Casting Light on Shadow IT
“Shadow IT” – also known as Stealth IT, Client IT, or Fake IT – is any system, solution, or software that’s used by the employees of an organization without the knowledge and approval of the corporate IT department. Shadow IT poses a unique threat to cybersecurity as the technologies used are not appropriately managed to identify and mitigate the associated risks that can put corporate data at risk.
Examples of Shadow IT
Employees using unapproved technology assets are incredibly widespread in businesses of all sizes and industries. In fact, a study from IBM Security found that 1 in 3 employees working for Fortune 1000 companies have saved and shared company data to third-party cloud applications that were not explicitly approved.
Prevalent Shadow Technologies:
- Unvetted communication tools used to share sensitive information outside of secured servers.
- Unauthorized personal peripherals (USB drives, keyboards, etc) used on company devices.
- Personal cloud storage accounts used to store company files.
- Users attempting to manage IT assets on their own, including attempts to bypass existing security features.
- Unmanaged remote access programs that can serve as an entry point for hackers.
- Feral information systems – data management formations that are created and managed outside of the security and governance of the company’s approved infrastructure.
- Personal devices used to perform work tasks in organizations that do not have an official bring your own devices (BYOD) policy.
The Dangers of Shadow IT
When the corporate IT department is not fully aware of the scope of existing assets within the company they are not able to provide the upkeep, troubleshooting, and risk management that is required to use those assets safely.
Shadow IT has the potential to cause a variety of logistical, data loss prevention, productivity, and security concerns, including:
- Productivity Loss: The lack of availability for internal troubleshooting, training, and support for shadow IT assets can create productivity blocks when a subset of users begin to rely on unmanaged assets to complete their tasks.
- Data Security: Unmanaged IT assets are not monitored or updated to address security vulnerabilities. Personal cloud storage accounts used to transfer corporate data may not have the same security controls available as enterprise accounts and they can be used as a gateway for malicious data exfiltration.
- IT Governance: The auditing of software and hardware assets proves difficult when technologies are implemented without the knowledge or clearance of the IT department. As shadow IT is discovered, the continued demand for those applications to be officially adopted can lead to application sprawl that creates redundancies and an increase in the resources required to appropriately manage IT assets.
- Software Utilization: Existing software resources that are provided by the company may see a significant under-utilization due to increased use of shadow technology alternatives.
- Litigation: Whether the company is aware of the assets or not, events such as data breaches caused by unsecured shadow systems or the use of pirated software can lead to costly litigation against the company. Organizations such as The Federation Against Software Theft (FAST) and The Software & Information Industry Association (SIIA) work with software companies to prosecute the use of unlicensed software. In the event that intellectual property owners discover the illegal use of their software in an unlicensed commercial setting the company as a whole may be liable for the infringement.
- Non-Compliance: The data risks caused by the unmitigated use of shadow IT may be in violation of internal or regulatory compliance frameworks that govern how data is protected and used. These technologies can lead to violations of requirements for data residency, data security, and related forms of information governance.
How Can Shadow IT Be Mitigated?
While shadow IT is incredibly widespread and potentially dangerous, it can be mitigated against with the right tools and processes. With the help of (approved!) computer monitoring software, employee training, and suitable alternatives you can deploy a software asset management (SAM) strategy that effectively mitigates the threat of unmanaged technology.
Computer Monitoring Software
To detect the use of unapproved and unfamiliar applications, you can monitor employee application use and web traffic for the prevalence of shadow IT. Once the demand for these applications is identified you can address the security concerns of unmanaged applications and services with the employees that are using them and take the opportunity to discuss viable alternatives or procedures.
Unmanaged IT assets that continue to pose an unwanted hazard can be blocked using software that prevents access to unauthorized websites and applications until they can be adequately reviewed and considered for official adoption.
Endpoint Management Software
To prevent the use of unknown data storage hardware that could be used to exfiltrate sensitive data such as intellectual property and records that contain personally identifiable information, you can use endpoint security software to disable unauthorized USB devices (flash drives, external hard drives, etc) from connecting to endpoints on your network.
Cybersecurity Training
Employees using unauthorized software and hardware are typically not doing so maliciously; it is more likely that they do not realize the cybersecurity risks of the unvetted tools they use. An important step in tackling shadow IT is to ensure that your workforce is well educated about the dangers posed by unmanaged assets as well as their responsibilities for working safely with the technology they use in their workplace.
Offer Suitable Alternatives
A key motivator for the use of unvetted tools is that the current suite of options offered by the organization does not meet the needs that their shadow alternatives are being used for. If the existing technology that is available to employees creates a productivity bottleneck, they are likely to continue using alternatives that better meet their needs in an effort to improve the efficiency and ease of their workflow.
To ensure that new technologies are used safely, it is worth considering an official adoption that can be better monitored and managed by the security team. Encourage employees to be comfortable with being honest about the technologies they are using by establishing a method for them to report unauthorized software and hardware usage without the fear of disciplinary action.
Conclusion
The use of shadow IT is inevitable for most organizations. With the right tools and processes, your software asset management plan can mitigate the risks of unmanaged assets by identifying their use, coaching employees on their cybersecurity responsibilities, and offering suitable alternatives that can be safely monitored and managed by your security team.
