There’s a new storm brewing on the horizon of information technology: the rise of shadow IT facilitated by the cloud. Almost every company has it, and many IT departments are aware of that fact. However, it’s remained an obscure and somewhat mystifying concept. Relatively few professionals have understood the implications of the problem, let alone the magnitude of it. Until now.
With cloud services becoming more and more accessible, employees are emboldened to reach out for exactly what they need, when they need it. The result is a nightmare for IT professionals as sensitive company data gets splayed across often unsecured channels. To address this, managed IT service providers are cracking down on shadow IT. Here’s what that means and why it matters.
Shadow IT is hardware, software or cloud services which were installed or are being used for work purposes without the knowledge or authorization of a company’s IT department. Shadow IT takes many forms:
· Communication and productivity apps (Slack, Asana, Skype, Pipedrive, etc)
· Cloud design services like Proposify and Figma
· The creation of subdomains or staging sites
· Subscriptions for services or software licenses
· Physical hardware installed on company computers
· Personal cloud storage like OneDrive
· Personal devices, such as in a BYOD policy
Although shadow IT has negative connotations, it doesn’t describe the presence of malicious hardware or software. Instead, shadow IT appears because employees are trying to do their job, but they lack the technical support or training to do it correctly. Thus, they’re coming up with their own solutions to problems. This may occur when:
· The IT department is overwhelmed with support requests
· The current IT infrastructure hasn’t been updated in a while
· Communication channels for acquiring IT resources are too time-consuming or confusing
· Employees don’t understand the dangers of accessing company information on personal devices
· Employees or departments need specialized tools that aren’t being provided
The presence of shadow IT is the number one clue that a company’s current IT infrastructure or resources aren’t meeting the needs of its employees. And it’s common: Cisco estimates that 80 percent of employees are using software or services which the IT department didn’t approve.
Cloud computing and the many services provided via the cloud are rapidly exploding. In particular, it is estimated that public IT cloud services will be a $205 billion industry by next year. The cloud puts powerful capabilities into the hands of individuals and businesses which would otherwise be outside their budget.
While this has numerous advantages for businesses, it also means that employees can get their hands onto tools or services faster and more easily. So far, they have been. As early as 2015, Cisco was sounding the alarm. Its research indicated that employees in an average mid-size company were signing up for over 700 cloud services per year.
Most of these services exist on the public cloud. This has severe implications for companies with strict compliance requirements for how they manage, transmit, and store data. While the cloud has traditionally been regarded as secure, new revelations are forcing a reconsideration of that assumption.
Managed IT service providers take a comprehensive, efficient approach which includes detecting and managing shadow IT present in a company. XMC follows a five-fold approach to ensure total visibility of existing shadow IT.
1. Discovery. A team of specialists will survey and inventory current IT assets, plus any shadow IT which may exist for business purposes.
2. Assessment. Most shadow IT arises due to an employee need. Experts conduct a careful analysis of each instance to determine its value.
3. Structure. Shadow IT is either integrated and brought under the purview of the IT department or removed.
4. Implement. New policies and strategies focus on mitigating the future rise of shadow IT, plus creating a framework for employees to suggest and implement new tools as needed.
5. Support. Managed IT services will continue to support the integration of shadow IT into the company’s formal IT infrastructure, as well as manage new cases of shadow IT as they appear.
Shadow IT represents a serious though poorly understood security risk for modern companies which utilize cloud services. However, its presence is one of the biggest clues that it’s time for an update to a company’s IT infrastructure. It means that the current infrastructure can’t meet employee needs, and they’re finding their own solutions to do their jobs.
With the amount of data passing through cloud services, securing the cloud should be a company’s number one priority. The IT specialists of XMC have the level of professional aptitude and insight necessary to bring shadow IT under control. Contact us immediately if you’ve detected the presence of shadow IT in your company.
