The IT department may be blind to the issue, with no clue about how many unauthorized apps are being used, particularly when those applications are connecting from a home office.
It’s often unclear what security protections the applications are using, and frequent reuse of login credentials, weak passwords and phishing attacks leave user accounts on unauthorized services vulnerable.
With shadow IT, there is also the problem of application confusion and oversaturation. It’s messy when people are deciding for themselves which messaging application or file-sharing service to use.
MORE ON EDTECH: How to secure higher ed’s growing number of remote devices.
How to Protect Against Unauthorized Access
Unauthorized software may not meet the security standards required by the institution. There are several categories of risk that need to be considered:
- Data protection issues: Where is the data being stored? How is it protected? Can the user upload sensitive data to the cloud, where it could be leaked? Is data encrypted? Who controls the encryption keys? Can the user download files that contain malware and spread them to other members of the team?
- Compliance: The university’s compliance efforts may be squandered if the actual state of software is unknown. Will use of the service put the institution in conflict with industry regulations or even laws?
- Software asset management: Licenses procured without IT knowledge expose the institution to risk, potentially with severe sanctions. How do unknown applications and data relationships affect the carefully populated configuration management database?
How to Develop Proactive Prevention
Fortunately, the sea of shadow IT is not as murky as it may seem. The best approach involves five steps:
- Establish a baseline of acceptable applications. Recognize there are probably many instances of shadow IT in your institution, most of which use well-known tools such as mail, messaging, conferencing and large file transfer services. Focus on the most popular ones and determine if you can sanction a subset of them.
- Clarify the policy. Establish a clear policy on which devices, systems and software your faculty, staff and students can use. Communicate that policy to all users — not just once, but often. Remember that consistent user education strengthens your first line of defense.
- Gain visibility. Detect and catalog all software running in the organization by using a software asset management solution, such as an asset management suite. This can integrate compliance, license entitlement, discovery and more in one interface.
- Triage unacceptable risk. Conduct a detailed analysis of the risks associated with unauthorized applications. A cloud access security broker, such as McAfee MVISION, ensures real-time data protection. For tighter control with virtual desktop infrastructure tools such as Citrix XenDesktop, let IT control a secure desktop image with only sanctioned applications.
MORE ON EDTECH: Know the difference between DaaS and virtual desktops.
- Create a long-term plan to fill functionality gaps. Run strategic analysis of usage patterns. Recognize that the institution needs a full range of tools and services to function properly.
Students, faculty and staff are constantly trying to work as efficiently as possible, particularly when they are doing so away from campus. It’s up to IT to provide them with secure solutions that make this easier.
Shadow IT is a problem, but it serves one good purpose: It provides a view of what capabilities users really need, while software asset management, virtual desktop infrastructure and cloud access security brokers can help IT exercise control and governance over the entire landscape of applications. As always, user education plays a key role.