Who is the IT Department Anyway: An Evaluative Case Study of Shadow IT Mindsets Among
summary
Mixed-methods research uses 450 survey responses and 32 follow-up interviews to classify shadow IT as unapproved cloud accounts (eg private Dropbox), self-made solutions, self-installed apps, and rogue devices like USB sticks or Nest units, and identifies 10 mindsets ranging from consequence avoidance to longevity-based invincibility. Findings show a risk-averse versus risk-tolerant dichotomy, a clear awareness‑action gap, and that consequences, risk discussions, and targeted training shift behavior. Recommendations include usable sanctioned tools, usable security, targeted training, and a rule‑bending protocol to integrate necessary workarounds.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:54Shadow IT mindsets
- 3:02Research questions & method
- 4:48Survey findings on shadow IT
- 6:13Risk-avoidance mindsets
- 7:43Risk-taking mindsets
- 9:33Managing shadow IT
- 10:38Open questions
related talks
40mTen Things to Include in Remote Work IT Risk Assessments
40mThrough Your Mind’s Eye: What Biases Are Impacting Your Security Posture?
15mAn Ethnographic Understanding of Software (In)Security and a Co-Creation Model
48mData-Driven Cyber Indicators of Malicious Insider Threat
55mDeveloping a Conceptual Model for Insider Threat
31mSeeing Through the Fog - Navigating the Security Landscape of a Cloud-First World
05mCloudy with a Chance of Misconceptions: Exploring Users' Perceptions and Expectations
27mSmall Company, Big Threats: Cybersecurity for the Rest of Us