What is Shadow IT and why is it so risky?

Shadow IT refers to the practice of users deploying unauthorized
technology resources in order to circumvent their IT department.
Users may resort to using shadow IT practices when they feel that
existing IT policies are too restrictive or get in the way of them
being able to do their jobs effectively.

An old school phenomenon

Shadow IT is not new. There have been countless examples of
widespread shadow IT use over the years. In the early 2000s, for
example, many organizations were reluctant to adopt Wi-Fi for fear
that it could undermine their security efforts. However, users
wanted the convenience of wireless device usage and often deployed
wireless access points without the IT department’s knowledge or
consent.

The same thing happened when the iPad first became popular. IT
departments largely prohibited iPads from being used with business
data because of the inability to apply group policy settings and
other security controls to the devices. Even so, users often
ignored IT and used iPads anyway.

Of course, IT pros eventually figured out how to secure iPads
and Wi-Fi and eventually embraced the technology. However, shadow
IT use does not always come with a happy ending. Users who engage
in shadow IT use can unknowingly do irreparable harm to an
organization.

Even so, the problem of shadow IT use continues to this day. If
anything, shadow IT use has increased over the last several years.
In 2021 for example, Gartner found^[1]
that between 30% and 40% of all IT spending (in a large enterprise)
goes toward funding shadow IT.

Shadow IT is on the rise in 2022

Remote work post-pandemic

One reason for the rise in shadow IT use is remote work. When
users are working from home, it is easier for them to escape the
notice if the IT department than it might be if they were to try
using unauthorized technology from within the corporate office.
A study by Core^[2]
found that remote work stemming from COVID requirements increased
shadow IT use by 59%.

Tech is getting simpler for end-users

Another reason for the increase in shadow IT is the fact that it
is easier than ever for a user to circumvent the IT department.
Suppose for a moment that a user wants to deploy a particular
workload, but the IT department denies the request.

A determined user can simply use their corporate credit card to
set up a cloud account. Because this account exists as an
independent tenant, IT will have no visibility into the account and
may not even know that it exists. This allows the user to run their
unauthorized workload with total impunity.

In fact, a 2020 study found that 80% of workers admitted to
using unauthorized SaaS applications. This same study also found
that the average company’s shadow IT cloud could be 10X larger than
the company’s sanctioned cloud usage.

Know your own network

Given the ease with which a user can deploy shadow IT resources,
it is unrealistic for IT to assume that shadow IT isn’t happening
or that they will be able to detect shadow IT use. As such, the
best strategy may be to educate users about the risks posed by
shadow IT. A user who has a limited IT background may inadvertently
introduce security risks by engaging in shadow IT. According to
a Forbes Insights report^[3] 60% of companies do not
include shadow IT in their threat assessments.

Similarly, shadow IT use can expose an organization to
regulatory penalties. In fact, it is often compliance auditors –
not the IT department – who end up being the ones to discover
shadow IT use.

Of course, educating users alone is not sufficient to stopping
shadow IT use. There will always be users who choose to ignore the
warnings. Likewise, giving in to user’s demands for using
particular technologies might not always be in the organization’s
best interests either. After all, there is no shortage of poorly
written or outdated applications that could pose a significant
threat to your organization. Never mind applications that are known
for spying on users.

The zero-trust solution to Shadow IT

One of the best options for dealing with shadow IT threats may
be to adopt zero trust. Zero-trust is a philosophy^[4] in which nothing in your
organization is automatically assumed to be trustworthy. User and
device identities must be proven each time that they are used to
access a resource.

There are many different aspects to a zero-trust architecture,
and each organization implements zero-trust differently. Some
organizations for instance, use conditional access policies to
control access to resources. That way, an organization isn’t just
granting a user unrestricted access to a resource, but rather is
considering how the user is trying to access the resource. This may
involve setting up restrictions around the user’s geographic
location, device type, time of day, or other factors.

Zero-trust at the helpdesk

One of the most important things that an organization can do
with regard to implementing zero trust is to better secure its
helpdesk. Most organizations’ help desks are vulnerable to social
engineering attacks.

When a user calls and requests a password reset, the helpdesk
technician assumes that the user is who they claim to be, when in
reality, the caller could actually be a hacker who is trying to use
a password reset request as a way of gaining access to the network.
Granting password reset requests without verifying user identities
goes against everything that zero trust stands for.

Specops Software’s Secure Service
Desk^[5] can eliminate this
vulnerability by making it impossible for a helpdesk technician to
reset a user’s password until that user’s identity has been
proven. You can test it out for free^[6] to reduce the risks of
shadow IT in your network.