1
00:00:00,05 --> 00:00:03,00
- [Instructor] Most of the dangers on the cybersecurity

2
00:00:03,00 --> 00:00:05,05
threat landscape come from malicious actors

3
00:00:05,05 --> 00:00:07,05
outside of your organization.

4
00:00:07,05 --> 00:00:09,03
Shadow IT is different though

5
00:00:09,03 --> 00:00:12,07
because this threat comes from within your organization

6
00:00:12,07 --> 00:00:14,09
and many times it's not malicious.

7
00:00:14,09 --> 00:00:17,08
That doesn't mean it's not a serious problem.

8
00:00:17,08 --> 00:00:20,09
Let's take a look at Shadow IT and why it's part

9
00:00:20,09 --> 00:00:23,07
of the cybersecurity threat landscape.

10
00:00:23,07 --> 00:00:27,09
Shadow IT refers to the unauthorized use of systems,

11
00:00:27,09 --> 00:00:30,02
software, personal devices,

12
00:00:30,02 --> 00:00:34,00
or cloud services by enterprise employees.

13
00:00:34,00 --> 00:00:37,02
To best manage and secure IT systems,

14
00:00:37,02 --> 00:00:39,05
all technology purchases should be approved

15
00:00:39,05 --> 00:00:43,08
and budgeted by a shared services IT function,

16
00:00:43,08 --> 00:00:46,03
but users will sometimes go around IT

17
00:00:46,03 --> 00:00:49,02
and purchase technology with their own budget.

18
00:00:49,02 --> 00:00:52,08
When implemented, this unsanctioned and often unmanaged

19
00:00:52,08 --> 00:00:54,07
technology solution becomes part

20
00:00:54,07 --> 00:00:57,04
of the Shadow IT in the enterprise.

21
00:00:57,04 --> 00:01:00,09
IT will either find out about these Shadow implementations

22
00:01:00,09 --> 00:01:04,09
after they've been deployed or even worse, not at all.

23
00:01:04,09 --> 00:01:08,01
There are many reasons behind the rise of Shadow IT

24
00:01:08,01 --> 00:01:12,00
but some of the most common are understaffed IT departments

25
00:01:12,00 --> 00:01:15,01
that can't support the IT needs of users.

26
00:01:15,01 --> 00:01:18,06
The perception by users that IT is too slow or restrictive

27
00:01:18,06 --> 00:01:22,07
with technology deployments, and easy access to software

28
00:01:22,07 --> 00:01:26,09
as a service or SaaS solutions like Dropbox, Salesforce,

29
00:01:26,09 --> 00:01:29,03
or Amazon web services.

30
00:01:29,03 --> 00:01:31,06
Shadow IT can represent a large amount

31
00:01:31,06 --> 00:01:34,01
of spending in organizations.

32
00:01:34,01 --> 00:01:37,02
In fact, Gartner has estimated that Shadow IT accounts

33
00:01:37,02 --> 00:01:41,07
for 30 to 40% of IT spending in large enterprises.

34
00:01:41,07 --> 00:01:45,03
Other research states that this number could be even higher

35
00:01:45,03 --> 00:01:46,07
but many enterprise leaders

36
00:01:46,07 --> 00:01:49,00
either aren't aware of the Shadow IT problem

37
00:01:49,00 --> 00:01:51,09
or downplay it as not that big of a deal.

38
00:01:51,09 --> 00:01:53,05
That can be a costly mistake

39
00:01:53,05 --> 00:01:57,01
because there are real risks associated with Shadow IT,

40
00:01:57,01 --> 00:01:58,08
simply put it's impossible

41
00:01:58,08 --> 00:02:01,00
for the enterprise to secure systems

42
00:02:01,00 --> 00:02:05,03
that the organization's IT function isn't even aware of.

43
00:02:05,03 --> 00:02:08,07
Here are just a few of the Shadow IT risks.

44
00:02:08,07 --> 00:02:10,06
First is data loss,

45
00:02:10,06 --> 00:02:13,02
if the Shadow IT systems are processing

46
00:02:13,02 --> 00:02:15,04
or storing important information,

47
00:02:15,04 --> 00:02:17,02
it probably isn't being included

48
00:02:17,02 --> 00:02:19,07
in the enterprise backup solution.

49
00:02:19,07 --> 00:02:23,06
So if the data is lost there's no chance for recovery,

50
00:02:23,06 --> 00:02:26,05
even worse if the information is confidential

51
00:02:26,05 --> 00:02:29,03
and the Shadow IT systems aren't secured,

52
00:02:29,03 --> 00:02:32,00
that could lead to a data breach.

53
00:02:32,00 --> 00:02:34,09
Next is unpatched vulnerabilities,

54
00:02:34,09 --> 00:02:37,06
Shadow IT systems probably aren't being included

55
00:02:37,06 --> 00:02:40,09
in vulnerability scans or scheduled patch cycles.

56
00:02:40,09 --> 00:02:43,02
That means these systems could have vulnerabilities

57
00:02:43,02 --> 00:02:47,02
that expose them to attacks and possible data breaches.

58
00:02:47,02 --> 00:02:51,03
And lack of security compliance, all sanctioned IT solutions

59
00:02:51,03 --> 00:02:53,00
should be deployed with standard

60
00:02:53,00 --> 00:02:57,01
security controls that may not exist on Shadow IT systems.

61
00:02:57,01 --> 00:03:00,00
These could include antimalware, encryption,

62
00:03:00,00 --> 00:03:02,01
security monitoring, and more.

63
00:03:02,01 --> 00:03:04,09
And enterprise could be subject to big fines

64
00:03:04,09 --> 00:03:07,05
if a data breach occurs on Shadow IT systems

65
00:03:07,05 --> 00:03:09,06
that aren't compliant with enterprise

66
00:03:09,06 --> 00:03:12,05
or regulatory security controls.

67
00:03:12,05 --> 00:03:14,03
We can expect that IT departments

68
00:03:14,03 --> 00:03:15,07
will continue being challenged

69
00:03:15,07 --> 00:03:18,07
by users who circumvent required processes

70
00:03:18,07 --> 00:03:22,00
for implementing IT solutions.

71
00:03:22,00 --> 00:03:24,09
For this reason, we'll likely see Shadow IT being part

72
00:03:24,09 --> 00:03:28,00
of the cybersecurity threat landscape for some time.