From Fragmented Protective Practices to Secure Digital Learning: Developing the Secure-Dl Cybersecurity Adoption Framework for Higher Education

Abstract

Digital learning depends on students consistently applying several layers of cybersecurity protection, yet higher-education interventions often rely on general awareness messages or isolated technical training. This study developed an evidence-informed, theory-integrated framework for moving students from fragmented protective practices towards secure digital learning. Primary survey data were obtained from 393 Computer Science undergraduates in universities in Enugu State, Nigeria, using the 60-item Utilisation of Cybersecurity Applications for Digital Learning Questionnaire. Five domains were assessed: antivirus, firewall and intrusion detection/prevention, encryption, multi-factor authentication (MFA), and virtual private network (VPN) use. Domain means were benchmarked against the prespecified functional criterion of 2.50 using one-sample tests and standardised mean differences. Empirical gaps were then mapped to mechanisms from Social Cognitive Theory, the Unified Theory of Acceptance and Use of Technology, and Protection Motivation Theory, and aligned with multilevel implementation principles. All five domains were below the functional benchmark. Antivirus use was closest to the criterion (M=2.36, SD=0.57, d=-0.24), whereas firewall (M=2.07, d=-0.59), encryption (M=2.08, d=-0.60), MFA (M=2.12, d=-0.58), and VPN use (M=2.10, d=-0.61) showed moderate deficits. The resulting SECURE-DL framework comprises six linked functions: Screen and segment; Enable secure defaults; Cultivate capability; Use threat-and-coping messages; Reinforce norms and feedback; and Evaluate and adapt. It specifies actions at the student, course/programme, and institutional levels, together with process, behavioural, and resilience indicators. The framework shifts cybersecurity education from awareness-only provision towards supported, repeated, and measurable protective practice. Prospective testing is required before causal effectiveness or generalisability can be established.