Shadow IT: Risks and Management | Decripte Security

Shadow IT refers to IT systems, applications, and services used within an organization without explicit approval or knowledge from the IT department, creating security and compliance risks.

What Is Shadow IT

Shadow IT encompasses all software, hardware, and cloud services deployed and used by employees without going through official IT approval processes. It ranges from SaaS applications to personal devices used for work.

The phenomenon has grown exponentially with the rise of cloud services and the proliferation of SaaS productivity tools accessible with a credit card.

Common Examples

Collaboration Tools: Unauthorized Slack, Teams, Zoom.

Cloud Storage: Personal Dropbox, Google Drive, OneDrive.

Project Management: Unapproved Trello, Asana, Monday.com.

Development: Personal GitHub, GitLab, AWS accounts.

BYOD Devices: Personal laptops, smartphones, tablets.

Messengers: WhatsApp, Telegram, Signal for corporate communication.

Security Risks

Data Loss: Corporate data stored in uncontrolled services.

Information Leakage: Inadvertent sharing with unauthorized people.

Malware and Phishing: Unvetted applications may be malicious or compromised.

Lack of Encryption: Data may not be adequately protected.

Weak Credentials: Use of weak or reused passwords.

Absence of MFA: Lack of multi-factor authentication.

Insecure Integration: APIs connecting unauthorized systems.

Compliance Risks

LGPD/GDPR Violations: Processing personal data outside established controls.

Industry Non-Compliance: Violation of regulations such as PCI-DSS, HIPAA, SOX.

Loss of Auditability: Inability to track data access.

Inadequate Contracts: Lack of DPAs and data protection clauses.

Why Shadow IT Happens

Slow Processes: IT approvals take too long.

Inadequate Tools: Corporate solutions do not meet needs.

Lack of Alternatives: IT does not offer equivalent approved options.

Complexity: Official tools are too complex.

Culture of Innovation: Teams want to experiment with new tools.

Remote Work: The need for immediate collaboration tools.

Shadow IT Discovery

Cloud Access Security Brokers (CASB): Discovery of cloud applications in use.

Network Monitoring: Traffic analysis to identify unauthorized services.

Endpoint Detection: EDR identifies installed applications.

Cloud Discovery: Tools scan SSO and proxy logs.

Expense Reports: Analysis of corporate expenses.

User Surveys: Surveys of employees about the tools they use.

Management Strategies

1. Discover: Identify all existing Shadow IT.

2. Assess Risks: Classify applications by risk level.

3. Decide on Action:

• Approve: Legitimize use with adequate controls
• Replace: Offer an approved alternative
• Block: Prohibit use of high-risk tools

4. Implement Governance: Clear approval processes for new tools.

5. Educate: Raise awareness of risks and approved alternatives.

Collaborative Approach

Rather than simply prohibiting, adopt a collaborative stance:

• Understand why employees chose specific tools
• Offer approved alternatives that meet their needs
• Streamline approval processes for legitimate tools
• Create a catalog of pre-approved applications
• Establish fast SLAs for evaluating new tools

Control Tools

CASB (Cloud Access Security Broker): Microsoft Defender for Cloud Apps, Netskope, Zscaler.

SaaS Management: BetterCloud, Torii, Zylo.

DLP (Data Loss Prevention): Prevents exfiltration to unauthorized services.

Identity Management: Centralized SSO to control access.

Effective Policies

• A clear acceptable-use policy for IT
• A transparent request and approval process
• An easily accessible catalog of pre-approved applications
• Security guidelines for BYOD
• Clear consequences for deliberate violations
• Incentives to report needs for new tools

Best Practices

• Become a business partner, not the IT police
• Maintain an up-to-date inventory of all applications in use
• Implement SSO for visibility and control
• Continuously monitor the discovery of new applications
• Regularly review policies and processes
• Offer ongoing security training
• Establish metrics to measure the reduction of Shadow IT