What is shadow IT?

What is shadow IT?

‘Shadow IT’ refers to the unsanctioned use of software, hardware, or other systems and services within an organization, often without the knowledge of that organization’s information technology (IT) department. Unlike standard IT infrastructure, shadow IT is not internally managed by an organization.

Shadow IT may enter an organization in different ways, but typically occurs through one of two actions:

1. Using an unapproved tool to access, store, or share corporate data. For instance, if an organization has exclusively approved Google Workspace for file sharing, an employee might introduce shadow IT to the company by choosing to share files via Microsoft 365.
2. Accessing an approved tool in an unauthorized manner. To continue the example, if an IT department has approved the use of Google Workspace through corporate-managed accounts, an employee can introduce shadow IT to the company by choosing to access Google Workspace through an unmanaged personal account instead.

Whether the adoption of shadow IT is intentional or not, it creates serious security concerns and costs. It increases the risk of data breaches, theft, and other cyber attacks, while preventing IT teams from taking crucial steps to minimize the damage those may cause.

Why do users adopt shadow IT?

Given the myriad security risks shadow IT presents, it may seem surprising that employees choose to bypass IT approval when adopting new tools. Their reasons for doing so may include the following:

• Employees are unaware of the security risks inherent to shadow IT. Employees may not be deliberately trying to circumvent the controls their IT department has put in place, but simply do not know that their actions can compromise sensitive corporate data and increase the risk of data breaches and attacks.
• Employees are more focused on the benefits of using unsanctioned tools. The best tools for the job may not be ones that have been explicitly approved by an organization’s IT department. This often drives employees to adopt additional services that help them meet a specific business need, gain a competitive advantage in their market, or collaborate more efficiently.
• Employees are using unapproved tools to carry out malicious activities. Most shadow IT is not adopted for malicious purposes; however, some employees may choose to adopt unsanctioned applications and tools in order to steal data, access confidential information, or introduce other risks to the organization.

What are the risks of shadow IT?

While shadow IT may make some employees’ jobs easier, its drawbacks far outweigh its benefits. If IT teams cannot track how tools and services are used across their organization, they may be unaware of the extent to which shadow IT has pervaded it — and have no idea how corporate data is being accessed, stored, and transferred.

The usage of shadow IT also causes IT teams to lose control over data management and movement. When employees implement unapproved services or work within approved services via unapproved methods, they may be able to view and move sensitive data without appropriate oversight from the IT department. As a result of this lack of visibility and control, shadow IT may create additional risks, including the following:

• Sensitive data may be compromised or stolen. Attackers can exploit configuration errors and vulnerabilities within cloud-hosted services, opening the door to data breaches and other cyber attacks. These attacks may be carried out without the knowledge of an IT department, especially when they target unsanctioned (and possibly unsecured) applications and tools. And remediating these attacks can be costly: in a 2020 study, IBM estimated that data breaches caused by cloud misconfigurations cost an average of $4.41 million.
• Organizations may unknowingly violate data compliance laws. For organizations that need to comply with data protection regulations (e.g. the GDPR), it is imperative that they have the ability to track and control how data is processed and shared. When employees use unauthorized tools to handle sensitive data, they may inadvertently put their organization at risk of violating these laws, which can result in steep penalties and fines.

How can organizations detect and remedy shadow IT?

There are several steps an IT team can take to minimize the effects of shadow IT within their organization:

• Implement shadow IT detection. Using a shadow IT discovery tool can help IT teams discover, track, and analyze all of the systems and services — both those that are approved and unapproved — that employees are currently using. Then, IT teams can create policies to allow, restrict, or block the usage of those tools as needed.
• Use a cloud access security broker (CASB) or adopt a SASE architecture. A CASB (which is included as part of SASE architecture) helps safeguard cloud-hosted applications and services via bundled security technologies, which include shadow IT discovery, access control, data loss prevention (DLP), browser isolation, and more.
• Improve risk management training for employees. Employees may not be aware of the security risks of shadow IT. Training users on best practices — not using personal email to access corporate resources, disclosing the use of any unsanctioned hardware and software, reporting data breaches, and so on — can help avoid the likelihood of data compromise or theft.
• Communicate with employees about the tools they need. Employees often know what tools work best for their job, but may not feel comfortable asking for explicit approval from the IT department due to budget constraints or other concerns. Initiating those conversations and implementing a ‘no-blame’ culture (for those who may have already adopted shadow IT) can help foster a more open and safe work environment.

What is a shadow IT policy?

A shadow IT policy helps establish protocols for the adoption, approval, and management of new hardware and software within an organization. IT departments create these policies and may adapt them according to evolving security risks and the needs of the company.

Shadow IT policies are one of several necessary steps for controlling and managing systems and services within an organization, while avoiding the introduction of any unsanctioned tools. However, many organizations still have not standardized shadow IT policies; in a survey of 1,000 US IT professionals, Entrust found that 37% of respondents said their organizations lacked clear consequences for using shadow IT.

How does Cloudflare protect against shadow IT?

Cloudflare’s Zero Trust security suite helps IT departments easily discover, catalog, and manage unsanctioned tools across their organizations. Learn more about how Cloudflare detects shadow IT.

FAQs

What is shadow IT?

Shadow IT refers to the use of software, hardware, or other digital services within an organization without the approval or oversight of the IT department. This occurs when employees use unsanctioned tools or access approved tools through unauthorized methods. Shadow IT is especially common with the use of SaaS apps.

Why do employees typically adopt shadow IT?

Most employees use unsanctioned tools to work more efficiently or solve specific business challenges that approved tools may not address. In many cases, users are unaware of the security risks involved, though in rarer instances shadow IT may be used for malicious activities like data theft.

What are the primary security risks associated with shadow IT?

Shadow IT creates significant blind spots for security teams, leading to a lack of visibility and control over how data moves. This increases the risk of data breaches through misconfigured cloud services and can lead to unintentional violations of data compliance laws.

How can a cloud access security broker (CASB) help manage shadow IT?

A CASB provides a suite of security technologies designed to protect cloud-hosted services. It helps IT teams discover and analyze the unsanctioned applications being used across the organization, allowing them to implement policies that either allow, restrict, or block these tools to prevent data loss.

What steps can organizations take to reduce the impact of shadow IT?

Organizations can minimize risks by using discovery tools to catalog unsanctioned services and by fostering a no-blame culture where employees feel comfortable requesting the tools they need. Additionally, risk management training helps employees understand why using personal accounts or unapproved hardware puts corporate data at risk.

What is the purpose of a shadow IT policy?

A shadow IT policy establishes clear protocols for how new hardware and software should be requested, approved, and managed. These policies help standardize security practices and ensure that every tool used within the company meets necessary safety and compliance requirements.