Shadow IT, also known as feral IT, refers to all software, devices, and IT services not owned by IT organizations.
Shadow IT more explicitly describes software and hardware technologies used by employees and managers of a company, without the IT department having given its prior consent. Ousting shadow IT from employee habits is necessary to ensure the security of your organization’s confidential data.
Shadow IT: an underestimated reality in the company
While it is true that shadow IT can sometimes help stimulate the creativity and productivity of employees, it also represents a real risk for the security of professional data. This remains especially true during the global pandemic where many employees are working remotely.
A French study conducted by the Club of Information and Digital Security Experts (CESIN) in 2017 revealed a sobering reality for companies. Employees admitted to using approximately 1,700 apps, while businesses list between 30 and 40 authorized apps on average.
Additionally, according to NTT Communications’ research, shadow IT’s reality is even creeping into corporate management. 77% of employees considered decision-makers in the company admit to having already used at least one Cloud application without validation from their respective IT departments.
Risks of unauthorized software on the security of professional data
“Most organizations grossly underestimate the number of shadow IT applications already in use,” says Brian Lowans, principal research analyst at Gartner. “A data breach resulting from any individual BUIT purchase will result in financial liabilities affecting the organization’s bottom line. Liabilities can be very large due to a mix of costs that include notification penalties, auditing processes, loss of customer revenue, brand damage, security remediation and investment, and cyberinsurance.”
Source: Gartner
Shadow IT weakens organizational standards, creates compliance issues, and potentially allows unauthorized users to access confidential data. In addition, running unauthorized software sets up the potential of losing data critical to the company—a dangerous threat that would likely be irreversible.
The COVID-19 crisis and data security
It is not surprising that the current health crisis and surge in remote work have resulted in the widespread adoption of shadow IT solutions.
Many executives and administrative supports were using shadow IT solutions for their daily work during the first lockdown. The same goes for board and committee members who communicated via well-known instant messaging applications and discussion groups on themes sometimes identified as sensitive subjects.
When shadow IT is adopted at all levels of the company, the risk for cyberattacks is exponential.
Solutions to stop the progression of Shadow IT in business
Educating employees on the risks of using outside technology is critical. It is also essential to have open discussions about the employee’s needs, as sometimes authorized software might not provide the functionality needed.
The IT department approves the software and hardware that should, in principle, allow each member of the company to carry out their missions under the best conditions. Creating a communication channel for employees to express their needs also creates an opportunity for their organization to offer authorized solutions or training on existing platforms.
Performing security training during employee’s onboarding is also another effective way of preventing shadow IT and the use of potentially harmful software within the company.
In addition to working with employees on the risks of using outside technology, CEOs need to comprehend the need for innovative IT solutions. Research has found a strong correlation between companies that have failed to invest in modern solutions and adverse financial outcomes.
How to reconcile Shadow IT and security of confidential data of governance bodies
It is essential to know how to manage the risks of shadow IT to protect the confidential data of your boards and committees. IT departments should analyze the needs of managers and offer secure and sovereign solutions adapted to their specific activities.
Customized according to your business’s needs, DiliTrust’s Governance suite eliminates the need for risky shadow IT solutions. Whether you are a legal team or a board of directors, our modules are secure and easy to use, centralizing all the tools you need via one secure portal. All of our modules are in accordance with the highest international standard for security, ISO 27001.
