What is Shadow-IT?

In brief: Shadow IT refers to IT resources that pose potential security risks and are completely unknown to the company - therefore, they are difficult to protect.

Shadow IT refers to digital systems - applications, devices, servers, API and services - whose existence is unknown to the company. Shadow IT often emerges when IT departments grow very quickly, internal and external employees receive too many permissions and are overzealous when it comes to using new technologies. The IT department cannot process all requests, and employees look for quick solutions to get their work done. They then use their own devices, applications, and services to complete their work. Other examples include cloud providers like AWS or Google. IT employees get permissions to launch their own EC2 instances without IT management knowing about it. They use them and quickly forget about them. Shadow IT becomes problematic because the same security rules are usually not followed in the creation and use of these resources as is the case with IT department or internally known resources.

What are the risks of Shadow IT?

Just as quickly as servers are set up, they are forgotten and exist on their own - the classic example of Shadow IT. They are not monitored by IT and are often completely defenseless against attacks. Over time, these resources become vulnerable and compromised. The result is data loss - for example, because an IT employee uploaded real customer data to this system "for testing." Compliance is also a major issue. Companies often have a set of rules regarding data protection and IT security. However, these rules only apply to known systems. The unknown systems are not protected and may violate the rules. This can lead to high penalties. In general, it is problematic when IT resources are not on the IT department's radar. What you don't know, you can't protect.

How can companies protect themselves against Shadow IT?

It's worth confronting IT employees - both internal and external - with this issue and showing them the dangers. Monitoring and network analysis also allow potential Shadow IT to be detected early. Besides internal Shadow IT, external Shadow IT plays a very important role as it can be attacked by anyone. Good solutions in External Attack Surface Management help to know and protect one's own attack surface. As an example, our Security Platform Argos should be mentioned here, which daily scans the entire cloud of Amazon and Google to look for systems that may be assigned to customers. SSL certificates are a good indicator here.