Around 89% of Indian organizations suffered cyber incidents in the past two years, and 20% of them were due to the use of shadow IT, a report by cybersecurity firm Kaspersky has revealed.
Globally, employee use of shadow IT has been the cause of a cyber incident in 11% of organizations in the past two years.
According to the report, as the workforce becomes increasingly remote and distributed, employee use of shadow IT puts organizations at higher risk of cyber incidents.
What is Shadow IT?
Shadow IT is the part of an organization’s IT infrastructure that is outside the purview of the IT and information security department, such as software, applications, unsolicited devices, and public cloud services. IT/security departments often have no knowledge of shadow IT infrastructure, and employees do not use it in accordance with information security policies.
Hardware that is abandoned after an IT infrastructure modernization can also be used behind the scenes by employees and acquire vulnerabilities that can later impact the company’s infrastructure.
“We believe that employees who use applications, devices, and cloud services that are not approved by IT should be protected and secure if those IT products come from trusted providers. ” said Alexei Vobuk, Head of Information Security at Kaspersky Lab.
“However, in our Terms of Use, third-party providers use a so-called “shared responsibility model.” By selecting “Agree”, the user confirms that he/she will perform regular updates of this software and will be responsible for any incidents (including the breach of corporate data) related to the use of this software. ”, Vovk added.
Deploying and operating shadow IT can have serious negative business consequences. The study found that the IT industry was the hardest hit, with 16% of cyber incidents due to shadow IT abuse in 2022 and 2023. Other sectors affected include critical infrastructure, transport and logistics organizations, with 13% affected. The report said there had been an attack.
Shadow IT risk mitigation
To reduce the risk of shadow IT usage, this study recommends the following steps:
Build collaboration between business and IT departments to create new and improved IT services.
Perform regular IT asset inventories and scan internal networks to avoid the emergence of unmanaged or abandoned hardware and services.
Allow employees’ personal devices to access only the resources they need to do their job. Use an access control system to allow only authorized devices.
We will conduct training aimed at improving the information security literacy of employees and IT security experts.
Deploy products and solutions that can limit the use of unwanted apps, websites, and peripherals.
Limit employees’ ability to use third-party external services and, if possible, block access to the most common cloud information exchange resources.
“At the end of the day, businesses need tools to control the shadow IT used by their employees. Of course, information security departments need to protect themselves from unauthorized use of unmanaged and unsafe hardware, services, and software applications. To ensure this, you should conduct regular scans of your company’s network,” says Vovk.