- [Instructor] Most of the dangers on the cybersecurity
threat landscape come from malicious actors
outside of your organization.
Shadow IT is different though
because this threat comes from within your organization
and many times it's not malicious.
That doesn't mean it's not a serious problem.
Let's take a look at Shadow IT and why it's part
of the cybersecurity threat landscape.
Shadow IT refers to the unauthorized use of systems,
software, personal devices,
or cloud services by enterprise employees.
To best manage and secure IT systems,
all technology purchases should be approved
and budgeted by a shared services IT function,
but users will sometimes go around IT
and purchase technology with their own budget.
When implemented, this unsanctioned and often unmanaged
technology solution becomes part
of the Shadow IT in the enterprise.
IT will either find out about these Shadow implementations
after they've been deployed or even worse, not at all.
There are many reasons behind the rise of Shadow IT
but some of the most common are understaffed IT departments
that can't support the IT needs of users.
The perception by users that IT is too slow or restrictive
with technology deployments, and easy access to software
as a service or SaaS solutions like Dropbox, Salesforce,
or Amazon web services.
Shadow IT can represent a large amount
of spending in organizations.
In fact, Gartner has estimated that Shadow IT accounts
for 30 to 40% of IT spending in large enterprises.
Other research states that this number could be even higher
but many enterprise leaders
either aren't aware of the Shadow IT problem
or downplay it as not that big of a deal.
That can be a costly mistake
because there are real risks associated with Shadow IT,
simply put it's impossible
for the enterprise to secure systems
that the organization's IT function isn't even aware of.
Here are just a few of the Shadow IT risks.
First is data loss,
if the Shadow IT systems are processing
or storing important information,
it probably isn't being included
in the enterprise backup solution.
So if the data is lost there's no chance for recovery,
even worse if the information is confidential
and the Shadow IT systems aren't secured,
that could lead to a data breach.
Next is unpatched vulnerabilities,
Shadow IT systems probably aren't being included
in vulnerability scans or scheduled patch cycles.
That means these systems could have vulnerabilities
that expose them to attacks and possible data breaches.
And lack of security compliance, all sanctioned IT solutions
should be deployed with standard
security controls that may not exist on Shadow IT systems.
These could include antimalware, encryption,
security monitoring, and more.
And enterprise could be subject to big fines
if a data breach occurs on Shadow IT systems
that aren't compliant with enterprise
or regulatory security controls.
We can expect that IT departments
will continue being challenged
by users who circumvent required processes
for implementing IT solutions.
For this reason, we'll likely see Shadow IT being part
of the cybersecurity threat landscape for some time.