What is shadow IT? Shadow IT is an emerging threat to your business, especially as organizations migrate to the cloud and embrace the application age in all its glory.
How does it pose a risk to your business and your data in the cloud? What can your organization do to effectively stop the threat that shadow IT poses to your environment? Let’s take a closer look.
Table of Contents
What is shadow IT?
The definition of Shadow IT, as its name implies, is the use of any unsanctioned or unapproved hardware or software without the approval or knowledge of the IT department or the IT security team within the organization.
You can define Shadow IT as the activities that use products, services, and solutions that do not align with organization-defined policies and requirements related to security, compliance, data governance, and other factors.
What are some of the reasons behind the prevalence of shadow IT in most organizations today? The explosion of public cloud technologies has led to a massive increase in shadow IT operations inside most organizations. The public cloud has made services and solutions available to individuals that would have been science fiction only a few years ago, a reality, and totally achievable within a few clicks (accessing files from anywhere and from any device). Cloud-hosted solutions and services are easily used and can be provisioned in minutes.
Services like using Google Drive, OneDrive, DropBox, Box, and other cloud services generally only require an email address to set up and have tiers that are free. This makes these types of services very appealing to employees looking to have the means to access certain data anywhere and, on any device, especially if they do not have a sanctioned way to do this with business-approved solutions.
Why do employees choose to use shadow IT?
There can be unscrupulous employees who may use unsanctioned apps or tools to bypass restrictions or circumvent policies in place that may be hindering certain types of network traffic or other software they may want to use.
Another scenario that is the most common involves departments that may be looking to speed up productivity or remove barriers to certain projects and objectives by using new tools that may not be approved by IT.
If sanctioned company software and collaboration tools are providing roadblocks to productivity, employees are more likely to start using certain cloud services that help to remove these roadblocks. These include collaboration tools that feature file sharing, team communication, online file storage, and other features.
While the intention is to propel the business forward and remove roadblocks to productivity, these types of shadow IT operations can lead to many very concerning security vulnerabilities and threats to your company data.
Another concerning aspect that contributes to Shadow IT statistics is that most businesses do not have a strategy for how they will deal with Shadow IT in their organization.
A recent report by Entrust Datacard notes that 37% of IT employees say their organizations do not have clearly outlined internal consequences for employees involved in Shadow IT. Also, 77% of IT professionals say that Shadow IT will become a large problem for organizations by the year 2025 if left unchecked.
What are the threats to your business with Shadow IT?
As mentioned, Shadow IT can come about by highly motivated business-oriented employees looking to move the business forward with better tools, quicker productivity, and empowering teammates with what they feel are the tools needed.
However, even from well-meaning employees, Shadow IT can bring about disastrous consequences. Very often, when departments or single employees go about using software and cloud services that constitute Shadow IT, this is done by way of setting up accounts with personal credentials. This opens the door to many compliance and data leak concerns.
Think about several scenarios:
- An employee begins using personal cloud storage to upload and edit sensitive customer data records from your business
- A document containing credit card numbers is created and uploaded to a personal OneDrive account and shared with your other employees using a shared link
- An unsanctioned Amazon S3 bucket is created and utilized by one of your business units looking to remove the limits imposed by sanctioned on-premises storage. However, the S3 bucket is inadvertently left open.
In any of the above scenarios, business-critical data that is stored using the unsanctioned Shadow IT mechanisms leave your business open to many dangerous and costly consequences. Let’s list the main ones:
Using unsanctioned software and services
Departments or individual employees who go down the road of making use of unsanctioned cloud services, due to their lack of technical experience and unfounded assumptions, often make dangerous mistakes when it comes to security. Individuals who lack the expertise or experience using cloud services mistakenly assume that the security of cloud solutions is simply built-in and they don’t have to do anything to ensure data is protected. However, this is not the case as we will see below.
Sharing sensitive information outside of the organization
Not only does Shadow IT involves using software and services that are not sanctioned by the organization for storing and accessing data, but it also allows access to unsanctioned hardware as well. By using a cloud Software-as-a-Service (SaaS) storage application, employees can easily use personal devices to access, edit, and even share information outside the purview of the organization.
This opens your business up to even further security concerns when devices that may not have the appropriate security software and other protections in place are used to interact with sensitive business-critical data. End users, in general, are also very trusting with third-party applications installed on mobile devices. Risky apps can easily be installed that further threaten your business data.
Installing malicious mobile apps
Think of a situation where an end-user installs a malicious application on their mobile device that already has access to a personal cloud environment where they have copied sensitive business data. There is a good chance the malicious application will be granted all the permissions needed to access that data by the end-user during installation. Data leak concerns certainly come to the forefront in that scenario.
Don’t public vendors take care of data security?
By in large, employees that are not technically minded or are not properly trained in security assume that public cloud vendors take care of all the security holes and proper configurations for you. This is just not the case. Most public cloud vendors have what is called a shared responsibility model.
In the case of Amazon, it states the following:
Amazon’s responsibility
- “AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud. This infrastructure is composed of the hardware, software, networking, and facilities that run AWS Cloud services.”
Customer responsibility
- “Customers that deploy an Amazon EC2 instance are responsible for the management of the guest operating system (including updates and security patches), any application software or utilities installed by the customer on the instances, and the configuration of the AWS-provided firewall (called a security group) on each instance. For abstracted services, such as Amazon S3 and Amazon DynamoDB, AWS operates the infrastructure layer, the operating system, and platforms, and customers access the endpoints to store and retrieve data. Customers are responsible for managing their data (including encryption options), classifying their assets, and using IAM tools to apply for the appropriate permissions.”
Each public cloud service provider (CSP) will have its own version of the shared responsibility model. However, they all have similar stances on customer responsibilities.
This helps to emphasize the fact that if your employees are leveraging shadow IT in cloud environments under the purview of your organization, then ultimately, it is the responsibility of your business for any data leakage or other security and compliance repercussions that may result.
Shadow IT increases the likelihood of uncontrolled data flows leading to serious compliance issues
In today’s world where compliance and security regulation implications have “real teeth”, the impacts on your business from Shadow IT operations can be huge. Think about the General Data Protection Regulation (GDPR) where your business can be fined immensely for serious infringements to the regulation.
The official GDPR.eu page cites the following:
- The more serious infringements go against the very principles of the right to privacy and the right to be forgotten that are at the heart of the GDPR. These types of infringements could result in a fine of up to €20 million, or 4% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher.
In the case of serious GDPR violations, the consequences are not insignificant to your business. Think about how your business could potentially be affected by a GDPR violation due to shadow IT operations such as Amazon S3 storage that has mistakenly been left open to the outside world. Shadow IT examples show that the costs could be such that your business might never recover.
In today’s world of very strict and hefty regulations and fines, such as in the case of GDPR, shadow IT is certainly a user activity that your business must at all costs get under control.
SpinOne provides visibility and control of Shadow IT
As shown, Shadow IT can be very damaging to your business in many ways. Even though end users might have the right motivation to remove barriers to more effective business productivity, doing this outside of the sanction of proper IT and security blessing is dangerous.
End users outside of IT or security personnel often do not understand the implications of storing data, sharing data, or collaborating with SaaS applications in the cloud without implementing proper security measures and configurations.
If you are already leveraging cloud SaaS environments like Google G Suite or Microsoft Office 365, how do you ensure your end users are only interacting with sensitive and other business-critical data stored there?
There are two very important aspects of getting a handle on Shadow IT operations in your cloud environment. This includes:
- Visibility
- Control
SpinOne provides a comprehensive suite of cybersecurity tools that allow your business to have both visibility and control over what your end users are doing with your business data stored in the cloud. This by extension allows discovering Shadow IT activities.
SpinOne is an API-based Cloud Access Security Broker that integrates with your G Suite or Office 365 environment. This allows your business to extend on-premises Shadow IT policy to the cloud. This includes providing visibility to how your data is shared, accessed, as well as which third-party applications are allowed to interact with your data.
One of the major features of SpinOne is SpinAudit. SpinAudit plays a primary role in helping to protect your cloud SaaS environment. It is an artificial intelligence (AI) based security platform that constantly watches your cloud account, providing security protection 24x7x365. SpinAudit provides a business risk assessment, security risk assessment, and compliance risk assessment offering for SaaS applications, Chrome Extensions, Android Apps, and non-marketplace apps.
It constantly assesses third-party applications and evaluates whether these are safe for use in your organization. Even apps that have previously been deemed safe are reevaluated with each new release or change.
You can also whitelist or blacklist specific applications in your cloud SaaS environment to keep a strict model of sanctioned applications that can be installed. This helps to eliminate Shadow IT risks to your data from third-party applications. You might be wondering though, what if a user is leaking data to their cloud environment that is not controlled by Spin?
This is the beauty of the visibility, control, and protection offered by SpinAudit. With SpinAudit you always have visibility when someone from your organization or the outside:
- Is Leaking data from sanctioned storage, outside the environment
- Is subject to a Man-in-the-middle (MITM) attack
- Is transferring data to a personal cloud account
- Is installing risky third-party applications
- Is a victim of a ransomware attack affecting cloud data company-wide
- Is in possession of an administrator account and has hijacked those permissions
- Is brute forcing login attempts
- Is purposely or accidentally sharing sensitive data outside of the organization
- Is putting your business at risk of unexpected IT costs, fines, and penalties
Be sure to check out SpinAudit with a free fully-featured trial of SpinOne here.
A typical SaaS environment is invisible to admins. And you cannot manage what you cannot observe. SpinAudit gives you full visibility over your data by monitoring employees who have access to G Suite and using machine learning algorithms to detect abnormal cloud user behavior.
Using the visibility provided by Spin, your organization can use the controls provided by SpinOne to ensure business-critical data is protected and safe from data leaks and other threats such as ransomware.
Key Takeaways
Shadow IT is the biggest cybersecurity risk threatening your cloud environment and business-critical data. There are many reasons that employees may resort to shadow IT activities either intentionally or accidentally. The end result is the same for your business – security and compliance risk.
The results and penalties for both can be significant. By using SpinOne including the SpinAudit module, your business can have the visibility and control needed to combat the risk to your business that comes from shadow IT operations including risky third-party applications.
Read also: