Complete Scope

Protecting From Shadow IT

The use of unauthorized apps and devices opens an organization to any number of problems, from basic process efficiency to serious security threats. Unsanctioned devices and software can jam bandwidth, decreasing employee productivity. It can lead to data breaches or theft, which could cost millions of dollars in lost business or fines should an organization fail to satisfy the General Data Protection Regulation (GDPR) compliance from the European Union (EU) or other industry and government regulations. This can also result in the loss of certifications and licenses.

Addressing shadow IT and device security should start at the top. Leadership should take more responsibility for network security and provide IT the support it needs to respond more quickly to broken processes. The use of unsanctioned software and devices should be monitored by someone outside of IT — such as a C-level executive like the chief information officer (CIO) or CISO, security team or managed service provider — and IT should then be encouraged to set an example by endorsing and enforcing authorized device and app use. This way, the ownership of proprietary data security will trickle down and calcify into the entire organizational structure, rather than straining uphill toward success.

At the same time, IT deserves the leeway to introduce new technologies into the company through authorized policy. With that line between personal and business devices increasingly unclear, it is easy for shadow IT to sneak past the network checkpoints. But by not having a plan in place and not requiring quicker response times, shadow IT can end up causing a lot of damage.

Information security is all about protecting data, so an effective cybersecurity policy has to include app security provisions that protect data generated on user endpoints. That’s easier said than done, however; after all, to secure applications, you have to know what applications your employees are using.

Employees rely on apps for almost every type of task, and they aren’t all using the same types of devices to access these apps. Thanks to the rise of bring-your-own-device (BYOD), the overall mobile workforce and, perhaps most significantly, the growing blur between professional and personal devices, it’s common to use apps and hardware that aren’t authorized by the IT department.

This unauthorized use is known as shadow IT, and it’s a nightmare for those in charge of security. You can’t protect what you don’t know — and endpoint users are unwittingly putting company data at risk every day.