Contributor: C. Gene McClain, CFCE, CCLO, CCPA, MCFE, Director of Forensic Services
In today’s fast-paced work environment, employees often seek out tools and applications that help them perform their tasks more efficiently. While productivity is a valuable goal, using unapproved applications—known as “shadow IT”—poses significant cybersecurity risks for organizations. As cybersecurity threats continue to grow, businesses must be vigilant in managing these unofficial tools and understanding the hidden threats they bring.
For our final article in recognition of Cybersecurity Awareness Month, we will explore the rise of shadow IT, how it affects cybersecurity, and the steps organizations can take to mitigate these risks.
What is Shadow IT?
Shadow IT refers to the use of unauthorized hardware, software, or cloud applications within an organization, often without the knowledge or approval of IT departments. Shadow IT can take many forms, from popular productivity tools like Dropbox or Google Docs to instant messaging apps, virtual private networks (VPNs), or even personal devices used to access company resources. This trend has gained traction as remote work, bring-your-own-device (BYOD) policies and cloud-based services have become commonplace.
The 2020 State of Cloud Security Report by Netskope found that 97% of cloud applications used in the average enterprise were not managed by IT, reflecting a significant level of shadow IT use. Employees often turn to these tools to improve workflow or bridge gaps left by organizational tools. However, because IT has no oversight of these tools, they can introduce vulnerabilities and expose sensitive data to risk.
Why Do Employees Use Shadow IT?
Understanding why employees turn to shadow IT is essential for organizations to create effective policies to control it. Some common reasons include:
- Enhanced Productivity: Employees often use shadow IT tools to simplify tasks or improve collaboration, especially when existing organizational tools are cumbersome or inadequate.
- Remote Work Flexibility: As remote work continues, employees are more likely to use personal devices and applications to complete tasks from various locations, creating a shadow IT ecosystem.
- Lack of IT Support or Slow Approval: Sometimes, IT departments are overloaded, making the approval process for new software slow or restrictive. Employees turn to shadow IT when they feel the organization’s tools don’t meet their needs.
- Evolving Technology Preferences: New applications and services are constantly being developed, and employees are quick to adopt the latest technology trends to keep up with the demands of their jobs.
These reasons are understandable, but they also highlight a fundamental challenge: employees are prioritizing convenience over security, often without fully understanding the risks they introduce.
The Risks of Shadow IT in Business Cybersecurity
The use of shadow IT poses serious cybersecurity risks, which can lead to data breaches, compliance issues, and other adverse outcomes.
- Data Breaches and Unauthorized Access
Because shadow IT applications are not managed by IT departments, they often lack proper security protocols. This increases the likelihood of data breaches. Employees may inadvertently share sensitive information through these unapproved apps, which may not have encryption or adequate access control.
For instance, employees using a personal Google Drive account to store company documents may expose confidential information if their account is hacked. According to a 2022 report by McAfee, around 40% of corporate data stored in unmanaged cloud applications could be classified as sensitive. This shows how much valuable information is stored on platforms that may need more robust security features.
- Lack of Visibility and Control
When employees use unapproved apps, IT teams lose visibility into where company data is stored and who can access it. This lack of control makes it harder for businesses to monitor their data, apply security patches, or detect and respond to suspicious activity. Without this oversight, it is challenging for organizations to protect their data from malicious actors.
- Increased Vulnerability to Cyberattacks
Unapproved applications often lack the security standards that vetted applications provide. For instance, many cloud services do not offer adequate data encryption or rely on weak user authentication methods. As a result, these tools become entry points for cybercriminals. A 2021 report by IBM found that the average data breach cost due to unapproved cloud usage was $4.24 million, highlighting the financial impact of shadow IT.
- Compliance and Regulatory Risks
Many industries are governed by strict data privacy regulations, such as the GDPR in Europe, HIPAA for healthcare, and the CCPA in California. Shadow IT often does not comply with these regulations, exposing businesses to legal and financial penalties. When sensitive data is stored in unauthorized applications, organizations lose control over their compliance efforts and increase the risk of regulatory violations.
- Inefficient Incident Response and Recovery
When shadow IT applications are used, IT departments often struggle to respond to cybersecurity incidents promptly. If a breach occurs in an unapproved app, IT may be unaware of the incident, making it challenging to contain and recover from the breach quickly. The time lag in incident detection and response can result in higher recovery costs and more significant damage.
Real-World Examples of Shadow IT Vulnerabilities
Several notable breaches have demonstrated the dangers of shadow IT:
– Target’s Data Breach: One of the most notorious data breaches, the Target attack of 2013, was facilitated by shadow IT. An unapproved HVAC contractor’s access was compromised, enabling hackers to infiltrate Target’s network, leading to the exposure of 40 million credit card records.
– The Capital One Breach: In 2019, a vulnerability in Capital One’s cloud misconfiguration exposed the personal information of over 100 million customers. Though not strictly a case of shadow IT, the breach highlighted how unauthorized or poorly managed cloud applications can result in devastating data loss.
How Businesses Can Manage and Reduce Shadow IT Risks
While shadow IT is unlikely to disappear entirely, businesses can manage the associated risks with a proactive approach.
- Conduct a Shadow IT Assessment
Organizations should start by evaluating the extent of shadow IT in their environment. This can involve using network monitoring tools to detect unapproved applications or surveying employees about the tools they use. By understanding what apps are in use, IT departments can develop strategies to mitigate associated risks.
- Implement a Robust IT Governance Policy
Creating and enforcing a comprehensive IT policy is essential. This policy should outline acceptable use of applications, data storage guidelines, and security protocols. Employees need clear guidelines on the importance of using approved applications and the potential risks of shadow IT.
- Encourage Collaboration Between IT and Employees
Encourage open communication between IT teams and employees to foster a culture where employees feel comfortable discussing their tool needs. By understanding employees’ technology requirements, IT can recommend secure alternatives or approve new tools to meet those needs.
- Adopt a Zero Trust Security Model
The Zero Trust security model assumes that every request for access, whether from inside or outside the organization, could be a potential security threat. Zero Trust models verify the identity of each request, minimizing the risks associated with shadow IT. This approach involves multi-factor authentication (MFA), role-based access control, and continuous monitoring.
- Utilize Cloud Access Security Brokers (CASBs)
CASBs are tools that provide visibility into cloud usage and help enforce security policies. By monitoring cloud application usage, CASBs detect unauthorized apps and protect company data. They can be particularly effective in identifying and managing shadow IT, ensuring that unapproved applications are flagged and monitored.
- Regular Employee Training and Awareness Programs
Employee education is crucial in managing shadow IT risks. Regular training programs can help employees understand the importance of cybersecurity and the dangers of using unapproved tools. When employees understand these risks, they are more likely to follow IT policies and best practices.
Balancing Productivity with Security
While shadow IT is often seen as a security liability, it also represents employees’ genuine desire to work efficiently. Striking a balance between productivity and security is essential for businesses looking to address shadow IT without stifling innovation.
Offer Secure Alternatives
Instead of banning all unapproved applications, companies should invest in secure, user-friendly alternatives. By providing employees with modern, efficient tools that meet their needs, businesses can reduce the likelihood of shadow IT while keeping productivity high.
Establish a Fast-Track Approval Process
To reduce the temptation of shadow IT, create an efficient process for employees to request new tools. When employees can quickly request and obtain approval for new applications, they are less likely to turn to unapproved options.
Conclusion: The Importance of Managing Shadow IT
Shadow IT is a complex challenge in today’s digital workplace, driven by employees’ need for efficiency and flexibility. While these unapproved tools may seem innocuous, they introduce significant cybersecurity risks, from data breaches to compliance violations. By understanding the motivations behind shadow IT, establishing strong governance policies, and implementing security tools like CASBs and Zero Trust, organizations can mitigate these risks.
As cybersecurity threats continue to evolve, businesses must remain proactive in managing shadow IT. This Cybersecurity Awareness Month, consider evaluating your organization’s approach to shadow IT and ensuring that employees have the resources they need to work securely and efficiently.
Sources:
- Netskope. “2020 State of Cloud Security Report.”
2. IBM. “Cost of a Data Breach Report.” 2021.
