By 2020 it is expected that one-third of enterprise data breaches will be a
result of Shadow IT. It is undoubtedly one of the biggest cyber security threats
facing us today; but if harnessed it could also be one of
your best assets.
Welcome to the Pro Tech Show the place for tech, tips, and advice for IT pros and
decision-makers. If that sounds like your kind of thing then hit that subscribe
button and comment below to let me know what you want to see. Today's topic is
Shadow IT. I'm going to cover: What is it? How big is the threat? How do you flush it
out of the shadows and understand the scale in your organization? And finally,
what should you actually do about it? First up: what is it? Shadow IT is the
use of rogue or unsanctioned IT systems. This could be hardware, software, or
cloud services. It's something that's been implemented without the knowledge
of your organization's IT department. This could be something as simple as
someone using Dropbox or something as complex as a department head going out
and getting a brand new system implemented for them. Some people point
to the cloud or bring-your-own-device as somehow having created shadow IT. That's
not really true. Shadow IT's been with us as long as sanctioned IT. People
used to bring home work on floppy disks and isn't that just the same thing? For
the youngsters if I just lost you with "floppy disks", well think of a 3D save icon
that can actually store data; though not much data. So how big is the threat? Well
hopefully in the current climate I don't need to convince you of how damaging a
data breach can be - financially or reputationally. Well, Gartner reckon that
by 2020 a third of these data breaches in enterprises will be on data located
in shadow IT resources. And that makes sense, because IT don't know
it's there then how can they secure it? So how widespread is Shadow IT? Well,
let's look at some research by Cisco. This research was performed in
consultation with CIOs in a set of large enterprises, in a variety of industries.
Going by the numbers it would seem that the IT departments they worked with had
authorized between 32 and 46 cloud services. How many were actually in use?
Well, CIOs aren't stupid so they knew that there were likely
going to be rogue services. Their average estimate was that there would likely be
about 51 cloud services in use, after accounting for Shadow IT. The reality?
Cisco found an average of 730 cloud services. That's 14 times more
than the CEOs had estimated, and 15 to 22 times more that had actually been
approved. That's a staggering disparity, and it shows how out of control the
problem is. So how do you get a handle on it? How do you understand the scale in
your organization? Well, there are plenty of ways to audit your network and find
the devices and applications that are installed there; but the really tricky
one is cloud services, because they don't physically exist on your network and
they don't leave a lot of evidence behind. Fortunately a number of tools
have sprung up that can help you detect and quantify the use of cloud services
within your organization. These can work by deploying agents to your
computers, or by ingesting firewall logs and
processing them. They can help you identify what cloud services are being
used, who's using them, what the level of risk associated with them is, and even
what data is being stored in them. The most well-known of these is probably
Microsoft's Cloud App Security. Now due to the integration with Windows, Azure and
Office 365 if you're already a Microsoft shop then it probably makes sense; and if
you've got Microsoft cloud subscriptions you might already have licenses for it.
Now there are other options available, of course. If you just Google them you might
need a scroll a bit, but you'll find them. If you don't have and can't afford one
of these services then it's not a bad idea to spin one up in a trial. It won't
give you ongoing monitoring, but it will give you a point in time snapshot of the
state of Shadow IT in your organization; and that will put you head and shoulders
above the CIOs Cisco were talking to. OK. We know where we stand. We've discovered
a whole pile of Shadow IT, but what do we do about it? Well, the knee-jerk reaction
is usually to bring down the hammer of policy, ban everything with a threat of
disciplinary action. If I may, I'd like to caution you against that. There is a
place for policy, definitely; but if you follow the knee-jerk reaction then
you're in danger of throwing the baby out with the bathwater. Instead ask
yourself this: Why does shadow IT exist? It's not
because your staff enjoy data breaches! One of the answers I often get is
"people are too lazy to do things properly".
Well, I suggest that's a lazy answer. It exists because there's a deficiency
in your systems or your processes and someone has find a better or quicker way
of doing things. Now that "better" way might be terrible from a security and
compliance perspective, but it's delivering a benefit - something that for
whatever reason you haven't been able to provide yet. This is innovation at work.
If you try and hoard this innovation and make the IT department solely
responsible for innovation in IT, then you miss out on a whole pile of good
ideas. Again putting stats from Gartner, they say that the average IT department
makes up 6% of an organization's headcount.
That means as soon as you contain the ideas within IT you have thrown 94
percent of your good ideas straight in the bin without ever hearing about them.
IT's role should be to support and evolve these ideas; not suppress them. Now
that doesn't mean you get people full rein to do whatever they want. It means
you need to create a culture whereby people come to you with their ideas so
IT can help extract the benefits from them in a planned, sensible, and timely
manner; without sacrificing security, and without duplication of effort. If you
simply swing the hammer of policy then IT become unhelpful ogres, and nobody's
going to come to an unhelpful ogre with their ideas. Let me show you a diagram.
You've probably all seen Gartner's Magic Quadrant before - you know the ones with
completeness of vision versus ability to implement? Well, this is Quinny's Magic
Quadrant; and instead of products it has IT projects on it. On the vertical axis
we have the knowledge of the problem we're trying to solve. On the horizontal
axis we have the maturity of the solution we're deploying. If you don't understand
the business problem and you don't have a good solution, you've got a failure. If
you have a really good solution but it doesn't adequately solve the business
problem, then you're delivering something of low value. If you've got a great idea
and know exactly what problem you're trying to solve but you've not put
enough thought and due diligence into the solution, then you end up incurring a
lot of risk. If you've got intimate knowledge of the business problem and a
heap of experience with robust solutions that meet all of your policy and
regulatory needs, then you are in the land of awesomeness. This is where we all
want to be. Here's the thing. IT projects delivered without the
involvement of the IT department tend to inhabit this area of the chart. IT
projects delivered by IT without the involvement of business users who are
supposed to benefit from it and actually understand the problems tend to inhabit
this area of the chart. The land of awesomeness only becomes accessible when
we work together. Let me give you an example. You do your discovery piece and
you find a team of people are using Dropbox. You can't have that! That data
needs to be controlled, not stuck in someone's personal cloud account! So you
extend your on-premises SharePoint farm with extra storage, and you present them
with Onedrive for Business. Fully controlled, fully secured, and compliant
with all of your policies. Great solution, right? Wrong! Because you didn't involve
the people who'd actually deployed the Shadow IT service. You assumed that they
were using this because they needed an offline file sync, but actually they were
using it to share documents with suppliers. Now you've blocked Dropbox,
they're sending them as email attachments and have versioning problems.
If you'd worked together you might have deployed something like SharePoint
Online or Teams instead. So what's the moral of this story? Shadow IT is a
threat; but instead of crushing it along with the innovation it represents, try to
embrace the creativity. Encourage your users to come to you with their ideas.
Start by finding out what rogue services are out there. When you find them don't
beat people up. Go and talk to them and find out why they had to go outside of
sanctioned services, and then work with them to find a solution to the problem.
I'm a great believer that if you're going to take something away you have to
provide a viable alternative. And yes, make clear policies, educate your staff,
and enforce those policies. But you knew that bit anyway. The point I really want
to get across is that you do this in a supportive way, not an authoritarian way
that crushes the innovative spirit; because that's a fragile thing and it can
be one of your best assets. Besides, the more you dig your heels in and shout,
the more people are just going to find workarounds. I have genuinely been to an
organization where part of the induction process was showing people how to work
around IT restrictions. That is not a good place to be. You don't want to be
them. That's all for today. If you like this sort of content then hit that
thumbs up. Either way, I'm doing this for you guys so drop me a message in the
comments and let me know what you want to see next time. I'll have a new video
in a couple of weeks. If you want to see it then hit that subscribe button and do
the old bell icon notification thing. Thanks for watching guys. See you next
time!