Current Filter: >>>>>>

   

Shadow IT, the term for IT resources used outside of a company's official IT infrastructure without the IT department's permission - and all too often knowledge - is a growing phenomenon. From cloud services and private smartphones, to USB sticks and printers, so-called Shadow IT takes many forms. And while there are clear benefits associated with its use, it is a real concern for businesses who do not want to have their IT systems compromised.

One option is simply to take a hard line against any unapproved, therefore unofficial IT, but this will consume time and energy, not to mention employees’ tolerance and good will. Most staff won't appreciate being prevented from using the tools and applications they choose, in the way that want. The key to this dilemma is to find a way to reconcile Shadow IT and official IT operations, thus creating a viable alternative to an unenforceable ban.

Shadow IT exists for a number of reasons, most of which are completely non-malicious. Many employees are simply ignorant of the risk of their actions and use Shadow IT without thinking about the security repercussions; they simply want to get the job done as quickly as they can and do not understand the risks. They are focused only, for example, on downloading the app that they need or sending an email to their personal account to complete a task at home, because for them it is the most efficient way to get things done.

With a recent survey by 2nd Watch revealing that as many as 61 per cent of business departments use Shadow IT it is clear that resistance is futile. The business priority therefore is to manage the danger. A large concern is the risk of data loss, because Shadow IT provides an ideal entry point for hackers. Another problem is the potential impact on business processes. Companies can become too dependent on Shadow IT and then they encounter issues when they try to export data back to official resources. Equally, Shadow IT can breed inefficiency by allowing different departments to create their own unique IT solutions which are not integrated across the company, and ultimately impossible to manage.

There are a number of relatively simple steps that can be taken to win back control. For instance, by creating a code of practice that clearly documents responsibilities and standards, a company can set a consistent standard around IT management. They can also create internal test environments within departments where Shadow IT is particularly prevalent, so that these departments can be monitored and managed, while at the same time reminded of the established code of practice. These complementary actions allow companies to establish a stringent process, while at the same time avoid confrontation and internal friction, harnessing the benefits of Shadow IT.

An IT monitoring solution can also help a company to minimise these threats. It can be deployed to identify whether there are any issues caused by Shadow IT, how significant the problem is, and in which departments. An auto-discovery feature, for instance, allows network administrators to be notified immediately when any new devices are connected. Monitoring bandwidth shows and records how much bandwidth is being used and which if any devices or applications are creating system bottlenecks. Similarly, flow analysis takes a detailed look at traffic and this can be used to further analyse bandwidth consumption across the network.

Ultimately, Shadow IT is not going away. However, by carefully reconciling it with a more pragmatic approach from the IT team companies can however minimise the risk and harness the innovation and productivity-boosting benefits Shadow IT brings.

This is the last in the current series of the Paessler Masterclass in Network Computing. Any reader comments and questions relating to this series are welcomed. Mail: Ray.Smyth@BTC.co.uk