The phenomenon of shadow IT is spreading: According to a survey by it-daily.net, the online portal of the trade magazines it management and it security, there are an average of 52 shadow IT instances in every corporate department. These include software installed by employees without prior consultation with the IT department, as well as legacy devices that are still connected to the system landscape. The reason for the high number of unauthorized software is that a quarter of employees (24 percent) are not satisfied with the options provided by the company, and a large proportion of department heads (77 percent) actually notice an increase in workflow efficiency as a result of using shadow IT. What initially sounds advantageous harbors dangers, as shadow IT can give rise to IT risks with serious consequences.
Shadow IT as a security risk for your company
Free tools for clearer appointment management, cloud-based applications such as Google Docs and Microsoft Office 365, or file-sharing offers to quickly exchange large amounts of data with colleagues: There are countless options on the Internet that can be used to make everyday work more efficient. But the fact is that if software is not introduced into the company through the official channels of the IT department, the necessary security precautions will not take effect. In the worst case, new security vulnerabilities are created, inadvertently exposing access to what should be protected information to cybercriminals. The use of shadow IT is commonplace in corporate practice and is further simplified by uncomplicated access.
Shadow IT also affects legacy equipment
Shadow IT not only affects new downloads, but also old devices: desktop computers that are no longer in use, defective laptops, outdated WLAN routers and printers can provide gateways, because even when switched off, they are still connected to the company network. Instead of separating them cleanly from the IT landscape and completely removing e-mail accounts of former employees, hardware that is no longer needed is often simply set aside and forgotten.
Private devices as potential risk factors
With just a few clicks, a link to the company e-mail account is set up on the private smartphone, or internal documents are sent to the printer in the home office via unsecured networks. Such processes are not easy for management to prevent, after all, not all devices and installations used by employees can be checked – especially if they are private end devices. Nevertheless, companies can take some measures to curb the emergence of shadow IT. One example: If specified processes cannot be implemented efficiently in practice, it is tempting to look for ways to simplify processes on one’s own. Shadow IT is then often downloaded. However, if companies ensure that information and data can be sent, shared and downloaded easily when selecting and implementing new applications and software, they are less likely to resort to free and less secure applications from the network.
The TOP 3 security risks of shadow IT summarized for you
Cyber risks are on the rise, not least because there are more and more technological options and offerings. To give you an overview of the potential dangers posed to your company by shadow IT, here is an overview of the top 3 security risks:
1. promise of work relief
When an employee starts using shadow IT, it is not uncommon for a snowball effect to occur: colleagues are enticed to download applications as well. This lowers the inhibition threshold to upload and share internal data via tools that appear trustworthy.
2. insecure connections
Uploading and downloading data using unsecured apps or systems paves the way for malware, hacker attacks and security breaches. Especially in the case of freeware, people often overlook the fact that the provided data is cached or used for further purposes by agreeing to the terms of use. Caution is also advised with tools that seem harmless at first glance, such as free translation software where the text is simply entered on the website and translated into the desired target language. In the worst case, internal information and customer data can be tapped and fall into the wrong hands; the protective goals of information security – availability, confidentiality, integrity – are thus not guaranteed.
3. non-compliance with guidelines
Unauthorized data sharing through shadow IT means that compliance guidelines specifying the handling of physical work devices (including legacy devices) and digital content are not adhered to and followed. Information security measures cannot be fully effective in this way and a completely closed system cannot be created. In addition, shadow IT can lead to violations of the General Data Protection Regulation (GDPR), for which the company is then financially liable in case of doubt, should a fine be imposed.
Shadow IT thus also entails economic losses for companies. The additional costs incurred to detect and rectify vulnerabilities, as well as the expenses for restoring data and new security concepts, add up in a very short time and present companies with serious difficulties. In the long term, such events can damage a company’s image and reduce confidence in the secure handling of data. For this reason, managers should address the issue of shadow IT at an early stage and keep an eye on what hardware is still connected and no longer in use, what tools are specified by the company, what is desired by employees and whether software has been downloaded independently. Another effective measure is to sensitize employees to the need for secure handling. Security awareness training imparts important basics on correct behavior on the network and familiarizes those involved with the risks that arise, for example, from downloading applications.
Minimize shadow IT and ensure cybersecurity: here’s how
To minimize the risks of shadow IT in your organization and increase your own cybersecurity, there are three important steps you should consider:
Get an overview
First, companies need to get an overview of the apps used by employees. Often, the number of unapproved apps is significantly higher than management assumes. The following questions should be clarified:
- Which applications are used?
- What are the upload and download activities?
- Who uses shadow IT?
- Does the use of shadow IT violate privacy regulations or other important policies?
- Are the applications risky in terms of IT security?
- What old equipment is in circulation and what hazards does it pose?
With a clear IT security tool, such as the one offered by DGC with cyberscan.io®, companies keep track of their IT infrastructures and can continuously check vulnerabilities caused by shadow IT.
Check shadow IT
Shadow IT does not have to be fundamentally bad and can provide for an optimization of work processes. Therefore, the applications should be closely examined for security gaps based on a few questions:
- Which applications that have not been officially released are safe for the company and can continue to be used by employees?
- What shadow IT is not secure and needs to be replaced or removed?
- What secure alternatives are available so that employees can still reap the benefits of the applications?
To test how secure your own systems really are, you can use pentests. Simulated attacks are used to test how robust the IT system is and where there are hidden gateways through shadow IT.
Introduce guidelines
Clear specifications and guidelines help to limit the emergence of shadow IT. Many companies operate according to outdated rules for the acquisition of new systems, which means that some potential is not exploited in a meaningful way. High acquisition costs are often a deterrent at first, but there are useful tools and apps that now cost less than the planned budget. It is helpful if the compliance guidelines clearly specify who is the contact person for the introduction of new software. The IT department is then actively involved and can check and record which solutions are approved – and which are not.
Conclusion
If unapproved software spreads unnoticed in the company, the risk of security vulnerabilities increases. In order to contain shadow IT, it is helpful to get an accurate overview: Which of the tools can be officially introduced into the enterprise for shared benefit? And which legacy devices need to be cleanly removed from the IT landscape? In this way, you ensure streamlined processes and employees experience welcome support in performing their jobs.
Would you like to know what shadow IT is used in your company and how high your risk potential is? Let our experts advise you now.
