What it is, why it happens, and why it likely isn’t a good strategy for you
It’s time to talk about shadow IT: it sounds ominous, like a secretive group of tech-savvy professionals working under cover of darkness.
And that’s…pretty much exactly what it is. Shadow IT is well-meaning, not nefarious — but if it’s happening at your business, it still poses a threat. Here’s what you need to know about this growing trend.
What Is Shadow IT?
Shadow IT is when people within your business use information technology tools outside the formal channels of your IT department or IT partner. Shadow IT can include software, systems, web services, and even hardware — anything that’s in a category that traditional or managed IT would usually handle.
Here are a few examples:
- Using a SaaS tool like Slack for communicating as a team (when IT hasn’t approved it and isn’t managing it)
- Setting up project management or workflow apps like Trello without IT’s support or OK
- Installing apps or utilities downloaded from the internet — like PDF converters or other quality-of-life additions
- Using a personal laptop to access business systems or networks
- Using personal accounts for cloud storage or cloud services
Why Shadow IT Happens
Shadow IT happens when teams and team members find tools they want to use on their own — and don’t vet them through proper channels. Maybe they’re worried IT will say no, or that officially adopting an app will cost the business when all they need is the free tier.
The sheer number of SaaS tools available today is another contributor. Teams and tech-savvy individuals find the tools that they like best, and they just start using them. Because most of these tools don’t require installing software (they just run in the internet browser), IT can’t easily block them — but neither can they support them all.
Ultimately, shadow IT happens in search of convenience and/or efficiency. People want to find better ways to get the work done, and they may be unaware that their actions even qualify as “shadow IT.”
How Shadow IT Can Put Your Business At Risk
To be clear, different types of shadow IT infractions carry differing levels of risk. Using free Slack without approval isn’t nearly as dangerous as downloading “free” utilities that may or may not be crawling with malware.
But at every level there is some risk. Shadow IT is by definition unmanaged; in many cases, IT doesn’t even know about the tools people have adopted outside regular channels. So if a scammer gets into that unofficial Slack channel, IT won’t have protections in place to detect and block the scam.
Data exposure is another risk. IT can force employees to create complex passwords, use multi-factor authentication, and keep data confined to apps with strong records of keeping user data safe. When people take that data outside the confines of those vetted tools, they create security risks. Weak passwords, stolen credentials, poor security practices on the part of the software or SaaS provider— IT is powerless to help.
Perhaps the worst threat is the risk of a cyberattack. Downloading free utilities or using fraudulent online file converters (as the FBI warned about earlier this year) might seem like a quick and easy way to solve a frustrating work issue. But if that utility or website is secretly loading up your device with malware or even ransomware, the damage could be catastrophic.
The Solution to Shadow IT
If shadow IT is a problem at your business, it’s time to shine a little light. Broadening your list of approved apps and tools can help. So can tightening up access control and administrator rights.
The ultimate solution is to put a forward-thinking, holistic IT support plan in place, and the easiest way to do this is to work with a managed IT partner like Blue Ridge Tech. If you’re a current customer, reach out to discuss how we can help. If not, now’s the perfect time to switch. Reach out today!