and protect personal information.

Policy gap

While respondents overwhelmingly recognised the importance of cybersecurity policy, far fewer were aware of existing policies in Namibia.

Of the 267 respondents, 90.9% said cybersecurity policies were important in combating cybercrime. However, only 29.2% said they were aware of a cybersecurity policy in Namibia.

Nearly six in 10 respondents (59.1%) said they were not aware of any such policy, while 11.7% were unsure.

The researchers found that lack of awareness about security policies was the leading factor identified by participants as contributing to non-compliance in the workplace.

Poor leadership and low job satisfaction were also identified by 85 participants as factors that could contribute to employees not following cybersecurity policies.

Methodology

The study used a Google questionnaire distributed to 370 people, of whom 267 participated. The researchers used simple random sampling and conducted the study in Windhoek.

The sample was predominantly female, with women accounting for 75.7% of respondents.

Most participants were also younger than 35. Some 42.3% were aged between 21 and 24, while 39% were between 25 and 35. Overall, 93.7% of respondents were younger than 35.

In terms of employment, 44% of respondents were unemployed, 39% employed, 11% self-employed and 6% chose not to disclose their employment status.

The researchers caution that the findings should not automatically be generalised to Namibia's population because the survey was limited to Windhoek.

They recommend similar research in at least five regions to develop a broader picture of cybersecurity awareness across the country.

Just the beginning

The study concludes that cybersecurity awareness needs to be strengthened as online threats continue to evolve.

The findings suggest that many people in Windhoek recognise the risks of cybercrime, understand the importance of cybersecurity policy and already use basic protective measures.

At the same time, the research identifies a significant gap in awareness of cybersecurity policies and legal frameworks.

The authors recommend targeted cybersecurity awareness programmes, stronger legislative measures to combat cybercrime and further research into the factors affecting cybersecurity policy formulation in Namibia.