What Is Shadow IT? The Risks to Your Company, Why It Happens and What to Do

Have you heard the term shadow IT?
It refers to staff using IT equipment or cloud services that the company has not formally approved, without permission, for work.

In the search for efficiency and convenience, shadow IT is increasingly being used.
It is also a cause of serious problems for companies, such as data leaks and security breaches — there is no shortage of news about businesses failing after a leak.

When individual members of staff each use a different tool, gaps open up in information and in the work itself, which makes things depend on individuals and leaves the quality of the service uneven.

For all these reasons, dealing with shadow IT is essential for any company.
This article explains in detail what shadow IT is, the risks it creates and the specific measures you can take.

▽Recommended for
・Anyone responsible for information security at a company
・Anyone wanting to tackle shadow IT
・Anyone wanting to make their internal IT environment safe

1. What is shadow IT?

Shadow IT means staff using IT equipment or cloud services that the company has not authorised, without permission, for work。

Specific examples of shadow IT include:

• Doing company work on a personal smartphone or PC
• Using cloud services the company has not approved, such as drives, note-taking apps or task tools
• Using a VPN or an outside Wi-Fi network without permission to exchange work data

.

Staff often turn to shadow IT in search of convenience or an easier way to work, but

it usually breaches the company’s security policy and carries considerable risk.

2. The difference between shadow IT and BYOD

BYOD (bring your own device) is a term with a similar meaning to shadow IT, but strictly speaking the two differ.

BYOD means using a personal device for work with the company’s formal permission.
It is the same as shadow IT in that a personal device is used, but it differs in that shadow IT happens “ without the company’s permission” when personal devices or tools are used for work.

BYOD is sometimes adopted precisely in order to prevent shadow IT.

The table below sets out the differences between shadow IT and BYOD.

	Shadow IT	BYOD
Company permission	None (used without permission)	Yes (officially approved)
Security measures	Does not follow company policy	Follows company policy
Main risks	Data leaks, malware infection and the like	Risk reduced through proper management
Example of use	Using Google Drive or a personal PC without asking	Using a personal device under rules the company has set

3. Why shadow IT arises

So why does shadow IT happen in the first place?
Some staff do not follow the rules.
Their level of IT literacy varies.
Both are of course part of it, but they are not the whole story.
The biggest cause of shadow IT is in fact that the company’s IT environment does not meet what its staff need。

People who use shadow IT

• They want to get the work done more smoothly
• The IT systems in place are awkward to use, or inflexible
• The internal systems are old and difficult to operate
• There is no support for smartphones, so they cannot work away from the office
• Excessive security blocks the functions they need and the work becomes impossible

often do so for reasons such as these.
Leaving the functions and the environment people need for their work unattended builds frustration, until they start using unauthorised tools to get the job done more efficiently.

4. Devices and tools commonly used as shadow IT

Certain devices and tools turn up as shadow IT far more often than others.
Here we look at the devices and tools most likely to be used without the company’s permission.

4.1 Personal devices (smartphones and PCs)

Using a personal smartphone or PC for work alongside the device the company issues is very common.
Personal devices are typically used in situations like these.

• The company-issued PC is awkward to use, or cannot be used away from the office
• They want to work in places where they cannot reach the internal network, such as out on the road

Note that personal devices fall outside the company’s security measures, which raises the risk of a data leak.

4.2 Chat tools

Staff also use the chat tools they use personally, alongside or instead of the communication tool the company has formally approved.

◆Examples of chat tools
・LINE
・Facebook Messenger
・Slack
・Chatwork

These tools are convenient, but there is a risk of a data leak from sending a message to the wrong person.
Even where a company has formally adopted a chat tool, staff may still use others for the following reasons.

• It is awkward to use, or its features are restricted
• They want to communicate more smoothly with the other person

4.3 Free email services

Free email services are another tool easily used without permission.
Where the company’s email system is restricted, staff sometimes use the free email account they use personally for work.

◆Examples of free email
・Gmail
・Yahoo! Mail
・Outlook
・iCloud Mail, and others

Free email services fall outside the company’s security monitoring, so the risk of unauthorised access and data leaving the business is very high.
They still get used, for reasons such as these.

• They use it every day, so they are familiar with it
• Internal email is heavily restricted and inconvenient
• Internal email cannot be checked away from the office, so work email is forwarded to a free account

4.4 Cloud storage

Cloud services the company has not approved are also used to manage work data and share files.

◆Examples of cloud services
・Google Drive
・Dropbox
・OneDrive
・iCloud Drive
・Box, and others

Using cloud services without permission, against the company’s data management policy, can raise the risk of confidential information leaving the business and of unauthorised access, so it needs watching.

4.5 Public Wi-Fi and other outside networks

Staff also connect to networks with inadequate security while out of the office or working remotely.

◆Examples of public Wi-Fi and outside networks
・Hotel guest Wi-Fi
・Cafe Wi-Fi
・Convenience store Wi-Fi
・Railway Wi-Fi
・Airport Wi-Fi, and others

Is this happening at your company — sales staff who travel and meet clients, or staff working remotely, using free Wi-Fi in a cafe or a public building to reach internal systems?

Public Wi-Fi is often inadequately encrypted, and carries a risk of traffic being intercepted or hacked, so treat it with care.

5. The risks shadow IT poses to a company

While shadow IT makes an individual’s work more convenient, it raises a company’s security risk considerably。
The risks of data leaks and cyber attacks in particular grow, so companies need to understand the impact correctly and take appropriate measures.
Here are examples of the main risks to a business.

• Unauthorised access
• Account takeover
• Malware and virus infection
• Intrusion into the LAN

We look at each in turn.

5.1 Unauthorised access

Using tools the company neither knows about nor manages raises the risk of unauthorised access from outside.
Free email accounts with lax password management, and chat tools that have never been approved by the company, are especially easy targets for hacking.

How unauthorised access happens For these,

• An employee exchanged work data through a personal free email account and that account was hacked
• Someone used public free Wi-Fi, the traffic was intercepted and login details were stolen
• A phishing scam led an employee to enter a password on a fake login screen

and so on.
For the business,

• Critical data reaches an outside attacker and escalates into a ransom demand (a ransomware incident)
• A hacked account becomes the foothold for breaking into internal systems and causes a data leak

are among the risks, and they can lead to data leaks and financial loss.

5.2 Account takeover

Most tools used as shadow IT have no multi-factor authentication (MFA) such as two-step or two-factor verification. That makes a leaked password, and the account takeover that follows, far more likely.

How account takeover happens For these,

An employee saves work data in personal cloud storage
↓
The password leaks
↓
The account is taken over

is one such sequence.

There are other cases too: login details for internal systems noted on a personal phone, which leak when the phone is lost or stolen and are then abused.
For the business,

• The hijacked account is used to impersonate the company in correspondence with clients and suppliers (business email compromise)
• Internal data is accessed without authorisation and then altered, deleted or exploited
• Customer information leaks and public trust is badly damaged

are among the risks.

5.3 Malware and virus infection

Using tools the company has not approved also raises the risk of infection by malicious malware and viruses.

How malware infection happens For these,

• Work data was handled on a personal PC whose security was inadequate, and it caught a virus
• Malware was planted when internal systems were accessed over free Wi-Fi
• Unapproved free software was used for work and it contained malicious code

is one such sequence.
For the business,

• A virus spreads across the whole internal network and forces the business to stop
• Malware leaks passwords and confidential information to outsiders
• Critical internal data is encrypted by ransomware and recovery costs a great deal

are among the risks, and they can lead to data leaks and financial loss.

We have given three examples here, but the risks of shadow IT are far wider.
Because the impact can threaten the survival of the business, companies need to raise individual security literacy on the soft side and, on the hard side, act quickly to build an environment in which shadow IT does not arise.

6. Four steps for tackling shadow IT

Tightening the rules alone will not stop shadow IT.
Alongside a change of mindset across the organisation, you need to build something fundamental that delivers both convenience and security in your systems and tools.
Here we set out the practical steps against shadow IT that a company should take, in four steps.

6.1 Step 1. Find out where shadow IT stands internally

To prevent shadow IT, the first thing is that it matters to know which unofficial tools are in use inside the company。
If you are a system administrator without that picture, check it now.
In doing so, be clear about why employees reach for unapproved tools rather than the official ones and you can put the right measures in place.
Ways to take stock include

running a survey or interviews with employees
・Monitoring network logs
・Taking an inventory of access rights

and similar work.
Taking stock sometimes reveals that people turn to shadow IT out of frustration: they cannot reach customer data while out of the office, or sharing files is awkward.

Making current shadow IT use visible and analysing its causes is the first step towards measures that work.

6.2 Step 2. Build an environment where shadow IT is not needed

As noted above, one of the biggest reasons shadow IT appears is that the approved IT tools do not fit what employees need for their work.
So it is better to write it as it matters to put a genuinely convenient environment in place so that employees have no reason to go looking for unapproved tools。

In practical terms, that means

• Reviewing the approved internal tools you already have
• Introducing new tools where they are needed
• Making sure people know how to use the approved tools
• Improving UI and UX from the user’s point of view

and similar work.
When reviewing internal tools, HubSpot is worth considering: built on customer information management, it also carries marketing automation (MA) and sales force automation (SFA) functions.

Related article:
What is HubSpot? What it does, what it costs, and how it differs from other tools

Get to a point where employees feel the approved tools are enough to do their job, and the need for shadow IT disappears at the root.

Ask us about HubSpot

6.3 Step 3. Set guidelines

Alongside the measures above, preventing shadow IT also requires the company to set clear rules and make them known to employees。
The key is to draw up guidelines on the use of IT tools and state plainly what is permitted and what is forbidden.

In the guidelines,

• State which tools and services the company permits (a list is recommended)
• Spell out what is prohibited
• Set rules for exceptional use (allowing exceptions on application, for example)
• State the penalties

include items such as these.
Set clear rules, and let employees know the organisation is flexible enough to allow exceptions where they are warranted. Be explicit, too, about the strict rules, penalties included.
Update the guidelines regularly and communicate each update.
Updating and communicating keeps the IT environment consistent across the organisation.

6.4 Step 4. Employee training and access monitoring

However strict the rules, though, shadow IT cannot be stopped completely unless employees understand why they matter.
So it is better to write it as it matters to combine continuous training with appropriate monitoring。

The points for employee training are

• Communicate the risks of shadow IT and its impact on the company and its people
• Train people in the proper use of approved tools
• Run e-learning and regular training sessions

Access monitoring also needs to be strengthened.
How far to take access monitoring is a judgement each company makes differently, but we recommend doing what you can.
For example,

• Monitoring access logs for the internal network
• Detecting unusual activity outside working hours
• Introducing automatic alerts (a warning when an unapproved tool or free email is used)
• Making multi-factor authentication mandatory

There is a great deal you can do.

Improving the company’s IT environment while setting rules such as guidelines and training employees, all in parallel, is how you reach a point where employees no longer need shadow IT.

7. Towards an internal environment that is safe and comfortable

We hope that was useful.
Shadow IT usually arises because an individual wants to work more efficiently, so the measures you take need to address the root.
Security work costs money and generates no profit, so some companies leave it until later, but once unauthorised access or a data leak has happened it is too late.

To keep shadow IT at bay, take another look at your own security arrangements.

One way to build an internal system environment that does not invite shadow IT is to adopt a CRM people can use away from the office.
HubSpot in particular carries a wide range of functions, so work can be completed within the platform, which in itself curbs shadow IT.
NowVillage is a certified partner for HubSpot, a CRM platform highly regarded worldwide.
If you are considering a CRM, do get in touch.

Talk to NowVillage about adopting a CRM