What Is Shadow IT and How Do You Manage It?

There was a time when the IT used within an organisation was exclusively provided and approved by that organisation. CIOs might look back on those days with fond memories of security, compliance and low risk. If you had a problem, the IT department would sort it – after all, no one else could.

Today, there’s the “official” IT department way of doing things and there’s the unauthorised or “shadow” solution – the one the organisation doesn’t know about. IT users, keen to find a workaround for their problems, are less patient, more informed and much more inventive. And, while this activity comes with security and compliance risks, the more enlightened organisation may appreciate there’s something they can learn – if they are prepared to get to the root of the causes. 
 
This article looks at what causes incidents of shadow IT, where the risks lie, and how the organisation can both manage and learn from it.

Shadow IT is when employees use hardware, software, or cloud-based services for business purposes, without the centralised IT department being aware of, or approving, that usage. In other words, the behaviour – while it may be to work more effectively or conveniently – is not necessarily supported by the business. Any tools used won’t have been developed or authorised by IT.

In many cases, shadow IT is a well-intentioned initiative. People want to get their jobs done, and the solutions they feel they need are no longer the sole domain of the IT department. In many respects, shadow IT is a legacy or extension of BYOD (Bring your own Device). We are just too used to using our own devices and finding our own workaround solutions – just like we would on our IT at home.

Typical shadow IT workarounds are commonplace, using apps, software and sometimes hardware (e.g. Wi-Fi/Mi-Fi) many of us are familiar with. The popularity and everyday use of these can make them seem like standard practice, whether they are officially approved or not. They often include: 

• Use of WhatsApp and other online messaging services for organisational business. 
• Use of USB flash drives and other portable data storage devices. 
• Gmail and other email service providers outside of the organisation. 
• Dropbox, Google Docs and other document sharing. 
• Skype and other online VOIP (Voice Over Internet Protocol) software. 

IT users are busy, they often want to: 

• Save time, get on with the job and meet deadlines. 
• Access and share data quickly and often remotely. 
• Avoid complex IT policies and “going through” IT. 
• Work with software they are familiar with and can purchase easily. 
• Work with something compatible with their own devices. 

The use of shadow IT can be intensified when organisations are operating dated IT infrastructure that only frustrates business requirements, putting pressure on IT users who can see a quicker fix than waiting for any official solution. 

What’s more, the cloud has made it much easier to purchase software with many low-cost or free apps from a vast number of SaaS (Software as a Service) providers.

• Increased risk of data loss: The IT department can’t back up software they don’t know is present in their networks. If the data lost is critical to a business or its customers, the loss could have serious consequences with the possibility of fines. 
• Increased risk of data breach: The IT department will not know who has access to data as it is effectively under their radar. No records will exist of who is seeing, copying or transferring data. Not a good thing for those who need to comply with GDPR. 
• Increased cyber security risks: Hackers often access the weak spots in software to gain illegal access to data and systems. Software vendors try to prevent this by issuing patches where they are aware of vulnerabilities. That’s fine when the organisation knows what software is being used; when it doesn’t, hackers can find the weak spots easier. In many cases, the software being used in shadow IT is designed for domestic purposes and doesn’t meet the strict security and governance needs of an organisation. 
• Increased risk of non-compliance: The presence of unmanaged data, software and hardware makes it impossible to meet security standards such as PCI-DSS (Payment Card Industry Data Security Standard) and regulations such as GDPR. 
• Increased risk of importing malware: There have been multiple cases of software having malware attached to it. If your IT users introduce unofficial software into your organisation, the risk of malware increases. 
   

The issue with using shadow IT is really one of risk appetite. It may be the IT department has a business-endorsed risk appetite and its approach to cyber-based risk is relatively high. In this scenario, a decision may be made to let the business get its work done than developing overzealous security controls.

Or it may be the business-endorsed risk appetite is extremely low. The business impact of a cyber incident would be catastrophic for the business, and therefore, strict adoption of the security controls is essential.

Neither of these approaches is “wrong”; it is a decision based on the unique attributes of the business.

We live in a time of high-profile data and security breaches. Shadow IT is an obvious contributor to risk but, as we’ve discussed, there are reasons why people take that risk. So, understanding the causes and motivations for shadow IT is a good way to start.

If you are able to identify the reasons why your IT users are turning to shadow IT and propose workable solutions, you will stand a better chance of reducing both the problem and the risk that comes with it.

It’s a little like your IT users are your internal customers – how can you keep them onside, rather than have them do their own thing? To discover more, you could ask your IT users: 

• What are the frustrations that led to the IT department being bypassed? 
• What are their challenges, and why and how did their solutions make their life easier? 
• How can you help them implement the IT they need? 
   

As with any attempt to manage a situation, the best results involve understanding all sides of the problem. It involves a communication process and being prepared to learn from what you hear back. Here are some talking points to get the conversation going:

• Is your approval process taking too long? Perhaps IT is perceived as too controlling? Your IT users want to move with pace and innovate – are you holding them (and your business) back? 
• Are your policies and guidelines pragmatic and clear? Your existing rules, requirements and policies regarding app and data usage should be based on your risk appetite, be clear and properly communicated. To avoid confusion, they should be simple and easy to understand and not too restrictive, where possible. 
• Do your IT users properly understand the risks? You need to get them to understand the problems that shadow IT resources pose – and why you adhere to the security approach you’ve adopted. 
• Are some solutions OK to use? For example, and depending on the risk appetite, many end-user apps and reports are built within the framework of third-party software that comes with comprehensive governance and security standards in place. 
• Can you learn from their innovation? Your IT users may have developed an effective solution that serves their needs best. Provided it can meet the appropriate security and governance requirements, could it be adopted and bring benefits?

Shadow IT is an obvious security risk, and while the IT department has every right to put security controls in place, there may be room for compromise. By better understanding what your IT users are trying to achieve with their shadow IT solutions, you’ll be better able to serve their needs and manage IT security.

You may find that, while they might have bent the rules, they may also have been working in a more agile and efficient way which could benefit the business. With transparency and the right security measures in place, the organisation could be stronger for it.

The way forward relies on a better understanding of both sides’ needs – and in particular, where shadow IT sits in relation to the organisation’s risk appetite.