Shadow IT

In big organizations, shadow IT (also known as embedded IT, fake IT, stealth IT, rogue IT, feral IT, or client IT) refers to information technology (IT) systems deployed by departments other than the central IT department, to work around[1] the shortcomings of the central information systems.[2]

Shadow IT systems are an important source of innovation, and shadow systems may become prototypes for future central IT solutions.[3] On the other hand, shadow IT solutions increase risks with organizational requirements for control, documentation, security, reliability, etc.[4]

Origins

Information systems in large organizations can be a source of frustration for their users.[2] In order to bypass perceived limitations of solutions provided by a centralized IT department, other departments may build up independent IT resources to suit their specific or urgent requirements.[5] It isn't uncommon for resourceful departments to hire IT engineers and purchase or even develop software themselves, without knowledge, buy-in, or supervision from a centralized IT department.

Implications

In most organizations, the prevalence of shadow systems results in a heavily fragmented application landscape, where consistency, security and governability are sacrificed to achieve the necessary level of business agility, whether for the purpose of innovation or mere survival.

Benefits

The main benefit of shadow IT is the increased reactivity. The host department has direct power over its shadow IT resources, as opposed to central ones. Also, alignment between departments, a time-consuming and sometimes impossible task, is avoided.

Shadow IT systems are an important source of innovation, and shadow systems may become prototypes for future central IT solutions.[3]

Incumbent IT management dealing with legacy infrastructure and data management challenges cannot easily provision data as a service, either because they are unaware of its advantages or cannot acquire the budget for its successful implementation. Against this background, neither can the IT department ever deliver against all business requirements at a low enough cost relative to a true DaaS IT department. These deficiencies lead the business to implement IT solutions that may be perceived to cost less to execute, albeit whilst introducing risks a formal IT project could avoid.

For example, with the rise of powerful desktop CPUs, business subject matter experts can use shadow IT systems to extract and manipulate complex datasets without having to request work from the IT department. The challenge for IT is to recognize this activity and improve the technical control environment, or to guide the business in selecting enterprise-class data analysis tools.

A further barrier to adopting DaaS is the legacy IT bulk provisioning of only the 'Read' element of the CRUD model (Create, Read, Update, Delete). This leads IT into neglecting the need to 'write back' into the original dataset, because this is complex to achieve. It is the need of shadow IT users to then store this changed data separately (I.E. 'siloeing') that results in a loss of organisational data integrity.

Placing barriers to shadow IT can be the equivalent of improving organizational security. A study[6] confirms that 35% of employees feel they need to work around a security measure or protocol to work efficiently. 63% send documents to their home e-mail address to continue work from home, even when they are aware that this is probably not allowed.

Drawbacks

Besides security risks, some of the implications of Shadow IT are:[7][8]

  • Wasted time Shadow IT adds hidden costs to organizations, consisting largely of non-IT workers in finance, marketing, HR, etc., who spend a significant amount of time discussing and re-checking the validity of certain data, setting up and managing systems and software without experience.
  • Inconsistent business logic If a ‘shadow IT’ spreadsheet application encapsulates its own definitions and calculations, it is likely that over time inconsistencies will arise from the accumulation of small differences from one version to another and from one group to another, as spreadsheets are often copied and modified. In addition, many errors that occur from either lack of understanding of the concepts or incorrect use of the spreadsheet frequently go undetected due to a lack of rigorous testing and version control.
  • Inconsistent approach Even when the definitions and formulas are correct, the methodology for doing analysis can be distorted by the arrangement and flow of linked spreadsheets, or the process itself can be wrong.
  • Wasted investment Shadow IT applications sometimes prevent full Return on investment (ROI) from investments in systems that are designed to perform the functions now replaced by Shadow IT. This is often seen in Data warehousing (DW) and Business informatics (BI) projects, which are initiated with good intentions, where the broader and consistent usage of DW and BI in the organization never really starts off. This can also be caused by management failure to anticipate deployment, licensing and system capacity costs when attempting to deliver DW & BI solutions. Adopting an internal cost model that forces potential new users of the DW/BI system to choose cheaper (shadow) alternatives, also plays a part in preventing successful enterprise implementation.
  • Inefficiencies Shadow IT can be a barrier to innovation by blocking the establishment of more efficient work processes. Additional performance bottlenecks and new single points of failure may be introduced when Shadow IT systems layer on top of existing systems. Data might be exported from a shared system to a spreadsheet to perform the critical tasks or analysis.
  • Higher risk of data loss or leaks Shadow IT data backup procedures may not be provided or audited. Personnel and contractors in Shadow IT operations may not be put through normal education, procedures or vetting processes. Originators of Shadow IT systems may leave the organization often leaving with proprietary data or leaving behind complicated systems the remainder of staff cannot manage.
  • Barrier to enhancement Shadow IT can act as a brake on the adoption of new technology. Because IT artifacts, e.g., spreadsheets, are deployed to fill critical needs, they must be replaced carefully. But lacking adequate documentation, controls and standards, that process is slow and error-prone.
  • Organizational dysfunction Shadow IT creates a dysfunctional environment leading to animosity between IT and non-IT related groups within an organization. Improper motivations behind Shadow IT efforts such as seeking job-security (i.e., "Bob is the only person with this data," or "What will happen if he leaves?"), data hoarding, self-promotion, favor trading, etc. can lead to significant management issues. A 2015 survey of over 400 global Chief information officers (CIOs) showed 90% of CIOs worldwide find themselves by-passed by line of business at least sometimes. One third (31%) of CIOs globally are routinely side-lined when it comes to making IT purchasing decisions.[9]
  • Compliance issues Shadow IT increases the likelihood of uncontrolled data flows, making it more difficult to comply with the Sarbanes-Oxley Act (USA) and many other compliance-centric initiatives, such as: Basel II (International Standards for Banking), GLBA (Gramm-Leach-Bliley Act),[10] COBIT (Control Objectives for Information and related Technology), FISMA (Federal Information Security Management Act of 2002), DFARS (Defense Federal Acquisition Regulation Supplement), GAAP (Generally Accepted Accounting Principles), HIPAA (Health Insurance Portability and Accountability Act), IFRS (International Financial Reporting Standards), ITIL (Information Technology Infrastructure Library), PCI DSS (Payment Card Industry Data Security Standard), GDPR (General Data Protection Regulation),[11] CCPA (California Consumer Privacy Act), NYDFS (New York Department of Financial Services) [12]

Prevalence

Shadow IT is notoriously hard to measure. Within an organization, the amount of shadow IT activity is by definition unknown, especially since departments often hide their shadow IT activities as a preventive measure to ensure their ongoing operations. Even when figures are known, organizations typically don’t volunteer these. As a notable exception, The Boeing Company has published an experience report[1] describing the alarming numbers of shadow applications which various departments have introduced to work around the limitations of their official information system.

According to Gartner, by 2015, 35 percent of enterprise IT expenditures for most organizations will be managed outside the central IT department's budget.[13]

A 2012 French survey [14] of 129 IT managers revealed some examples of shadow IT :

  • Excel macro 19%
  • software 17%
  • cloud solutions 16%
  • ERP 12%
  • BI systems 9%
  • Websites 8%
  • hardware 6%
  • VoIP 5%
  • shadow IT support 5%
  • shadow IT project 3%
  • BYOD 3%.

Examples

Examples of these unofficial data flows include USB flash drives or other portable data storage devices, MSN Messenger or other online messaging software, Gmail or other online e-mail services, Google Docs or other online document sharing and Skype or other online VOIP software—and other less straightforward products: self-developed Access databases and self-developed Excel spreadsheets and macros. Security risks arise when data or applications move outside protected systems, networks, physical location, or security domains.

Another form of shadow IT comes by way of OAuth connected applications, where a user authorizes access to a third-party application via a sanctioned application. For example, the user can use their Facebook credentials to log into Spotify or another 3rd party application via their corporate cloud app (Google G Suite or Microsoft Office 365). With this access, the 3rd party app may have excessive access to the sanctioned app, thereby introducing unintended risk.

References
  1. Handel, Mark J.; Poltrock, Steven (2011). "Working around official applications: experiences from a large engineering project". CSCW '11: Proceedings of the ACM 2011 conference on Computer supported cooperative work. pp. 309–312. doi:10.1145/1958824.1958870. S2CID 2038883.
  2. Newell, Sue; Wagner, Eric; David, Gary (2006). Clumsy Information Systems: A Critical Review of Enterprise Systems. Agile Information Systems: Conceptualization, Construction, and Management. p. 163. ISBN 1136430482.
  3. "How no-code development tools can benefit IT". Retrieved 2017-12-25.
  4. "Shadow IT - Should CIOs take umbrage?". CXO Unplugged. Retrieved 2012-04-25.
  5. Zarnekow, R; Brenner, W; Pilgram, U (2006). Integrated Information Management: Applying Successful Industrial Concepts in IT. ISBN 978-3540323068.
  6. RSA,November 2007,The Confessions Survey: Office Workers Reveal Everyday Behavior That Places Sensitive Information at Risk,available from (PDF), archived from the original (PDF) on February 11, 2012, retrieved September 15, 2017
  7. Raden, N., October 2005, Shadow IT: A Lesson for BI, BI Review Magazine, Data Management Review and SourceMedia, Inc.
  8. Myers, Noah and Starliper, Matthew W. and Summers, Scott L. and Wood, David A., The Impact of Shadow IT Systems on Perceived Information Credibility and Managerial Decision Making (March 8, 2016). Available at SSRN: http://ssrn.com/abstract=2334463 or https://dx.doi.org/10.2139/ssrn.2334463
  9. "Shadow IT is a reality for 90% of CIOs". Logicalis. 23 November 2015. Retrieved 2015-11-23.
  10. "Gramm-Leach-Bliley Act".
  11. "Under Construction".
  12. "23 NYCRR 500". govt.westlaw.com. Retrieved 2019-10-17.
  13. "Predictions Show IT Budgets Are Moving Out of the Control of IT Departments". Gartner. Retrieved 2012-04-25.
  14. RESULTATS DE L’ENQUETE SUR LE PHENOMENE DU "SHADOW IT" par Thomas Chejfec : http://chejfec.com/2012/12/18/resultats-complets-de-lenquete-shadow-it/
  • Discussion on Tech Republic
  • Industry's First Cloud Adoption and Risk Report
  • Line of business purchasing power moves out of the shadows
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.