Shadow IT: Danger lurks in dark places

Shadow
IT: Danger lurks in dark places

Dick Bussiere, Technical Director, Asia Pacific, Tenable Network Security

Make no mistake — shadow IT as a security problem is here to stay. Many
CIOs are fighting to maintain their traditional control over enterprise IT
assets, but the ubiquity and convenience of the cloud-based solutions are
allowing individual lines of business to make their own IT purchases. These
purchases are often outside “traditional” procurement controls, and therefore
are taking place outside of the purview of the IT and security organisations.

Unsanctioned use of cloud services drives increased risks of data
breaches and resulting financial liabilities. According to Gartner’s December 2015
research report, “Predicts 2016: Threat and Vulnerability Management,” “by
2020, a third of successful attacks experienced by enterprises will be on their
shadow IT resources.”

The business impact

The presence of unknown cloud services makes it
difficult for security teams to identify and manage the organisations total
attack surface. Despite this challenge, the answer is not a wholesale ban on
the use of these popular services.

Many employees turn to unsanctioned cloud
services because they often allow them to be more efficient and productive,
solving a real business problem. Although blocking may be a quick-fix for the
associated security issues, this does nothing to correct the underlying
business problem that led to the unsanctioned applications in the first place.

Discovering and embracing the unknown

Not knowing what cloud services are present represents something
dangerous – an unknown threat surface. Security departments need to understand
what cloud services are being used within the organisation in order to get a
handle on the real risk.

Security and IT organisations must embark on a
proactive discovery mission where the infrastructure is instrumented to help
identify what cloud services are being used and who is using them. When
administrators are armed with this information, services can be analysed. Those
with a legitimate business purpose can be properly secured, embraced and
maintained. Those services which expose the organisation to excessive risk or
which are superfluous in nature can be blocked.

Technology and its role in the workplace are changing constantly, and
because of shadow IT, many of these changes go undetected by those responsible
for securing the workplace. Before any cloud-based application is used, the
risks associated with that application must be understood and mitigated.
Discovery of all unknown soft assets, such as SaaS, is critical to having a
secure IT infrastructure. Once soft assets are discovered and associated risks
are identified, teams can create appropriate controls.