Should you embrace shadow IT?

Simon Edward • 22 July 2024

Shadow IT is a problem, right? Yes and no. Discover how embracing shadow IT can be good for business.

Shadow IT – sometimes known as "grey IT" – is a term that refers to devices and cloud accounts used within an organisation that aren't approved by the IT department.

In the age of "bring your own device" and hybrid working, shadow IT is bigger and shadowier than ever. Conventional wisdom tells us that it should be eliminated, first and foremost because it enlarges an organisation's attack surface and puts it at greater risk of cyber attacks.

On top of that, critics say shadow IT is a waste of money. If an employee or department unilaterally decides to buy a solution, it could be buying a duplicate. The result: a sprawling network of shadowy solutions and devices that IT struggles to control.

There is, however, another way of looking at it. When handled properly, shadow IT can be strategically useful. Is it time for your company to bring it into the light?

The benefits of shadow IT

Why do people turn to shadow IT? Answering this question tells us something about what it can do for a business when properly managed.

Staff tend to turn to shadow IT when they're in a fix. IT has set constraints on what they can achieve. Shadow IT is a way around that.

You could see this as mere disobedience. However, fighting shadow IT is time-consuming – and time is money. It might make more sense to bring these unapproved devices and applications into the light and regulate them accordingly.

That way, you get the best of both worlds. Staff can be proactive in their problem-solving without introducing any shadowy security risks.

For IT, the counter-argument to this is that officialising shadow IT would create even more work for them as they seek to ensure these new solutions are secure.

From one point of view, this is true. But from another, it empowers staff to take charge of troubleshooting, reducing the burden on IT.

One of the most common complaints in IT, after all, is that staff don't know how to help themselves. And sure, there are probably plenty of examples of staff lacking the proactive attitude to fix a problem before contacting IT.

But the very existence of shadow IT tells a different story. Staff are constantly trying to troubleshoot and come up with workarounds. Bringing these solutions into the light means that staff have the tools they need before summoning IT.

How do you embrace shadow IT?

If you do decide to bring shadow IT into the light, your first task is to know exactly what apps are being used on your networks. This includes those that have been officially deployed and those that haven't been sanctioned.

Next, you have to take control of all those apps. Each one needs to be deployed properly and securely. Access permissions and data privileges need to be up-to-date and there should be measures in place to simplify the onboarding and offboarding process.

Once these steps have been taken, you're in a position to make the most of the new data under your control. You might, for instance, find customer data that wasn't put to work when it lived in the shadows.

It should be said that this won't necessarily be a simple task. Integrating data that used to belong to shadow IT can present challenges – but in the long run, it can give you more to work with.

An easier task to execute is surveying staff about the apps they use and why they use them. Doing so can teach you a lot about how the overall system can be improved. After all, staff turn to shadow IT when they think it's too difficult or time-consuming to go through official channels.

What are the challenges of embracing shadow IT?

Perhaps the biggest challenge you can face when embracing shadow IT is the ever-present question of security.

We've mentioned that you can learn a lot about your staff's needs by looking at the shadow IT they use. But that doesn't mean every instance of shadow IT should be brought into the light. This is especially the case when an app doesn't meet your security requirements.

A network, they say, is only as strong as its weakest link. If you integrate an app with less stringent security than the rest, you could be putting the whole system at risk.

The lesson here is not purely technical. It reflects the wider question of how management should interact with staff. It can be summarised as follows: listen to your staff – but don't assume they're always right.

When done right, embracing shadow IT can improve data visibility and save money. Done badly, it can create security concerns which would put that valuable data at risk.

So how can you get the best of both worlds – the advantages of shadow IT without the security risks?

Self-service and approved software

There are two key ways you can stay on top of shadow IT once it's been embraced.

One is to provide staff with self-service tools. This means IT has strict control over data – but not the applications that use that data. In other words, staff are free to explore software options, but the data itself is under strict lock and key.

Another method is to issue a list of approved software. As long as staff needs are met, this can create an improved sense of commonality and communication between IT and the rest of the company.

Conclusion

Shadow IT doesn't have to be the enemy. Handled well, it can save you money, improve relations between IT and other departments, and furnish you with valuable data that would otherwise lurk in the shadows. It won't work for everyone – but it could just work for you.

Ascend is a team of cloud migration and security experts based in Cork, Ireland. Need help creating a robust cloud security strategy? Don’t hesitate to get in touch for a free consultation.

< Older Post

Newer Post >