{"id":23215,"date":"2021-10-14T13:21:26","date_gmt":"2021-10-14T17:21:26","guid":{"rendered":"https:\/\/www.sherweb.com\/blog\/?p=23215"},"modified":"2024-06-24T17:30:29","modified_gmt":"2024-06-24T21:30:29","slug":"dangers-of-shadow-it","status":"publish","type":"post","link":"https:\/\/www.sherweb.com\/blog\/security\/dangers-of-shadow-it\/","title":{"rendered":"The dangers of shadow IT"},"content":{"rendered":"

Unapproved apps, devices, and cloud services<\/a> have long been the bane of IT professionals. Remote and hybrid work arrangements<\/a> that have grown in popularity during the COVID-19 pandemic<\/a> have only made these \u201cshadow IT\u201d services more of a problem. But, just as hybrid work environments aren\u2019t going away any time soon, neither are the threats posed by shadow IT.<\/p>\n

Are you worried about shadow IT in the environments you manage?<\/strong> Keep reading for everything you need to know about shadow IT, including what forms it can take, the specific risks it poses and different ways you can combat it.<\/p>\n

Grow your business with Sherweb<\/a><\/em><\/h3>\n

 <\/p>\n

Shadow IT is uncontrolled IT<\/h2>\n

Shadow IT is the shorthand term for all devices, applications, cloud services and other unauthorized technology used within an organization. If it connects to corporate IT resources, carries corporate data, or just sits on your corporate network beyond the control of your IT department or MSP<\/a>, then it counts as shadow IT.<\/p>\n

You may recognize this is a widespread problem, but one with a small impact. That is incorrect<\/strong>. Studies have shown that as much as 40%<\/a> of all corporate IT spending is on shadow IT<\/a>\u2014purchases made for IT resources without the involvement or knowledge of the corporate IT department.<\/p>\n

In recent years, it has become such a problem that many companies are accelerating their digital transformation<\/a> timetables to get ahead of it. The thinking is that if the entire IT environment moves to the cloud<\/a>, there\u2019s less space for on-premises shadow systems.<\/p>\n

While the only common trait among all shadow IT is that it is uncontrolled and unmanaged, in practice, MSPs usually see one of four main types of shadow systems.<\/p>\n

Productivity apps and services<\/h3>\n

People like what’s familiar. Employees will often use personal accounts on their preferred productivity apps<\/a> at work because they\u2019re more comfortable with them than with approved corporate systems.<\/p>\n

File storage<\/h3>\n

Similarly, employees often like using personal storage and file-sharing accounts to move work files quickly. In a recent survey conducted by G2, 83% of IT professionals reported that their employees stored company data on unapproved cloud services<\/a>. They may see more secure, approved corporate services as too cumbersome or too confusing.<\/p>\n

Messaging<\/h3>\n

Beyond file and app use, communication is the most common function for which employees use personal or shadow services. If they\u2019re connected to coworkers on a personal messaging service<\/a>, then that communication probably isn\u2019t going to stick to purely personal topics. They may use those insecure channels to discuss company information.<\/p>\n

Email<\/h3>\n

The majority of workers maintain both personal and work email accounts. If they have a personal email tab open on a work device, they may just find it easier to send a quick message from that rather than switching to approved and secured corporate email<\/a>.<\/p>\n

Shadow IT poses many risks<\/h2>\n

Security gaps<\/h3>\n

IT professionals do an excellent job of maintaining and updating corporate IT systems. End users on their own shadow IT services? Not so much. Shadow IT is at higher risk of causing security breaches<\/a> and exposing corporate data. And if a compromised shadow service is connected to company resources, then a determined attacker will look to move laterally from that service to other more valuable corporate targets on your network.<\/p>\n

Compliance concerns<\/h3>\n

Many regulatory standards require specific IT security and management levels; for example, HIPAA<\/a> in healthcare and Sarbanes-Oxley<\/a> in finance. As a result, if your users knowingly or unknowingly move protected data to shadow IT services, your company could become exposed to steep fines and other penalties.<\/p>\n

Inefficiencies<\/h3>\n

Users often turn to shadow IT under the misguided notion that it will make them more efficient. Instead, it creates inefficiencies for the company as a whole, which will inevitably come back to hurt their productivity. For example, a data breach might require many staff to take on extra work during remediation. Additionally, paying out unexpected regulatory fines can eat into future budgets.<\/p>\n

Reduced visibility and control<\/h3>\n

If you don\u2019t know which shadow IT services are used on your network, you can\u2019t formulate reliable strategic plans. The fundamental lack of visibility on which IT services are in use hurts your ability to properly manage your company\u2019s IT environment. You\u2019ll be left reactively jumping from crisis to crisis created by shadow service problems rather than proactively developing your IT program.<\/p>\n

How to combat shadow IT<\/h2>\n

There are many steps you can take to prevent shadow IT from disrupting your IT environment.<\/p>\n

Use discovery tools to find rogue services<\/h3>\n

Start addressing shadow IT by first addressing the lack of visibility and control that allowed it to take root in the first place. IT discovery tools<\/a> can help you identify which unauthorized devices and services are connected to company resources.<\/p>\n

Implement ongoing network monitoring<\/h3>\n

Once you\u2019ve addressed the services already in use, you then need to make sure new ones aren\u2019t added to your company\u2019s IT environment. Various network monitoring tools<\/a> can make you aware of recent, unexpected activity.<\/p>\n

Introduce policies and procedures for acceptable software use<\/h3>\n

Create an acceptable use policy for information technology within your organization. That could mean the use of:<\/p>\n