What Is Shadow IT And How To Manage It
According to research done by CISCO, 80% of employees use software that is not cleared by the IT department. In this blog post, we take a look at how the use of unsanctioned resources, or shadow IT, impacts an organization, why it happens, the benefits and risks involved, and how organizations can manage it.
What Is Shadow IT?
Shadow IT refers to the use of any hardware, software, or application within an enterprise network without the IT department’s knowledge or approval. In simple terms, it refers to unsanctioned resources deployed by end users within an organization’s network.
While shadow IT does not necessarily include malicious assets such as malware, it poses significant security risks. Since IT teams are unaware of the assets deployed under shadow IT, they cannot monitor those assets or address their vulnerabilities, making those assets particularly susceptible to exploitation by cybercriminals.
Examples Of Shadow IT
Shadow IT encompasses a wide variety of IT assets. These include third-party software, SaaS applications, and cloud services that are available freely or at a very low cost, are quick to deploy, and are easy to use.
Common examples of shadow IT include:
Personal devices when Bring Your Own Device (BYOD) is not permitted;
USB flash drives and external storage;
Instant messaging services such as Slack, WhatsApp, Signal, and Telegram;
Productivity apps such as Trello and Asana;
Cloud storage, collaboration, and productivity applications such as Dropbox, Google Docs, Google Drive, and Microsoft OneDrive;
Excel spreadsheets and macros.
Employees typically bring such unsanctioned software and applications to the workplace because they are familiar with them and have been using them in their personal lives. Sometimes employees are invited to use unsanctioned applications by customers, partners, or third-party service providers to facilitate communication and collaboration. For instance, a client might request the use of WhatsApp for communication, leading employees to circumvent IT policies that restrict its use.
Reasons For The Use Of Shadow IT
The adoption of shadow IT is often driven by convenience, efficiency, and the perception that IT policies are overly restrictive.
Here are some key reasons:
Frustration with IT Processes
IT processes in medium and large organizations can sometimes be slow or cumbersome. Employees may feel their productivity is hindered by restrictions and the strict control exercised by the IT department. They may perceive shadow IT as a way to bypass administrative delays and achieve their work objectives more quickly.
Familiarity and Usability
Employees often prefer tools they are already comfortable with from their personal lives. For instance, someone accustomed to using Google Drive may find it easier to share files through this platform rather than learning a new, sanctioned alternative.
Remote Work and Cloud-Based Applications
The rise of remote work and the proliferation of cloud-based applications have further contributed to the spread of shadow IT. Cloud tools are particularly appealing because they do not require installation on corporate devices and are often accessible from anywhere.
BYOD Policies
Organizations with BYOD policies face additional challenges, as IT teams may have limited visibility into the software and services employees run on their personal hardware.
Team-Level Adoption
Shadow IT is not always initiated by individual employees. Teams may adopt applications, cloud services, or development environments without seeking IT approval. This typically occurs when formal approval and procurement processes are perceived as too slow or burdensome. Teams might prioritize speed over compliance, particularly when under pressure to deliver results or respond to market demands.
The Bigger Picture
While the motivations behind shadow IT are often rooted in the desire for greater efficiency and productivity, its unchecked proliferation can have significant consequences. The lack of oversight and integration with official IT infrastructure can create security vulnerabilities, lead to data silos, and result in compliance breaches. Moreover, IT departments may struggle to provide support or troubleshoot issues related to unsanctioned tools, potentially compounding operational challenges.
Benefits Of Shadow IT
Many organizations have realized that shadow IT is an inevitability. In their zeal to be more productive and efficient employees are likely to use tools that they are most familiar with. This realization has led many organizations to embrace shadow IT, consequently enjoying the following benefits:
Make teams more agile, enabling them to quickly adapt to evolving technology and business landscapes;
Enhance productivity and efficiency by allowing employees to use the tools that best suits them;
Streamline IT operations and procurement processes, reducing IT costs. For example, shadow IT can help minimize software licensing fees for unused sanctioned tools.
However, to truly leverage these benefits, IT teams must mitigate the risks of shadow IT.
Risks Of Shadow IT
Lack Of Visibility And Control
While the end users may be aware of security concerns and take precautions, they are unlikely to have a holistic view of the organization’s exposure. Moreover, the end users are unlikely to maintain a high level of security through patches, updates, configurations, and permission restrictions, which are critical from a security and compliance perspective. For example, an unpatched collaboration tool used by employees might become an entry point for attackers. And, since IT teams are unaware of all the shadow IT assets in use, they cannot address the security vulnerabilities these unsanctioned assets introduce into the company network.
Increased Attack Surface
When employees use shadow IT, they expose the organization to an increased risk of cyberattacks. The unsanctioned software, applications, or devices are not protected to the same level of security as other assets on the company’s network, making them more vulnerable.
Data Exposure
Unsanctioned software and applications, especially those used on personal devices often become a source of data breaches. The lack of tight control over those assets can lead to either exposure or inappropriate sharing of sensitive company information.
Compliance Issues
Regulations like HIPAA, PCI-DSS, GDPR, etc., lay down stringent requirements for processing personally identifiable information. Shadow IT assets are unlikely to meet the requirements of these data security standards, leading to punitive fines or legal action against the company. For example, financial firms will face significant penalties if employees store customer data on unauthorized platforms that do not comply with PCI-DSS standards.
Operating Inefficiencies
Shadow IT applications can introduce inefficiencies in the following ways:
Unsanctioned applications may be incompatible with other applications on the network;
Shadow IT applications can result in silos since other employees may not have access to or knowledge of how to use them;
The IT department may make changes to the network disrupting the functioning of the shadow IT assets. For instance, a routine security update might inadvertently block access to an unsanctioned cloud storage tool;
And if things go wrong with the applications, end users cannot get support from IT. For instance, during a critical project deadline, the failure of an unauthorized tool could lead to significant downtime without IT support.
How To Manage Shadow IT
Since it is extremely difficult to entirely prevent shadow IT, organizations should accept its inevitability and focus on managing it instead. This enables the organization to enjoy the benefits of shadow while minimizing the risks.
Here are the steps an organization can take to effectively manage shadow IT:
Determine Your Organization’s Risk Tolerance
The first step is to assess how strict your organization should be about shadow IT. Each organization has a different level of risk tolerance, and its policy on shadow IT should align with that risk appetite.
Typically, shadow IT policies fall into one of the following categories:
1. Strict
Organizations may attempt to completely shut down shadow IT by enforcing stringent firewall rules and conducting regular software audits. While this approach can tighten security, it may also push employees to find loopholes, inadvertently increasing risks.
2. Lenient
A more relaxed approach to shadow IT supported by security measures such as data encryption and Role-based access control (RBAC) allows organizations to leverage the benefits of shadow IT while mitigating risks.
3. Middle ground
Another approach to managing shadow IT includes publishing a list of IT-vetted tools each year, striking a balance between control and flexibility. This approach gives employees some freedom of choice while helping the IT department maintain visibility and oversight.
Establish A Simple IT Procurement Process
Developing a streamlined and fast proposal and procurement process can help mitigate shadow IT while improving operational efficiency. A simplified process encourages employees to request new applications or services through the proper channels, reducing the temptation to bypass the IT department.
Educate Users
Most employees do not have a comprehensive understanding of the complexities of the company’s IT infrastructure, security posture, and compliance requirements. This makes it difficult for them to recognize the risks shadow IT can introduce.
Therefore, the IT department must communicate why certain applications or software might pose challenges for integration or security. Open communication about expectations and responsibilities at both the individual and departmental levels helps minimize shadow IT risks. Regular training sessions can further reinforce this awareness.
Use Tools For Managing Shadow IT
It is extremely difficult for an organization to discover or manage shadow IT with traditional asset management systems. While policies and processes have their place, these need to be adequately supported with tools and technologies.
For example, a cloud access security broker (CASB) is a tool that helps organizations deal with issues raised by shadow IT. It acts as an intermediary between cloud application users and cloud services, helping organizations discover and control shadow IT, prevent sensitive data leakage, and enforce security policies to ensure compliance. By providing data protection and threat prevention services, CASBs address many challenges posed by shadow IT.
Conclusion
If left unchecked shadow IT can severely compromise an organization’s security posture. However, with the right safeguards in place, organizations can harness the benefits of shadow IT, providing employees with tools that boost their productivity and morale. Adopting a holistic approach to managing shadow IT not only balances risks and benefits but also uncovers new tools, technologies, and processes that can drive organizational growth and efficiency.
About The Author
Hari SubediMarketing Manager at Jones IT
Hari is an online marketing professional with a focus on content marketing. He writes on topics related to IT, Security, and Small Business. He is also the founder and managing director of Girivar Kft., a business services company located in Budapest, Hungary.