What Is Shadow IT?
Shadow IT is the unauthorized use of any apps, devices, services, technologies, solutions, and infrastructure without the knowledge, approval, and support of the IT department. Even a project created by DevOps or a user connecting to a third-party service via a corporate cloud app are aspects of shadow IT.
Much of shadow IT consists of cloud-based consumer apps. Research by Netskope revealed that 97% of cloud apps used in the enterprise are shadow IT, unmanaged and often freely adopted. It’s a pervasive and pernicious problem that’s growing rapidly.
According to McAfee’s Cloud Adoption and Risk Report, overall use of cloud services spiked 50% during the pandemic’s shift to hybrid and remote work, with collaboration services climbing by 600%. Meanwhile, external attacks on cloud accounts soared even higher, rising by 630%. All of this makes shadow IT even more of a pressing concern.
Shadow IT Examples
Employees download unauthorized apps or access corporate data from an unapproved device.
This is not done out of malice. Typically, employees simply want to be more productive or innovative. They also may be unaware about company policies regarding information technology and not realize that they’re straying outside company guidelines and IT best practices.
Here are some ways shadow IT sneaks into your environment:
- Your marketing group uses Dropbox to share confidential files with an outside creative agency.
- A software developer downloads and uses APIs without going through the required approvals.
- An employee brings a personal laptop to work and connects it to a private network.
- One of your business units signs up for a new cloud-based storage service that’s not on the organization’s approved list.
Although all these actions support legitimate business needs, they can have serious negative implications.
Are Applications Like ChatGPT Shadow IT?
Yes. Applications like ChatGPT are learning about you based on the questions you ask and context you provide. The information you enter may be stored and used in ways that go beyond answering your question. Never enter corporate data into unauthorized applications, even if they appear to be harmless. This type of data leakage could lead to your data being exposed or used in unexpected ways.
Why Is Shadow IT Dangerous?
In today’s collaborative, mobile world, employees are constantly looking for new and better ways to get their work done.
Whether it’s checking email on personal devices or sharing files via cloud-based apps, some employees are bypassing IT-sanctioned technology and adopting their own solutions. Unfortunately, shadow IT poses tremendous risks to organizations.
When rogue employees bring unapproved applications and devices into an environment —often unwittingly and for seemingly practical reasons — they can expose sensitive data and violate compliance regulations. In addition, they open you up to potential cyber attacks.
In 2019, a survey by Forbes Insights and IBM found that 21% of the surveyed organizations experienced a security event due to shadow IT. And Core Research determines that, in the years since that survey, shadow IT has increased by 59%, due in large part to the shift to remote work, meaning the number of breaches due to shadow IT is only going to keep climbing.
Not all shadow IT technology is fundamentally risky, but the lack of visibility means you don’t know what the risks are — and what you need to do to protect your assets.
Problems With Shadow IT
- You can’t patch shadow IT devices and apps, which leaves them vulnerable to exploits and giving threat actors a way into your organization.
- Consumer-grade technology typically doesn’t have the same security posture as enterprise apps and devices, potentially resulting in data leaks.
- You can’t reinforce data use policies for data stored and processed via shadow IT resources, increasing the risk of sensitive data exposure.
- Without the proper service level agreements with vendors of shadow IT technology, your organization may violate compliance regulations.
How to Reduce or Eliminate Shadow IT
There are steps you can take to minimize your risks from shadow IT. The good news? They’re steps you should already be taking as part of a proactive security posture.
1) Educate Your Workforce
Training your workforce about your organization’s policies and procedures will help you better enforce your cybersecurity and data privacy practices. By creating a security culture, you can also educate employees about the critical role they play in maintaining strong security.
Awareness should also focus on the increased risks of working from home. To minimize the use of shadow IT, provide employees with a checklist of best practices and security requirements for their WFH technology.
2) Monitor your network
Monitoring your network 24×7 gives you crucial visibility into your environment. Use traffic logs to identify which applications are running and which users run those applications.
Network monitoring helps you:
- Discover assets in your environment.
- Identify anomalies in user behavior and network traffic patterns.
- Improve your efforts to adopt only IT-sanctioned, secure solutions.
- Quickly identify and respond to threats.
- In addition to monitoring your network around the clock, consider blacklisting unsecured devices, software, and services.
3) Manage approved applications
IT should publish a list of approved applications and have a process for employees to request new applications or services. IT is there to enable business, not block it. Employees may not be aware that there is an approved solution they can use.
4) Conduct Security Assessments
Conducting security assessments via vulnerability scanning is one of the most-effective strategies for mitigating the risks of Shadow IT. Like network monitoring, vulnerability scanning provides visibility into your environment. But it also goes one step further to help you prioritize your risks.
By identifying vulnerabilities, you can ensure that systems are configured properly and that critical security patches are applied in timely fashion.
5) Use a Zero-Trust Approach
A zero-trust policy requires your users to authenticate their access before they can connect to sensitive areas of the network or critical applications.
With more employees working from home, and many using personal devices, a zero-trust security model will help ensure only authorized users can gain access to company resources.
Additionally, implement multi-factor authentication whenever possible. Relying on passwords alone is particularly dangerous when most of your workforce is accessing your network and data from home.
