Skip to main content

Shadow IT Management

In an era where cloud and web services adoption is rampant and in the hands of end users, understanding and managing shadow IT is crucial for maintaining organizational security. This document aims to explain how Keep Aware addresses the challenges of effectively managing shadow IT by leveraging the innate and powerful visibility from browsers.

Fundamentals of Shadow IT​

Shadow IT refers to information technology systems and solutions used inside organizations without explicit organizational approval. This includes everything from unsanctioned software applications to unapproved web and cloud services.

note

Though unapproved physical hardware (e.g., a physical server or a USB) and software on endpoints are part of shadow IT, these forms of shadow IT are outside the scope of Keep Aware's browser security solution and are not focused upon in this documentation.

Employees most commonly employ unmanaged IT solutions in an effort either to be more efficient or productive than they are with approved technology, to bypass lengthy approval periods and start work sooner rather than later, or because they are unaware of the relevant approved solution. Though shadow IT is often driven by benign or neutral intentions, unmanaged solutions present many negative risks.

Risks of Shadow IT​

Unapproved technology usage opens the organization up to additional risk.

  • Loss of Control and Visibility: Without visibility into unapproved IT, organizations are unable to effecively manage such technology.
  • Loss of Data: When signing up for services, users often agree to various documents, such as a User Agreement, that could legally allow the application's owners access to the user's data or otherwise render the data insecure.
  • Non-compliance: Regulatory agencies have a range of requirements in order for an organization to be deemed compliant. Shadow IT solutions may render an organization as non-compliant, which could lead to fines or legal actions.
  • Increased Costs: Direct costs of shadow IT solutions may oftentimes be more cost-effective upfront; however, as an organization scales, they generally become cost prohibitive. Additionally, unmanaged solutions could incur indirect costs, such as non-compliance fines, costly or time-intensive IT support to deprovision or make it compliant, or reputational harm in the event of a breach.
  • Increased Attack Surface: Unmanaged IT increases an organization's attack surface when the solution contains misconfigurations, possesses known vulnerabilities, or is not protected by defense-in-depth security measures—all of which present the increased risk of a breach.

Additionally, without insight into shadow IT, organizations unknowingly accept the above risks.

Basic Principles of Managing Shadow IT​

  • Visibility: Prerequisite to identify what tools and applications employees are using.
  • Identification: Distinguish between using unsanctioned IT and merely browsing such technologies.
  • Management: The ability to enforce relevant policies, including the restriction of unapproved solutions.

Common Scenario​

  1. Employees in a marketing department start using AI tools, like ChatGPT and Claude, without informing their IT department, seeking to streamline content creation and customer interactions.
  2. While these tools boost productivity, the lack of oversight leads to the unintentional sharing of sensitive company data within these platforms.
  3. As a result, the organization loses visibility into the data being processed and stored by these unapproved solutions, increasing the risk of data breaches and regulatory non-compliance.

Variations​

In addition to traditional forms of shadow IT (such as physical devices, like USB drives, and software running directly on a host machine), there are also:

  • Browser Extensions: This is essentially software running directly on the user's browser. (For information specific to extension security, refer to Extension Security.)
  • Web Applications and Cloud Services: Unsanctioned use of these technologies are rampant in today's inter-connected ecosystem where end users often have full, or near-full, control of their browsers.

Context and Background​

Shadow IT has grown significantly with the rise of mobile technologies, distributed workforces, dynamic web frameworks, and cloud computing, as employees seek to bypass IT bottlenecks and increase their productivity.

Current Landscape​

In a 2019 article, NextWeb reported 67% of teams have "introduced their own team colloboration tools into their organization". IBM's report, The State of Attack Surface Management 2022, states "7 in 10 organizations have been compromised via an unknown, unmanaged, or poorly managed internet-facing asset in the past year". These reports highlight the rampant use of shadow IT and the potential negative consequences of remaining unaware and leaving them unmanaged.

The increasing availability and shift towards web applications and cloud services will likely continue to exacerbate shadow IT challenges, underscoring the need for organizations to have robust means to identify and manage shadow IT.

Challenges and Considerations​

Common Issues​

  • Lack of Visibility: IT and security teams commonly lack awareness of what solutions employees are using.
  • Missing Usage Context: In addition to identifying applications that employees are utilizing, teams struggle to understand how these solutions are being utilized.
  • Unable to Enforce Granular Policies: Most organizations lack the capability to enforce gramular policies, such as allowing employees access to their enterprise instance of AWS, for example, while also restricting access to any personal instances or to another organization's instance.
  • No Personal vs. Business Differentiation: Further complicating matters, most organizations lack the capability to discern between personal and business overlap. This issue extends both to account usage and instance usage.

Solutions and Mitigations​

  • Visibility and Identification: Utilizing tools for continuous identification of applications and services used across the organization.
  • Usage Insights: Employing tools that convey insight into how the IT solution is being used (e.g., information on file uploads or risky behaviors).
  • Granular Policy Enforcement: Ability to enforce policies that can be granular, such as restricting uploads to a cloud application unless it is a sanctioned instance of that application.
  • Business Relevance: Capability to rapidly discern business relevance from personal use for both account and instance usage.

Visibility and The Browser​

Visibility—or rather, the lack thereof—into unmanaged applications is the most impeding issue of shadow IT. To combat this issue, visibility into employees' browsers offers the single best place to gather information about shadow IT across an organization for several compelling reasons:

  • Comprehensive Coverage of Modern IT Ecosystems: With the increasing reliance on cloud-based services and web applications in modern workplaces, many aspects of an organization’s IT ecosystem are accessed directly through the browser. Traditional network monitoring tools might miss these web-based interactions, whereas browser monitoring can capture them in full and with context. This capability is essential for gaining a holistic understanding of how employees are interacting with IT resources.
  • Central Hub for Online Activity: Browsers serve as the primary interface through which users interact with the internet, making them a central hub for accessing web-based applications, services, and platforms. Whether an employee is using a sanctioned application or engaging in unauthorized activities (i.e., shadow IT), it most often occurs through the browser. By monitoring browser activity, organizations can gain comprehensive insights into the breadth of applications employees are using and identify the specific usage of those that are not officially approved.
  • Direct Access to User Behavior: The logging of browser activities can provide detailed records of user behavior, including specific actions such as uploads, downloads, and data entry. These logs can reveal how employees are interacting with both sanctioned and unsanctioned tools. For instance, if an employee is using a personal cloud storage service to upload sensitive corporate data, this activity would be logged, offering a direct insight into potential security risks.
  • Cross-Platform Visibility: Employees often use various devices (e.g., laptops, desktops, tablets) and work in different environments (e.g., office, remotely). Browsers provide a consistent point of interaction across these platforms, meaning that monitoring browser activity can offer a unified view of shadow IT activities, regardless of the device or network being used.
  • Detection and Management of Browser Extensions: Gaining visibility into browsers also enables the identification of installed browser extensions, which can be critical for understanding potential security risks and shadow IT. As software running directly on a browser, extensions can introduce vulnerabilities, compromise data security, or provide unauthorized functionality that circumvents IT policies. By monitoring which extensions are being used, organizations can detect and manage unauthorized or potentially harmful extensions, ensuring that they align with corporate security and compliance standards.
  • Identification of Unauthorized Accounts and Instances: Many employees use multiple accounts (e.g., personal vs. work) on the same applications. In order for web applications or cloud services to work via the browser interface, the browser must see which instances and accounts are being used; this enables a security tool that leverages browser data to distinguish between personal and corporate accounts and instances of these applications. This visibility is crucial for identifying potential misuse of personal accounts for work-related tasks or the use of another organization's corporate instance, either of which can bypass traditional security controls and lead to data leakage or compliance violations.

In summary, the browser is a critical point for monitoring and understanding shadow IT within an organization. Its ability to capture a wide range of user interactions, across different devices and contexts, makes it the most effective tool for gaining comprehensive visibility into the use of unauthorized applications and accounts.

The Keep Aware Advantage​

By leveraging the innate visibility that browsers offer, Keep Aware provides a centralized location to gain comprehensive insights into browser-based shadow IT. In addition to providing profound insight into browser extensions and web and cloud applications usage, our product empowers IT security teams to manage applications and enforce granular policies.

High Level​

Keep Aware offers robust functionalities to identify unmanaged applications and effectively manage them. Our solution includes:

  • Centralized Visibility and Identification: Identify managed and unmanaged solutions that users interact with via the browser.
  • Usage Insights: Rapidly gain an understanding of how users are utilizing specific applications.
  • Granular Restrictions: Policies enable the implementation of granular restrictions (e.g., restrict uploads and downloads to personal instances of Google Drive but allow them to your organization's instance).
  • Business Relevance: Web applications are tied to proprietary business relevance scores, enabling your team to clearly act in the face of personal and work account overlap.
  • User Notices: Customizable user-facing notices, referred to as safeguards, allow you to reference end users to approved resources.

Technical Level​

Additional technical capabilities include:

  • Insight into, and properietary risk scoring of, browser extensions across your organization. Refer to Extension Security for more information.
  • Provides context and rich metadata into applications and their usage, which include:
  • Supplies context into applications, instances, accounts, and users at the event level, instance level, and application level.
  • Policy templates empower your team to rapidly create and enforce Acceptable Use Policies.
  • Provides central management of policies across your organization.
  • Offers the capability to enforce broad policies that restrict access to entire applications or, more granularly, to restrict specific instances, specific accounts, and/or specific usage activities.

Summary​

Shadow IT, though most often implemented with benign intentions, pose significant risks to organizations when left unnoticed and unmanaged. By leveraging the browser's powerful visibility and control, organizations can gain comprehensive visibility of, and control over, their cloud services, browser extensions, and web applications. Keep Aware provides the progressive capabilities to gain actionable insight and address the prominent challenges posed by shadow IT in the modern IT workplace.

Begin investigating and managing your organization's shadow IT by visiting the Catalog page and referring to our Catalog documentation.

Table of Contents