Cloud

5 Steps to Proactively Address Unauthorized IT in the Office

Businesses can reduce and secure shadow IT without impeding productivity.

Tanya Candia is an international management expert, specializing for more than 25 years in information security strategy and communication for public- and private-sector organizations.

The term “shadow IT” has been around for several years — and for years, shadow IT itself has vexed IT departments. The practice of using applications and systems without the explicit approval of IT staff, or sometimes even without their knowledge, poses real challenges for businesses, particularly now that more employees are working from home.

Shadow IT is widespread in business. The Everest Group reported last year that the cost of dismantling shadow IT accounted for 50 percent or more of IT spending in large enterprises. Considering the pervasive nature of cloud-based services and the popularity of hybrid cloud environments, the Cloud Security Alliance believes the situation is likely much worse today.

Shadow IT Can Be A Slippery Slope

Shadow IT grows due to lack of awareness, both on the part of the user and the IT department. A wide variety of tools are brought into the business under the radar, without explicit IT approval or knowledge.

A user needs something to get the job done and, without thinking, signs up for a web-based application: Need online messaging? Why not the same WhatsApp you employ for your personal life? Want to do a VoIP or videoconference call? If you don’t love the videoconference solution your employer offers, why not just use the free version of Zoom you use at home? Need to transmit large files? It’s easy to sign up for a Dropbox account, particularly when you’re trying to get the job done remotely.

But in none of these scenarios is any thought given to control, management or security. Self-reliance is often a virtue, but not when it puts the business at risk.

The IT department may be blind to the issue, with no clue as to how many unauthorized apps are being used, particularly when those applications are connecting from a home office.

It’s often unclear what security protections the applications are using, and frequent reuse of login credentials, weak passwords and phishing attacks leave user accounts on unauthorized services vulnerable.

With shadow IT, there is also the problem of application confusion and oversaturation. It’s messy when individual workers are deciding for themselves which messaging application or file-sharing service to use.

How to Protect Against Unauthorized Access

Unauthorized software may not meet the security standards required by the business. There are several categories of risk that need to be considered:

Data protection issues: Where is the data being stored? How is it protected? Can the user upload sensitive data to the cloud, where it could be leaked? Is data encrypted? Who controls the encryption keys? Can the user download files that contain malware and spread them to other members of the team?
Compliance: The business’s compliance efforts may be squandered if the actual state of software is unknown. Will use of the service put the business in conflict with industry regulations or even laws?
Software asset management: Licenses procured without IT knowledge expose the organization to risk, potentially with severe sanctions. How do unknown applications and data relationships impact the carefully populated configuration management database?

How to Develop Proactive Prevention

Fortunately, the sea of shadow IT is not as murky as it may seem. The best approach involves five steps:

Establish a baseline of acceptable applications. Recognize there are probably many instances of shadow IT in your organization, most of which use well-known tools such as mail, messaging, conferencing and large file transfer services. Focus on the most popular ones and determine if you can sanction a subset of them.
Clarify the policy. Establish a clear policy as to which devices, systems and software employees can use. Communicate that policy to all employees — not just once, but often. Remember that consistent user education strengthens your first line of defense.
Gain visibility. Detect and catalog all software running in the organization by using a software asset management solution such as the Ivanti IT Asset Management Suite. This can integrate compliance, license entitlement, discovery and more in one interface.
Triage unacceptable risk. Conduct a detailed analysis of the risks associated with unauthorized applications. A cloud access security broker, such as McAfee MVISION, ensures real-time data protection. For tighter control with virtual desktop infrastructure tools such as Citrix XenDesktop, let IT control a secure desktop image with only sanctioned applications.
Create a long-term plan to fill functionality gaps. Run strategic analysis of usage patterns. Recognize that the organization needs a full range of tools and services in order to function properly.

Employees are constantly trying to do their jobs as efficiently as possible, particularly when they are working out of the office. It’s up to IT to provide employees with secure solutions that make their jobs easier.

Shadow IT is a problem, but it serves one good purpose: It provides a view of what capabilities employees really need, while SAM, VDI and CASBs can help IT exercise control and governance over the entire landscape of applications. As always, user education plays a key role.

alvarez/Getty Images