Companies are at an increased risk of becoming targets of cyber incidents due to the use of shadow IT by their employees amid the growing trend towards a distributed workforce, a recent study has found. According to research by Kaspersky, 77% of companies suffered cyber incidents in the last two years, and 11% of these were caused by the use of shadow IT.
The study showed that, in the last two years, 11% of companies worldwide have suffered cyber incidents due to the use of shadow IT by employees. The consequences of the use of shadow IT can be diverse in their severity, but they are never insignificant, whether it’s the leak of a piece of confidential data or tangible damage to business.
So, what is shadow IT?
Shadow IT is the part of the company’s IT infrastructure that is outside the purview of the IT and Information Security departments, i.e. applications, devices, public cloud services etc. but that is not being used in accordance with information security policies. Deployment and operating shadow IT can lead to serious negative outcomes for businesses. Many instances
were found in the Kaspersky study, which revealed that the IT industry – had been the hardest hit, suffering 16% of cyber incidents due to the unauthorized use of shadow IT in 2022 and Other sectors hit by the problem were critical infrastructure and transport & logistics organizations, which saw 13%.
Recent case of Okta clearly proves the dangers of using shadow IT. This year, an employee using a personal Google account on a company-owned device unintentionally allowed threat actors to gain unauthorized access to Okta’s customer support system. There they were able to hijack files containing session tokens that could then be used to conduct attacks. This cyber
incident lasted for 20 days and impacted 134 company’s customers according to Okta’s report.
Outlining ‘blurry shadows’
So, when you are looking for shadow IT, what to look for? These can be either unauthorized applications installed on employee computers, or unsolicited flash drives, mobile phones, laptops, etc.
“Employees who use applications, devices or cloud services that are not approved by the IT- department, believe that if those IT-products come from trusted providers, they should be protected and safe. However, in the ‘terms and conditions’ third-party providers use the so- called ‘shared responsibility model’. It states that, by choosing ‘I agree’ users confirm that they will perform regular updates of this software and that they take responsibility for incidents related to the use of this software (including corporate data leakages). But at the end of the day business needs tools to control the shadow IT when it’s used by employees.
