This is a short post looking at the challenges of adopting unknown software; challenges that include a lack of change control, IT security and ISMS involvement, as well as the increased chance of cyber-attack and loss.
We will look at network based shadow IT, the advent of shadow IT via the Cloud and tips to tackle the threat.
Shadow IT and Your ISMS: What is it and Why is a Security Risk?
Shadow IT is the installation or access of software without the Information Security Manager’s knowledge. Common justifications for shadow IT are “operational necessity”, “cost” and “convenience”. Often there is no malicious intent on behalf of the offending user or team, they simply need an app (e.g. a cloud service) to help them complete their tasks.
The crux of the problem is a likely perception that the existing ISMS change control process is either bureaucratic or unhelpful. This dissuades people from engaging the security team for advice or submitting formal requests. Instead they will look for gaps enabling them to download internet code, access cloud apps or install software.
Shadow IT is an indicator of a loose approach to security and a weak ISMS. As well as the malware risk posed by unknown code, consider the data exposure risk of “untrusted cloud services”. Further complicating the issue are rules on data location, sovereignty and privacy. Whilst these are routine ISMS considerations for formal cloud adoption, they will not have been considered by users who “outsource” shadow IT.
Shadow IT for “Traditionalists” and “Outsourcers”
The “traditional” shadow IT problem is that the ISMS will not include all of the applications, servers or file stores on your IT estate. The result is incomplete information risk assessment, inadequate vulnerability controls and increased opportunity for breach or loss.
Common to all shadow IT is the inability to establish the security testing and defences deployed within shadow applications. This can lead to more cyber-attacks by way of malware and malicious code deployment, as covered in our MITM post.
With the adoption of cloud, a new world of shadow IT has opened up for a small monthly charge to a corporate credit card under “expenses”. Major concerns here have to be the safety of personal and sensitive data as the consequences of EUGDPR related breaches are severe. Any activity (e.g. data export) indicating unsanctioned data processing and hosting “off premise” will need to be identified, challenged and quashed.
People Hacks for Shadow IT: Educate and Persuade
The best time to educate users about cyber security is when they first join an organisation as part of their induction process. The next best time is when they change role, particularly for anybody moving to a sensitive post reliant on data. Consequently, you should know what those roles are.
Finding the balance between the cyber “scare story” and benefits of training and education can be challenging. Consider whether personnel are already saturated with data protection and cyber security matters and don’t forget those who give the briefing. All staff will need meaningful collateral on data protection, malware, ransomware, phishing attacks etc. just as much as shadow IT. This NCSC link will help readers in the UK, whilst this link will support those in Australia.
Similar briefings should be available to existing users. Don’t forget to include guidance as to how and when to contact the security team, particularly if they suspect an incident or breach.
Process Hacks for Shadow IT: Accessibility and Transparency
Making change control and security processes accessible will help improve cyber resilience. Whilst you should not bombard personnel with “ISMS essentials”, useful processes such as change control requests and risk reporting should be reviewed for availability to those who benefit most.
A neat trick is to promote the wealth of apps, services and systems that are already available. It is feasible that shadow IT has been adopted in ignorance of opportunities that are already in place.
You should also ensure that any security briefing is clearly corroborated within policy including your Security Operating Procedures (SyOPs). It sounds old fashioned but, nothing focusses the mind more than signing to say that procedures have been read and that the user is aware of the consequences of not following them.
Tech Hacks for Shadow IT: Monitor and Control
Despite the best efforts of education, briefing and policy writing, there will be occasions where shadow IT continues to be adopted. It is all too easy (and tempting!) for teams to adopt cloud-based project workflow tools or drag large files to unknown cloud storage.
This is where technology capabilities that pivot around and monitor the user, network, devices and data should be considered. This will help identify the signs and symptoms of shadow IT.
ISMS team considerations:
- Monitoring for executable processes within the network suggesting new software deployment
- Analysis of web traffic to identify dangerous sites or indication that significant volumes of data have been exchanged
- Blocking URLs on web gateways for any cloud shadow IT services that have been previously identified
- Data import and export monitoring suggesting the move of data to unknown places
- Data encryption by default to reduce the chance of loss even when data leaves your network.
ISMS Hacks for Shadow IT: A Combination Approach
Shadow IT has evolved from unapproved software deployment on a single network terminal, to now include the variety and power of apps in the cloud. As ever, how much risk you accept depends on the appetite of your risk owner.
Commercial organisations might want users to have freedom in respect of application adoption. This “risk-hungry” approach is especially true if it helps drive growth. For others, particularly those handling personal and sensitive data, the use of unapproved software will be a definitive red line that is not to be crossed.
Communicating your shadow IT position is a key step in effective management. Don’t leave users with uncertainty and a potential defence for prohibited activity. As with all ISMS strategies, a combined approach of people, process and technology controls will be the best approach.
Products
Solutions by Industry
Learning & Resources
About Huntsman
