Consider this, your phone gets a call from the CEO at 3 AM. “Can you get here real quick? There’s been a data breach. Someone’s exfiltrating our customer data.” With the entire company coming to a halt – the apps being down, emails frozen, and thousands of customer calls swarming in with complaints, you might’ve landed yourself into an IT Manager’s absolute worst nightmare. Shadow IT being at the helm of it.
According to Productiv, approximately 42% of an average company’s digital solutions are the result of shadow IT. But what is it exactly?
What is Shadow IT?
Shadow IT refers to any hardware or software within an organization that is used by employees without the IT or security department’s knowledge and approval. It can range from personal hard drives used to store work-related information to cloud-based productivity or collaboration tools that employees sign-up for on their own, and much more.
While seemingly innocuous, it can pose a great threat to your company’s tech ecosystem.
Key Risks of Shadow IT
There’s a couple of reasons why shadow IT is notorious in the software asset management space.
1. Security vulnerabilities
First, shadow apps lack the security vetting and updates that your team would normally do for authorized apps – hence leaving them wide open to data breaches and exploits.
Think of them as a back door that your team didn’t build and therefore, can’t secure. It might be convenient for those who use it, but it’s an easy way for burglars to get in without being noticed.
The lock can easily be broken..!
This also means that any sensitive company data stored in shadow applications may not be adequately protected. Remember the example from above? That’s exactly how it can unfold for you.
Plus, the lack of visibility and control into shadow apps means it’s impossible for you to monitor security threats or enforce security policies. Since they’re off your radar, it’s harder to patch any entry points for attackers.
2. Compliance violations
If you work in an industry or a region that is heavily regulated by data privacy and security laws like the GDPR or HIPAA, then you should be concerned about shadow IT. Many shadow apps might bypass local regulations, increasing the likelihood for your teams to face costly lawsuits.
Plus their data storage protocols might differ from data residency laws prevalent in your region, making compliance more cumbersome. You might end up unknowingly violating certain regulations, putting you in unwarranted legal trouble.
Additionally, auditing and demonstrating compliance becomes much more difficult. Your team might have to spend significant time and resources trying to retroactively assess the compliance status of these systems.
3. Increased burden on IT
Shadow apps simply mean added burden for your team. As a manager, you wouldn’t want that.
Many shadow apps may not be compatible with the existing tech infrastructure in your company. This can lead to integration problems in the future.
Additionally, with separate teams using shadow apps for the same purposes, there might be duplication of effort and data storage. There’s also a chance of data inconsistency and silos, making it difficult to easily access all the relevant information needed for making certain business decisions.
Plus, when problems arise with shadow apps, the onus can fall on IT departments to solve such issues even if they lack control or adequate information about these systems.
This just means more, uncalled-for work for your team!
4. Un-budgeted costs
Perhaps the most harmful risk of shadow IT is the unbudgeted costs. Since shadow IT spending happens outside of approved company budgets, there might be dire financial consequences. You could be at the risk of overspending!
And on top of that, you might get hit with lawsuits if there are security problems. That’s a financial mess waiting to happen.
If shadow IT’s too bad, why do many employees still end up opting for it?
Why do employees go for Shadow IT?
1. The need for speed
Employees working in fast-paced tech environments usually look for quicker solutions. They may see software vetting processes as unnecessarily long or bureaucratic, prompting them to look for solutions on their own.
For instance, the marketing team in your company may need to launch a quick social media campaign and they’re looking to use an AI video editing platform for rolling out videos without having to hire a freelancer.
However, with the company’s vetting process, they may have to wait for the platform to get approved by IT, which may push their launch campaign far into the future. A readily available free tool bypassing IT’s radar would be their go-to pick in this case.
Comment
byu/Boogsterio from discussion
insysadmin
2. Preference for the familiar
You may have heard that familiarity breeds contempt. Well, that’s typically not true for apps that people have to use daily. The more an app is used, the more it learns and the more helpful it becomes for the people using it.
Therefore, familiar apps tend to stick better with people, especially if they’re being used daily for work. They’re simply more convenient and efficient; who cares if they were officially sanctioned by the company?
An example of this is when your employees are accustomed to using a file-sharing or collaboration tool for sharing or saving useful information. This could be a discord channel or a personal trello board. They might be using these channels for sharing personal stuff and might intuitively use the same when at work, even if the company has approved alternatives for document sharing. It’s just a matter of habit.
3. Lack of awareness on risks
Other times, employees may simply lack the awareness surrounding possible IT risks. They may not understand “why” certain IT policies are in place. Unaware of how their use of shadow IT can affect the company, they often just go ahead and install unvetted software.
This indicates that you need to train your employees on IT risks and the importance of adhering to IT policies. If you already do, perhaps your current training stack is too complex for employees to understand. Or maybe, your internal communication channels are not effective enough, making it hard to disseminate crucial security information across the company.
Whether it’s out of the need for agility, convenience, or lack of awareness on IT risks, use of shadow IT can be disastrous. But, how do you discern whether it exists in your company or not?
Key signs of Shadow IT in your company
We’ve curated a list of telltale warning signs that suggest shadow IT may be looming over your business. We know that IT Managers and Systems Admins despise alert fatigue stemming from false alarms. Don’t worry, we’ll stick to the most important signs only.
So, what are some signs to catch shadow IT early on before it becomes an uncontrollable beast?
1. Help desk tickets requesting access for unfamiliar software
This is a pretty common one. Your Systems Administrator might receive a lot of help desk tickets from employees for access to software applications that they weren’t even aware of. Or, employees could also be raising tickets related to issues they encounter with a software that was off your team’s radar.
Imagine getting a bunch of calls about QuickTask Pro, a project management tool that doesn’t ring a bell? When your help desk starts receiving a surge of tickets about software you don’t recognize or support, it’s a strong indicator of Shadow IT.
Comment
byu/LucyEmerald from discussion
insysadmin
Read so far? Great! We won’t just be flagging the signs but also suggesting fixes for them.
Fix #1 – Empower employees with easy software access while maintaining security
Enable easy software requests:
- Create a simple online catalog where employees can easily request the software applications they need for their daily tasks. Think of this as an online store but for internal company software tools.
- Once employees submit a request, it should automatically go to IT for review and approval. This will ensure that all software requests meet security and compatibility standards.
- To make the catalog super accessible, you can embed a link to it directly on your company’s internal website, so everyone can find it easily.
Train your help desk staff on spotting shadow IT:
- Train your staff on how to recognize when employees are using software that hasn’t been approved by IT (hint: this blog’s an example).
- Plus, give them a special tool to log instances of unauthorized software use, including the date, time, and device. This detailed record-keeping will help your team quickly identify and address any potential problems in case an event as serious as a breach happens. It’s also crucial for compliance audits.
Communicate any approved alternatives:
- When you find employees using unauthorized software, make sure they know about approved alternatives that offer similar capabilities.
- You can communicate this by sending company-wide emails or pinning the approved list in an IT-dedicated slack channel.
2. Discrepancies between SaaS inventory and actual usage
Has it ever happened to you that you’re running a routine network scan and find your numbers to be way off?
For instance, you had set the authorized license count for Adobe Creative Suite to be 50, but the scan revealed the install count for Adobe Creative Cloud to be 70.
This discrepancy hints at two things.
Either employees are using unauthorized copies of Adobe OR sharing license seats, both of which are violations when it comes to software licensing. This can be a direct hit to your IT budget and a potential legal risk for audit non-compliance.
Fix #2 – Take control of your software assets with automation, audits, and clear policies
Automate software scans:
- Deploy a Software Asset Management tool that automatically keeps track of all the software being used in your company.
- This tool acts as your IT detective, periodically scanning all employee devices to see what software is installed, including any unauthorized copies. It automates the process of software discovery, helping you stay on top of your SaaS inventory, and license management.
- It’s best if the tool can normalize different versions of the same software installed across employee devices, giving you a comprehensive snapshot of total license agreements required per vendor.
Conduct regular software audits:
- Use the SAM tool to generate monthly reports that show you exactly what software is being used and if you have the correct licenses for it.
- Quickly identify and fix any licensing issues and ensure that you’re always compliant.
Set clear rules and controls:
- Make sure everyone in your company understands the rules about software use. Conduct regular employee training to clearly communicate your software licensing policies.
- Update the company’s IT policy to explicitly prohibit software sharing among employees. List risks of license sharing for employees to better enforce this policy.
- Where possible, also put technical safeguards in place (like license servers) to prevent unauthorized software sharing.
3. Employees using personal emails for work
A common practice among employees for getting work done faster is the use of personal Gmail or Yahoo accounts for accessing or sharing company documents. This might seem harmless initially, however it’s a major violation of security protocols as it may expose sensitive company information beyond the company’s secure file transfer system.
Fix #3 – Mitigate use of personal emails for work with a multi-faceted approach
Provide viable alternatives:
- Offer your employees an easy-to-use, company-approved system for sharing files internally and externally. Remember, this should be a key focus – if you don’t offer a good alternative, employees will likely continue to use personal email out of convenience.
- Provide regular training on how to use company-approved tools and systems effectively. This will address any concerns about efficiency and ease of use.
Clearly communicate the risks:
- Don’t just say “it’s against the rules”; we don’t want you becoming a cybersecurity nazi. Explain why not to use personal emails for work. Emphasize the risks of data breaches, potential legal issues, loss of control over sensitive information, and the higher vulnerability to phishing attacks. Use real-world examples of data breaches caused by similar IT violations. The Okta 2023 attack is a great example.
- Explain that the company has minimal control over data when employees use personal email for data sharing. This means no backups of work, no ability to track access, and no way to retrieve information if an employee leaves the company or is on holidays.
- A critical implication is violation of industry regulations (like HIPAA, GDPR, or SOX). Make sure to inform your employees and expose the company to legal and financial penalties.
Address any unmet gaps:
- Conduct surveys or focus groups with your employees to understand why they resort to using personal email. Are the company’s tools inadequate? Does the training lack important stuff? Are there any workflow issues? Or, is it mere habit? Addressing these root causes is crucial to preventing use of personal emails in the future.
- Regularly gather feedback from employees on the company’s communication and collaboration tools. This can help identify any unmet needs and ensure that the provided solutions meet the specifications of your employees.
4. Every team having independent budget for software purchases
Let’s say you’re in a budget review meeting with the CFO and other department heads and you find that a major chunk of the marketing budget is assigned to implementation of a marketing automation software. Once discussions start happening about the ROI of this software, it might catch you by surprise. Because guess what, the marketing team made this decision independently. If this tool performs below the promised ROI, it might land your team in hot water because you were in charge of software procurement decisions.
To make things worse, some functionalities of this automation software are already offered by the existing CRM tool. Plus, there’s integration issues leading to extra costs. This highlights a lack of centralized control over software spending.
Fix #4 – Centralize software purchase process
Work with other teams to assess their software needs
- Regularly meet with other departments to understand which tools are they exactly looking for in terms of their workflows. Explain to them how the new software request process would work.
- Before purchasing any sort of new software, examine current systems to see if they already offer the features that your employees need. This helps in avoiding redundant purchases and will save you time and money.
- If buying new software is absolutely necessary, work closely with other department heads to make sure that the new software integrates smoothly with other existing tools.
Purchase software for other teams “the IT way”
- To make things simpler and safer, ensure that all software requests, no matter what department the employees are in, must go through the IT team. Educate all new employees about the new process, including any new hires during their onboarding.
- Set up a dedicated team (or person) in IT to handle all software requests. Assign them the responsibility to work with vendors, get the best deals, and make sure that everything is compliant with your internal company rules. Think of them as your personal software shoppers!
- Moreover, work with the finance and purchasing teams to update how your company buys any software tool. Create simpler forms, easier and quicker approval processes to facilitate employees as fast as you can.
5. Frequent requests for access to blocked websites or services
If your help desk staff constantly gets requests to unblock websites or services—especially ones that relate to file-sharing sites, VPNs, or online productivity tools—it could mean people are trying to use software or services that haven’t been approved by the company.
You can often check your network security logs and confirm if people were indeed trying to access these blocked services.
This suggests that some folks might actually be trying to get around your company’s IT rules. Hint: Need extra care there!
Fix #5 – Balance security controls with employee needs
Implement technical controls
- Use software asset management tools that integrate with browsers to detect if employees are accessing any URLs that could be potentially malicious for the company. Set up an alert for any attempts by employees to bypass the firewall.
- Reviewed and updated the company’s internet usage policy to clearly address the use of VPNs and file-sharing websites.
Don’t be a villain, be an enabler
- Shadow IT is natural; it’s human. If your employees don’t find something that suits their daily workflows, they will naturally pivot to tools that work best for them.
- Don’t villainize yourself by snapping at employees you catch them contributing to shadow IT. Understand why it exists and what you can do to provide an appropriate alternative.
Let’s talk about why shadow IT exists in the first place.
Shadow IT is a never-ending battle
Whichever signs you may encounter or how many of them you may have to fix, ultimately, dealing with shadow IT is a continuous battle.
Employees will always find an “easier way” for themselves to find solutions that best meet their needs – often at the expense of bypassing IT oversight just because they want processes to be faster.
The ideal strategy in this case would be to enforce approval processes that are quick, transparent, and deftly balance the needs of both employees and the company. Again, smartly balancing expectations is an IT Manager’s most crucial skill.
Regularly engage with other departments to assess their software needs, conduct periodic audits and review policies accordingly, foster open communication and feedback channels for facilitative IT support, and keep referring to this list. We’ll keep updating it!
Preventing Shadow IT with EZO AssetSonar
EZO AssetSonar’s software asset management solution offers powerful capabilities to normalize software versions scattered across employee divisions and scans your employees’ browsers to detect any access to restricted websites.
Remember, when it comes to comprehensive software visibility, we’ve got you covered with new tips and tricks always.
Happy New Year! Take shadow IT EZ with AssetSonar! 🙌
