Poster: The Unknown Unknown: Cybersecurity Threats of Shadow IT in Higher Education

Jan Philip van Acken; Joost F. Gadellaa; Slinger Jansen; Katsiaryna Labunets

doi:10.1145/3576915.3624395

Poster: The Unknown Unknown: Cybersecurity Threats of Shadow IT in Higher Education

Jan Philip van Acken, Joost F. Gadellaa, Slinger Jansen, Katsiaryna Labunets

Sub Software Production

Coöperatie SURF U.A.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

Abstract

The growing number of employee-introduced IT solutions creates new attack vectors and challenges for cybersecurity management and IT administrators. These unauthorised hardware, software, or services are called shadow IT. In higher education, the diversity of the shadow IT landscape is even more prominent due to the flexible needs of researchers, educators, and students. We studied shadow IT and related cyber threats in higher education via interviews with 11 IT and security experts. Our results provide a comprehensive overview of observed shadow IT types and related cyber threats. The findings revealed prevalent cloud and self-acquired software use as common shadow IT, with cybersecurity risks resulting from outdated software and visibility gaps. Our findings led to advice for practitioners: manage shadow IT responsibly with cybersecurity best practices, consider stakeholder needs, support educators and researchers, and offer usable IT solutions.

Original language	English
Title of host publication	CCS '23: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security
Publisher	Association for Computing Machinery
Pages	3633-3635
Number of pages	3
ISBN (Print)	979-8-4007-0050-7
DOIs	https://doi.org/10.1145/3576915.3624395
Publication status	Published - 21 Nov 2023
Event	30th ACM SIGSAC Conference on Computer and Communications Security, CCS 2023 - Copenhagen, Denmark Duration: 26 Nov 2023 → 30 Nov 2023

Conference

Conference	30th ACM SIGSAC Conference on Computer and Communications Security, CCS 2023
Country/Territory	Denmark
City	Copenhagen
Period	26/11/23 → 30/11/23

Keywords

Cyber Risk Management
Cyber Threats
Higher Education Institutes
Qualitative Study
Shadow IT

Access to Document

10.1145/3576915.3624395

3576915.3624395Final published version, 888 KBLicence: Taverne

Cite this

@inproceedings{1af3af6957ae44e582ceb69108a0260e,

title = "Poster: The Unknown Unknown: Cybersecurity Threats of Shadow IT in Higher Education",

abstract = "The growing number of employee-introduced IT solutions creates new attack vectors and challenges for cybersecurity management and IT administrators. These unauthorised hardware, software, or services are called shadow IT. In higher education, the diversity of the shadow IT landscape is even more prominent due to the flexible needs of researchers, educators, and students. We studied shadow IT and related cyber threats in higher education via interviews with 11 IT and security experts. Our results provide a comprehensive overview of observed shadow IT types and related cyber threats. The findings revealed prevalent cloud and self-acquired software use as common shadow IT, with cybersecurity risks resulting from outdated software and visibility gaps. Our findings led to advice for practitioners: manage shadow IT responsibly with cybersecurity best practices, consider stakeholder needs, support educators and researchers, and offer usable IT solutions.",

keywords = "Cyber Risk Management, Cyber Threats, Higher Education Institutes, Qualitative Study, Shadow IT",

author = "{van Acken}, {Jan Philip} and Gadellaa, {Joost F.} and Slinger Jansen and Katsiaryna Labunets",

note = "Publisher Copyright: {\textcopyright} 2023 Copyright held by the owner/author(s).; 30th ACM SIGSAC Conference on Computer and Communications Security, CCS 2023 ; Conference date: 26-11-2023 Through 30-11-2023",

year = "2023",

month = nov,

day = "21",

doi = "10.1145/3576915.3624395",

language = "English",

isbn = "979-8-4007-0050-7",

pages = "3633--3635",

booktitle = "CCS '23: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security",

publisher = "Association for Computing Machinery ",

address = "United States",

}

van Acken, JP, Gadellaa, JF, Jansen, S & Labunets, K 2023, Poster: The Unknown Unknown: Cybersecurity Threats of Shadow IT in Higher Education. in CCS '23: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. Association for Computing Machinery , pp. 3633-3635, 30th ACM SIGSAC Conference on Computer and Communications Security, CCS 2023, Copenhagen, Denmark, 26/11/23. https://doi.org/10.1145/3576915.3624395

Poster: The Unknown Unknown: Cybersecurity Threats of Shadow IT in Higher Education. / van Acken, Jan Philip; Gadellaa, Joost F.; Jansen, Slinger et al.
CCS '23: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. Association for Computing Machinery , 2023. p. 3633-3635.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Poster

T2 - 30th ACM SIGSAC Conference on Computer and Communications Security, CCS 2023

AU - van Acken, Jan Philip

AU - Gadellaa, Joost F.

AU - Jansen, Slinger

AU - Labunets, Katsiaryna

PY - 2023/11/21

Y1 - 2023/11/21

N2 - The growing number of employee-introduced IT solutions creates new attack vectors and challenges for cybersecurity management and IT administrators. These unauthorised hardware, software, or services are called shadow IT. In higher education, the diversity of the shadow IT landscape is even more prominent due to the flexible needs of researchers, educators, and students. We studied shadow IT and related cyber threats in higher education via interviews with 11 IT and security experts. Our results provide a comprehensive overview of observed shadow IT types and related cyber threats. The findings revealed prevalent cloud and self-acquired software use as common shadow IT, with cybersecurity risks resulting from outdated software and visibility gaps. Our findings led to advice for practitioners: manage shadow IT responsibly with cybersecurity best practices, consider stakeholder needs, support educators and researchers, and offer usable IT solutions.

AB - The growing number of employee-introduced IT solutions creates new attack vectors and challenges for cybersecurity management and IT administrators. These unauthorised hardware, software, or services are called shadow IT. In higher education, the diversity of the shadow IT landscape is even more prominent due to the flexible needs of researchers, educators, and students. We studied shadow IT and related cyber threats in higher education via interviews with 11 IT and security experts. Our results provide a comprehensive overview of observed shadow IT types and related cyber threats. The findings revealed prevalent cloud and self-acquired software use as common shadow IT, with cybersecurity risks resulting from outdated software and visibility gaps. Our findings led to advice for practitioners: manage shadow IT responsibly with cybersecurity best practices, consider stakeholder needs, support educators and researchers, and offer usable IT solutions.

KW - Cyber Risk Management

KW - Cyber Threats

KW - Higher Education Institutes

KW - Qualitative Study

KW - Shadow IT

UR - http://www.scopus.com/inward/record.url?scp=85179843725&partnerID=8YFLogxK

U2 - 10.1145/3576915.3624395

DO - 10.1145/3576915.3624395

M3 - Conference contribution

AN - SCOPUS:85179843725

SN - 979-8-4007-0050-7

SP - 3633

EP - 3635

BT - CCS '23: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

PB - Association for Computing Machinery

Y2 - 26 November 2023 through 30 November 2023

ER -

Poster: The Unknown Unknown: Cybersecurity Threats of Shadow IT in Higher Education

Abstract

Conference

Keywords

Access to Document

Fingerprint

Cite this