Shadow IT is a general term for any application or device (smartphone, tablet, laptop, etc.) implemented in an organization without the approval of the IT Department. IT departments are often unaware that applications are being used by individual employees or entire business units.
Then there is shadow data, which is an even bigger risk. It carries the risk associated with all data uploaded, stored and shared through the cloud, regardless of whether permitted paths are used. Although an organization has excellent security and compliance policies, it is still not completely free from data loss or threat.
Even standard file sharing and collaborative applications such as Box, Office 365, Dropbox, and Google Drive. They are subject to shadow data threats.
Causes
The word cyberattacks bring to mind third party unauthorised intrusions into the systems. But sometimes, cyberattacks happen as a result of the information leak from within an organisation, intentionally or inadvertently.
Notably, the most significant risk of shadow data comes from unsuspecting employees: Individuals who do not have malicious intent but pose a threat by oversharing confidential information. It happens due to poor compliance and data governance policies and training, inadequate security, negligence, or unintentional misuse.
How to deal with shadow IT?
Organizations must value mastery of shadow IT and work with lines of business to mitigate risk. Suggestions include:
- Constantly monitor the network for applications and systems.
- Promise that using shadow IT applications will be of no consequence and ask your employees to submit an audit.
- Create a risk classification and prioritization system. Not all applications outside of IT’s control are equally threatening.
- Develop a list of devices approved for BYOD use and make sure employees are aware that jailbroken devices are prohibited.
- Develop an internal application store for all applications that have been evaluated and approved for use within the corporate infrastructure.
- Blocking apps are considered dangerous and users must request permission before downloading.
The following steps will reduce the risk of shadow data:
- Encryption of all data stored/used in the public cloud
- When choosing a private cloud for everyone
- Nicknames are used instead of real names for interaction on social media.
- Strictly delete or disable the accounts of people who leave/leave/resign from the Company.
- Avoid using third-party services whenever possible and choose self-hosted services.
- Carry out regular security checks.
- Appointment of qualified system administrators.
Follow and connect with us on Facebook, Linkedin & Twitter
