Shadow IT

Information systems in large organizations can be a source of frustration for their users.[2] In order to bypass limitations of solutions provided by a centralized IT department, as well as restrictions that are deemed detrimental to individual productivity, non-IT departments might develop independent IT resources and for the specific or urgent need or requirements.[4] In some cases, IT specialists could be recruited or software solutions procured outside of the centralized IT department, sometimes without the knowledge, or approval of corporate governance channels.

Shadow IT has traditionally occurred through various sources of Hardware, such as employees bringing in USB drives or spinning up their own servers in offices. Recently Shadow IT has grown due to businesses adopting the cloud. The result has meant that more an more employees are signing up to Software-as-a-Service (SaaS) products to help them complete their jobs and be more productive. As a result, Shadow IT and SaaS Sprawl are now closely aligned and organisations can end up with 100s of SaaS applications that are not visible or centrally managed by the IT department.

There are several approaches that can be taken to mitigate the risks of Shadow IT. One of the main ways is to start creating a security culture and making employees responsible for their departments tooling. In a distributed world the Heads of Departments are often responsible for managing data in SaaS applications as well as which employees have access to those systems. SaaS Security Posture Management is a modern category cybersecurity that aims to help business specifically address security risks associated with SaaS applications. Some focus on identifying sensitive data such as DLP, some are CASB focused and other specifically address the risks of Shadow IT. The first step to tackling shadow IT is to identify the approved and unapproved applications being used throughout your business.[5]

Although often perceived as attempts to undermine corporate governance, the existence of shadow IT often is an indicator of needs from individual departments not being satisfied from a centrally managed information ecosystem. Thus the immediate benefits of shadow IT are as follows:

• Innovation: Shadow IT could be seen as sandbox for potential or prototype solutions in response to evolution of changing business requirements. Also, alignment between departments can be avoided or enhanced dependent on the constraints within the broader business.
• Individual productivity: Shadow solutions are customized to the needs of the individual departments and thus allows the individuals involve to be more effectively. A study[6] confirms that 35% of employees feel they need to work around a security measure or protocol to work efficiently.
• Reduced internal costs: Some shadow policies, such as BYOD, reduces direct hardware and software costs, while allowing localized support decreases overhead for IT departments.

In addition information security risks, some of the implications of Shadow IT are:[7][8]

• Costs: Additional time and investment could incurred at a corporate level on additional integration and validation and compliance of discovered shadow IT infrastructures. On the other hand, department choosing the solutions with the lowest price-tag for their shadow solutions might not have considered costs for deployment and maintenance. This also results in diminished return on investment in case of insufficient buy-in.
• Consistency: As shadowed technical solutions might beyond centralized version control, they might deviate from standardized methodologies or calculations. Multiple, coexisting shadow infrastructures also introduces a heavily fragmented application landscape. This also makes centralized configuration management more difficult.
• Operating inefficiencies: Established shadow solutions might prevent overall implementation of more efficient processes due to widespread use or inadequate documentation. The shadow system might also be beyond the capacity of the centralized IT department for integration and maintenance, especially when it becomes "too big to fail".

Shadow IT increases the likelihood of uncontrolled data flows, making it more difficult to comply with various legislations or regulations, these include, but not limited to:

• Sarbanes-Oxley Act (US)
• Basel II (International Standards for Banking)
• GLBA (Gramm-Leach-Bliley Act),[9]
• COBIT (Control Objectives for Information and related Technology)
• FISMA (Federal Information Security Management Act of 2002)
• DFARS (Defense Federal Acquisition Regulation Supplement)
• GAAP (Generally Accepted Accounting Principles)
• HIPAA (Health Insurance Portability and Accountability Act)
• IFRS (International Financial Reporting Standards)
• ITIL (Information Technology Infrastructure Library)
• PCI DSS (Payment Card Industry Data Security Standard)
• GDPR (General Data Protection Regulation),[10]
• CCPA (California Consumer Privacy Act)
• NYDFS (New York Department of Financial Services) [11]

Within an organization, the amount of shadow IT activity is by definition unknown, especially since departments often hide their shadow IT activities as a preventive measure to ensure their ongoing operations. Even when figures are known, organizations are reluctant to voluntarily admit their existence. As a notable exception, The Boeing Company has published an experience report[1] describing the alarming numbers of shadow applications which various departments have introduced to work around the limitations of their official information system.

According to Gartner, by 2015, 35 percent of enterprise IT expenditures for most organizations will be managed outside the central IT department's budget.[12]

A 2012 French survey [13] of 129 IT managers revealed some examples of shadow IT :

• Excel macro 19%
• software 17%
• cloud solutions 16%
• ERP 12%
• BI systems 9%
• Websites 8%
• hardware 6%
• VoIP 5%
• shadow IT support 5%
• shadow IT project 3%
• BYOD 3%.

Examples of these unofficial data flows include USB flash drives or other portable data storage devices, instant messaging software, Gmail or other online e-mail services, Google Docs or other online document sharing and Skype or other online VOIP software—and other less straightforward products: self-developed Access databases and self-developed Excel spreadsheets and macros. Security risks arise when data or applications move outside protected systems, networks, physical location, or security domains.

• Discussion on Tech Republic
• Industry's First Cloud Adoption and Risk Report
• Shadow IT in the New IT Management Triangle