Poster: The Unknown Unknown: Cybersecurity Threats of Shadow IT in Higher Education
Publication date
2023-11-21
Authors
van Acken, Jan-Philip
Gadellaa, Joost F.
Jansen, Slinger
Labunets, Katsiaryna
Editors
Advisors
Supervisors
Document Type
Part of book
Metadata
Show full item recordCollections
License
taverne
Abstract
The growing number of employee-introduced IT solutions creates new attack vectors and challenges for cybersecurity management and IT administrators. These unauthorised hardware, software, or services are called shadow IT. In higher education, the diversity of the shadow IT landscape is even more prominent due to the flexible needs of researchers, educators, and students. We studied shadow IT and related cyber threats in higher education via interviews with 11 IT and security experts. Our results provide a comprehensive overview of observed shadow IT types and related cyber threats. The findings revealed prevalent cloud and self-acquired software use as common shadow IT, with cybersecurity risks resulting from outdated software and visibility gaps. Our findings led to advice for practitioners: manage shadow IT responsibly with cybersecurity best practices, consider stakeholder needs, support educators and researchers, and offer usable IT solutions.
Keywords
Cyber Risk Management, Cyber Threats, Higher Education Institutes, Qualitative Study, Shadow IT, Taverne, Computer Networks and Communications, Computer Science Applications, Software
Citation
van Acken, J P, Gadellaa, J F, Jansen, S & Labunets, K 2023, Poster : The Unknown Unknown: Cybersecurity Threats of Shadow IT in Higher Education. in CCS '23: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. Association for Computing Machinery, pp. 3633-3635, 30th ACM SIGSAC Conference on Computer and Communications Security, CCS 2023, Copenhagen, Denmark, 26/11/23. https://doi.org/10.1145/3576915.3624395, conference