Do you know all the cloud apps that employees at your company are using?
You may be surprised to find out that on average, shadow IT use is 10x the size of known cloud app usage.
It usually starts innocently enough. An employee might see a task management app they like and begin using it to organize their daily To-Do list.
Another employee that posts social media for their department might begin using an app they like better than the one the company approved, without telling anyone.
Shadow IT creeps up little by little as staff start using SaaS (software as a service) apps on their own. It’s called “shadow” IT because those applications are used unbeknownst to the company’s IT team or outside support provider.
When that happens, the apps aren’t included in the company’s overall IT strategy or cybersecurity, causing several critical issues:
- Shadow IT isn’t integrated into other business processes
- Duplication of data in different apps
- Security concerns because Shadow apps haven’t been vetted
- Shadow IT may not have proper security settings to meet compliance requirements
- Unnecessarily high monthly spend for SaaS subscriptions
Cyber attacks on cloud services more than doubled in 2019.
One of the biggest concerns when it comes to the use of shadow IT is the security risk. As companies move their data to the cloud, hackers are targeting those SaaS apps to get to it.
Attacks on cloud infrastructure have been rising, which makes apps outside a company’s cloud security strategy dangerous.
If you aren’t aware an employee is using a particular cloud app in their workflow, it can’t be properly secured according to company policies and could be leaving sensitive data at risk.
Steps for Solving the Shadow IT Problem
While shadow IT does pose a serious security risk and needs to be addressed, it also poses an opportunity to find new and better applications that will improve productivity.
If you handle the issue right, you can keep your IT security plan intact and benefit from ongoing cloud optimization. Here are the steps to do that.
Understand Why There is Shadow IT
Before you address shadow IT with employees, it’s important to know why it happens. Employees aren’t typically using shadow IT to cause a security problem they just don’t know any better.
Some of the reasons that employees will begin using an app on their own are:
- Their company doesn’t have an app to do what they need
- They are trying to optimize their workflow
- They don’t like the app they’re supposed to use
- There is no cloud app use policy at their company
Here are a few statistics from Government Technology that explain why shadow IT is so prevalent:
- Only 12% of IT departments follow up on all staff requests for new technology
- 35% of employees don’t report shadow IT use because they don’t want to get anyone in trouble
- 31% of employees think shadow IT is a minor issue
- 21% of companies don’t have application use policies
So, the problem is a combination of a lack of a clear path for employees to request a new app and feel heard, and employees not understanding the dangers of shadow IT.
Find Uses of Shadow IT – As an Opportunity
You’ll need to locate the use of unauthorized applications in order to solve the security issue with shadow IT.
But if you do this with a punitive attitude, employees may be afraid to come clean about any apps they’re using that weren’t approved.
Instead, approach it as an opportunity to find the best applications for your organization’s cloud strategy by getting direct employee input.
Two ways to find the use of Shadow IT at your business are:
- Employee survey about all the cloud apps they use
- Cloud Access Security Broker (CASB) app that detects use of shadow IT
An employee survey is important to use because it gives you the opportunity to have your team rate each app that they’re using, both authorized and unauthorized.
Once you identify use of shadow IT, evaluate it for potential inclusion into your cloud strategy. Either add it as an authorized app or decommission use, ensuring data is safely migrated to an approved application.
Educate Employees on the Dangers of Shadow IT
Make sure that employees understand why shadow IT can cause data compromise, a breach, or other cybersecurity incident.
Even a seemingly innocent application from a well-known company can cause a vulnerability if it’s outside your cloud app security plan.
A lack of understanding of the risk is one of the contributing factors to employees using shadow IT in the first place.
Create a Use Policy and Include a Way to Request Apps
Many businesses don’t have a clear policy about cloud app usage or how to request a new app.
An employee may just mention to a supervisor that they’d like to try a new app, with their supervisor saying they’ll get back to them and then forgetting all about it. This can lead to frustration and the use of shadow IT.
Ensure you have a policy that allows employees to recommend applications they’d like to use. Make sure recommendations don’t just languish but are addressed in a timely manner and that the employee is communicated with throughout the process.
Also include in your policy penalties for using applications without permission to encourage employees to go through the proper process rather than use a cloud app on their own.
Work with RCOR to Secure Your Cloud Data
How secure is your cloud data? Do you have any shadow IT out there you don’t know about? We can help you with a strategy that secures your cloud data and encourages better IT security habits.
Contact us today to schedule a cloud security consultation. Call 919-263-5570 or contact us online.
