In this lesson,
we'll explore the hidden world of shadow IT.
Shadow IT provides us with some unique challenges
because it refers to the use of information technology
systems, devices, software, applications, and services,
without explicit organizational approval.
You may hear the terms stealth IT or client IT
also used to refer to shadow IT when you are working
out in the field as a cybersecurity professional.
Now, shadow IT refers to IT-related projects
that are managed outside of and without the knowledge
of the IT department, and they can include anything
from the use of personal devices for work purposes,
the installation of unapproved software,
or the use of cloud services
that have not been approved by the organization.
So why does shadow IT exist?
Well, I normally find that shadow IT exists
because an organization's security posture
is actually being set too high
or is too complex for business operations to occur
without being negatively affected.
For example, let's pretend that you want to have
a second monitor added to your office computer setup.
In one organization I was working for,
the process to request a second monitor,
get it approved, get it ordered and then get it delivered,
and get it installed took about 45 days.
This is just ridiculous for something as easy
and inexpensive as a new monitor.
So, many people would simply not bother
requesting a new monitor, and they would just buy
$100 monitor at the store, bring it to work,
and connect it themselves.
But this monitor is now considered to be shadow IT
because no one knows where it came from,
the security posture of the device,
and there's no lifecycle management for the device,
so if it breaks, the IT department
cannot repair it or replace it.
Now, a monitor is not that big of a deal,
but if you connect a USB thumb drive,
an external hard drive, a keyboard, a wired mouse,
a network adapter, or any other type of device,
you could be introducing a whole range of vulnerabilities
into the network without even realizing it.
So while shadow IT could possibly boost the productivity
and innovation in the organization,
allowing employees to find their own technology solutions
for their problems, it also poses a significant risk,
including opening up your organization
to potential data breaches, non-compliance with regulation,
and system disruptions.
The reason for this is that shadow IT
can lead to a lack of standardization across the network,
which makes the management and strategic planning
of your network much more complicated.
When problems arise from the use of unsanctioned technology,
they can be harder to resolve due to the IT department's
lack of awareness or understanding
of the specific technology deployed by the user.
For example, if a specific user has downloaded
a piece of software to perform some kind of task,
and this software is included in some type of malware
that they did not know about, it will be much harder
for the technical support department
to find the reason for malware spreading out
across the organization network,
since they don't know where this program
was installed on their network.
Another reason for the rise of shadow IT
is that employees want to gain more efficiency
and convenience when working.
So they may install a web browser plugin or extension
and other unsanctioned tools and applications
to make their experience more user-friendly
than the tools provided by the organization's network.
Also, the large scale adoption of cloud-based services
and mobile apps combined with the bring your own device,
or BYOD trend, has also facilitated
the rise of shadow IT in many enterprise networks.
Some shadow IT is more virtual in nature.
For example, if an employee decides
to use cloud storage services like Dropbox or Google Drive
for sharing and storing work-related documents
without the IT department's knowledge or approval,
this is yet another form of shadow IT.
While these services can enhance
the collaboration and efficiency,
they can also lead to data leakage or breaches
if not properly managed.
So organizations should make a conscious decision
as to which, if any, of these cloud storage services
they will support for organizational use.
Bring your own devices, or BYOD,
involves the use of personal devices for work purposes.
Employees may use their personal smartphones, tablets,
or laptops to access work emails or documents,
which gives them a lot of convenience,
but it also has the potential for exposing sensitive data
to security risks.
Since these personal devices might not have the same levels
of required protections as other corporate-owned
or procured devices that are managed by the IT department,
these personal devices can become an easy target
for opportunistic threat actors.
So remember, shadow IT can represent
a significant challenge for organizations.
Shadow IT is the use of information technology systems,
devices, software, applications, and services,
without explicit organizational approval.
While it can drive innovation and efficiency,
it also poses substantial security risks,
so organizations must try to strike a healthy balance
by developing policies that allow
for flexibility and innovation,
while also ensuring data security and compliance.
If the technology department of your organization
doesn't know that a particular piece of hardware,
software, or cloud service is being used by its employees,
then they are going to be unable to secure it.
This is why shadow IT is so dangerous
to the security of your enterprise networks.