Security risk: shadow IT

Corona. The second wave is here and companies are once again faced with relocating employees to the home office. What does this mean in terms of IT? The use of many mobile devices, the use of cloud solutions and an increase in shadow IT. Shadow IT? If you've never heard of it before, the following sections will help to raise awareness of this topic.

The IT department can only operate securely what it knows.

This sounds logical, but it's not so trivial. According to Gartner, just under half of all companies will switch to a home office solution in the long term. Many companies were and are overwhelmed by the sudden changeover, as there are or were no processes or infrastructure for this type of work.

This means, for example, that although users were given a notebook, they were sometimes free to decide on software, web applications and applications. These applications are therefore invisible to the IT department. A concrete application example:

An employee wants to send a file to another employee. This attachment is too large for an email, so he uses a free platform such as wetransfer.com or DropBox to send the file. What the user does not know, however, is that wetransfer sends the file but also caches the content. So if this file contains sensitive company data, it is now also stored on the provider's servers.

The same applies to the use of apps or cloud applications on smartphones. Another blind spot for many IT departments. Using cloud services is the absolute norm and is rarely scrutinised. The more such services are used, the bigger the shadow becomes. So here is the first, important tip:

Thinking about using a new service or installing an application? Contact your IT department in any case.

Max Mustermann

When there's more shadow than light

Shadow IT can pose a huge risk to the entire company. Applications and tools that you could use right now could torpedo the company's strategic digitalisation efforts. This scenario should be prevented at all costs. Two core drivers for shadow IT can be identified:

Specific requirements from specialist departments

Specialist departments often have problems for which a system-supported solution needs to be found. For example, if the inside sales team does not have a tool to write quotations, it is evaluated how this problem can be solved. If it is not possible for the IT department to offer a prompt solution, it is possible that the employees from the specialist department will resort to freeware on their own to make their day-to-day work easier. The employees are rarely aware that this measure harbours risks.

Bypassing bureaucracy

If no freeware can be found, the only option is usually to submit an official request. This enquiry immediately raises the question of budget: Which budget pot applies and is this pot filled? That doesn't sound like a quick solution, so the option of in-house development is often chosen. However, this scenario is even more dangerous, as there is no further development or maintenance for this type of system. The result: more potential gateways for attackers.

A study by eco makes it clear how big and complex the problem is:

Our own presentation

How to bring light into the darkness

Three steps to regain perspective:

Detect

To reduce shadow IT, you need to evaluate the size of the problem. How can this be found out? By talking to colleagues, of course, but there are also tools that can help, such as Cloud App Security from Microsoft. Once the status quo has been established and all services are known, phase two begins:

Assessment

The evaluation of the tools and services results in a risk assessment on the one hand, but on the other, it also reveals the needs of certain departments. In the next phase, a decision can be made on how these needs can be met, which leads us to phase 3:

Taxes

After the assessment, measures can be taken to close security gaps and strategically purchase software or cloud solutions. In the long term, the IT department will then have full transparency of all IT systems in use again.

Parallel to this, processes should be established to prevent the emergence of new shadow IT.

‍

‍

Sources:

Security risk: Shadow IT