Survey of Internet Users Regarding Cyber Security
In March 2017, Research for Public Safety Canada was conducted regarding Canadians’ beliefs and behaviours relating to Internet usage and online safety. You can read the summary below.
The use of Internet-enabled computer technology is ubiquitous across Canada. A priority of Public Safety Canada is to make the public aware of issues of security and safety and help Canadians stay safe from cyber threats. This survey gathers quantitative data on the knowledge, attitudes, and behaviours of Canadians who use the Internet to inform future communications and policy development initiatives. Interviews were completed with 2,027 Canadian adults from across the country who use the Internet. The cases were drawn from a random selection of Probit panel members, a randomly recruited panel of Canadian households assembled through random digit dialling (RDD) methodology used in standard telephone survey sampling techniques.
Usage of the Internet
Survey results confirm that Canadians are using a variety of Internet-enabled devices to access the web on a daily basis, including not only desktop and laptop computers (94 per cent), but smartphones (74 per cent), tablets/readers (58 per cent), gaming systems, streaming services, smart televisions (25 per cent in each) and other devices. Virtually everyone has access from home, and more than eight in ten are using secure wifi in their home. The average amount of time spent online exceeds six hours per day.
Canadians use the Internet for a wide variety of activities, with almost everyone using the Internet for email and browsing websites. Canadians also commonly use the Internet to perform financial transactions, view videos and movies, make purchases, use social networking sites such as Facebook or Twitter, and/or access government information services. Email still stands out as the most concentrated sources of risk to Canadians in terms of the online activities they engage in.
Level of Concern and Awareness
Canadians who are actively using the Internet are very concerned about having their personal information obtained, and used without permission, as a result of their online activities. In fact, half say they are very concerned, and by and large the remainder are moderately concerned. The importance of taking steps to protect personal information online and home computers is also not lost on Canadians with eight in ten seeing this as important. The importance of protecting mobile devices from online threats is slightly less obvious to some, although three in four see this as important.
Canadians perceive online threats to be fairly commonplace today; just over one in four believe it is very common for Canadians to be affected, and another half feel it is moderately common. In terms of one’s own personal online security, one in three think it very likely they will be affected by an online threat in the near future, and another one in three believe it to be moderately likely. Canadians also have a strong appreciation for the consequences of online threats. Two in three believe that consequences for the average Canadian experiencing an online threat can be serious. Canadians who are more knowledgeable of cyber security issues are more apt to see the consequences of online threats as serious.
Almost all Canadians also report being aware of precautions they can take to protect themselves online, like not sharing passwords, using anti-virus/anti-spyware software, not opening email attachments from people they do not know, and limiting the personal information they share online. Nine in ten are already aware that they should not open emails from people they do not know, that they should only do banking on a computer they know is safe, and that they should be selective in the sites they use for online shopping. Virtually everyone is also aware that their laptop or computer can be affected by an online threat, and eight in ten are aware of the same potential for a smartphone or tablet/reader. This drops to roughly half when it comes to awareness of possible risks to a smart home device, smart television, or wearable device.
Canadians are marginally less knowledgeable when it comes to some more concrete pieces of information including where to get information on how to protect against online threats, the signs to look for that indicate the presence of an online threat, and steps to take when affected by an online threat. Three in ten feel that Internet security is over their head (i.e., beyond their capacity to handle), and one in four feels that there is little that can be done to protect oneself online.
Level of Protective Measures Taken
Canadians report a strong repertoire of precautions they take to protect their devices and personal information online including two in three or more who say they download files only from trusted sources, lock devices with password protection, keep anti-virus software up-to-date, use spam filters, and generally use caution with unknown sources. Use of some of these protective behaviours, however, is down significantly from 2011 when, for example, more Canadians kept antivirus software up to date. About eight in ten Canadians said that they refrain from sharing passwords, use complex passwords, and exercise caution when giving out information like their real name, address, or phone number and when responding to solicitations from strangers. Almost nine in ten say that they have antivirus software installed on their computers, and seven in ten of these respondents have it set to download the latest protection automatically. Other precautions that are used less often, include changing default passwords, checking privacy policies, using multiple email accounts under a pseudonym, using an administrator account when accessing the web, and using encryption software. Also, roughly one in three never change their passwords, or do so only every few years, for online and banking accounts as well as email and social media.
The incidence of victimization from an online attack is moderately common, but much less so than in 2011. Nearly four in ten (37 per cent) Canadians report having been a victim of a virus, spyware, or malware attack on the device(s) they use to access the Internet for personal use. This is more than 50 per cent less than it was in 2011, when 59 per cent reported having been a victim. As in the past, results also indicate that there is at least a moderate impact from these attacks for more than half, with one in five reporting a significant impact. Between five and 12 per cent have experienced identity theft and financial loss as a result of online activity. Two-thirds to three in four of those who have experienced an online threat changed their behaviour as a result of an attack, with many taking precautionary measures to protect themselves against future threats (e.g., using anti-virus software, being more careful about the information they give out).
Need for Information
Canadians have looked for a range of information about online threats, including protecting devices with anti-virus software (four in ten), how to secure home networks, and how to tell if an email is a scam (three in ten in each case). About one in four looked for information about how to protect devices and computer files. Steps towards safe social networking and use of public wifi, as well as general terms related to cyber security were also sought out by about one in six. Most looked for this information using a general search engine (two in three) or from a vendor website (four in ten). Government websites were used about a quarter of the time. Results suggest that most are looking for information proactively rather than trying to fix a problem that has already occurred, highlighting a willingness to take steps provided they have access to the information they need.
Six in ten Canadians are confident that they can protect themselves online as long as they have the basic information on steps to take, suggesting a need for concrete information, particularly for those less knowledgeable and confident. This has dropped from 70 per cent in 2011. Just under six in ten feel that they have enough information on how to take steps to protect themselves against online threats, although more than one in five Canadians do not feel this way. Canadians are similarly mixed about whether they feel they have enough information to know how new technologies might affect their personal privacy, with half agreeing that this is the case and three in ten disagreeing.
Canadians are mixed in their trust of a variety of sources in terms of the technical reliability, currency, and neutrality of information about online threats. Around half of Canadians trust government, security software companies, and law enforcement organizations. Slightly fewer trust Internet service providers for current and reliable information about online threats. When Canadians are asked to indicate their most trusted source for unbiased information about online threats, government and law enforcement again top the list, with just under half of Canadians expressing confidence in these groups. Not-for-profit organizations rank third, while financial institutions and private vendors are each trusted by one in four Canadians.
Most Canadians think that the responsibility for ensuring that web-enabled personal devices are safe and secure rests with the individual owners of the devices, suggesting again that they are willing to take action, provided they have the information they need to do it.
Concern Among Parents
Results suggest that while many parents feel that they have the information they need to protect their children online, at least one in three do not feel this to be the case, more often among parents of older children and teens. For example, while half feel that they are confident they have the information to help their child navigate online, one in four say they do not. One in three also agree that they cannot keep up with the apps, games, and other technology that young people are using. About half say that they are concerned for their children’s privacy and also about cyberbullying and online harassment. Fewer (one in four to four in ten) are concerned with the legal implications of image and file sharing. This is typically because they have already spoken with their children about these issues, they trust their child to act appropriately, or their children are not online to an extensive degree (more often among parents with younger children).
Concerns Among Businesses
Although a survey of the general public, the research took the opportunity to ask those who are self employed or in a managerial position in a small to medium sized company (i.e., with fewer than 250 employees), about their IT practices and level of concern when it comes to online protection. A total of 550 businesses were represented. Although one in four say that they are very concerned, just over half rated themselves as moderately concerned, and one in five say that are not concerned with work disruptions and/ or financial loss from online threats. Among those unconcerned, this is most often because they feel that the threat is very low (one in three) or they feel that they have researched and taken appropriate steps to protect the business.
Results show that there is as much need for improvement in security protection from online threats to businesses as there is among members of the public in their personal space. Between half and two in three employers require employees to password protect devices, use password authentication, keep security software up to date, and back up information. About half of the time, employees are asked to use complex passwords, download only from trusted sources, and click with caution when opening attachments and responding to email invitations. Slightly fewer require employees to change default passwords and not allow browsers to remember passwords. Results also show that there is a strong appetite for information on a range of topics to help businesses identify and manage their risks from online threats. These include having a list of threats to look for, procedures for dealing with a cyber attack, guidelines for employees’ use of personal devices for work, best practices for storage of data, and resources to help make networks secure, each of interest to more than four in ten businesses.
Segments of the Population
There are a number of repeating patterns found in the survey results. Younger Canadians are more active online, and tend to be more knowledgeable about online threats and security. Older Canadians are less active, but more concerned about security, and typically more apt to be looking for information and advice on how to protect themselves online. The generational divide is typically found with the younger boomers (with results looking quite different for those under 45 to 55, and those 45 to 55 and older). Socioeconomic status also provides a key demarcation, with those reporting higher education often reporting more online activity and awareness of the issue. Residents of Quebec report lower awareness of online threats and security, less concern about potential threats, and fewer protective measures taken.