Shadow IT Guide: Examples, Advantages, Risks

Information systems in big businesses may be a cause of aggravation for their users. To avoid perceived or real restrictions imposed by solutions given by a centralized IT department, employees or other departments may set up autonomous IT resources to fit their specialized or urgent needs. It isn't unusual for resourceful departments to recruit IT professionals and acquire or even build software independently, without awareness, buy-in, or oversight from a centralized IT department.

Shadow IT is the usage of information technology systems, software, devices, applications, and services without explicit IT department authorization. In recent years, the prevalence of shadow IT has increased due to corporate transformation initiatives. Shadow IT has developed dramatically with the introduction of cloud-based apps and services. According to a 2019 report by Everest Group, roughly half of all IT spending "lurks in the shadows". Notably, these numbers predate the epidemic. As employees fought to sustain productivity in a new environment with fewer resources, the rapid surge of remote workers caused by COVID-19 limits probably contributed to a rise in shadow IT.

While shadow IT may boost employee productivity and foster creativity, it can also pose severe security concerns to companies via data breaches, possible compliance violations, and more. Shadow IT is a problem that must be addressed to preserve network visibility and security from an IT and cybersecurity standpoint.

Best Practice

Zenarmor is one of the best next-generation firewalls that you can use in your corporate network to lower the shadow IT risks. The Zenarmor NGFW extension facilitates the rapid conversion of an open-source firewall into a Next Generation Firewall within a matter of seconds.

The various features of Zenarmor, such as device identification and access control, application control, advanced reporting, user- and device-based filtering and reporting, allow organizations to systematically decrease shadow IT risks through the implementation of accurate security policies, the control of unauthorized applications, and the vigilant monitoring of network activity.

Zenarmor Free Edition is offered without charge to all open-source firewall users.

In this article, we'll explain what shadow IT is, why employees choose to use shadow IT, and the advantages and risks of shadow IT usage. You'll find the details about shadow IT policy, shadow IT tools, and best practices for shadow IT control.

What is Shadow IT?

Shadow IT is the information technology (IT) systems installed by departments other than the central IT department, to work around the perceived or real deficiencies of the central information systems. According to Gartner:

"Shadow IT" refers to IT devices, software, and services outside the ownership or control of IT organizations."

In the past, "Shadow IT" was often the result of an employee's request for immediate access to hardware, software, or a specific online service without following the proper procedures to acquire the technology through corporate channels. With the emergence of cloud computing, shadow IT has grown to encompass personal equipment that workers use at work or cloud services that match the special needs of a certain business division and are maintained by a third-party service provider or in-house group, rather than by corporate IT.

"Shadow IT" is seldom used maliciously. Rather, it is a practice supported by workers because their daily responsibilities require quick, flexible, and frictionless access to a variety of tools and apps. However, Shadow IT typically raises security and compliance difficulties.

When unsupported hardware and software are not subject to the same security procedures as supported technology, Shadow IT may pose security hazards. Furthermore, technologies that run without the IT department's awareness might significantly influence the user experience of other workers by reducing bandwidth and generating scenarios in which network or software application protocols clash. Shadow IT may also become a compliance risk when, for example, an employee maintains company data on their personal DropBox account.

The solution to shadow IT is not figuring out how to eradicate its usage, but rather how to equip workers with the tools they need to fulfill business goals quickly and at scale.

Why Do Workers Use Shadow IT?

Given the many security dangers posed by shadow IT, many workers prefer to use new technologies without IT permission. According to Gartner data, 30 to 40 percent of companies' acquisitions entail shadow IT expenditure on average. According to a study by Everest Group, these percentages are closer to 50 percent. User motivations for preferring shadow IT include the following:

• Employees are using unauthorized tools for nefarious purposes: Some workers may choose to adopt unauthorized apps and technologies to steal data, get access to secret information, or create additional threats to the firm.

• Employees are more concerned with the advantages of employing unauthorized tools: One of the primary reasons people participate in shadow IT is simply to work more effectively. A 2012 RSA study showed that 35 percent of workers feel that they need to get around their company's security regulations merely to get their job done. The finest tools for the task may not be those that have been formally endorsed by the IT department of a business. This often motivates workers to embrace extra services that help them achieve a particular company need, acquire a competitive edge in the market, or cooperate more effectively.

• Employees are ignorant of the inherent security concerns of shadow IT: Employees may not be intentionally attempting to overcome the protections implemented by their IT department; rather, they may be unaware that their activities might endanger important company data and raise the risk of data breaches and attacks.

• Communication and coordination may be insufficient: Inadequate communication and coordination between developers and the IT team further impede the needed speed and adaptability of IT support for the approval of essential technologies. Inadequate security skills tend to prohibit businesses from accepting new technologies, even when they wish to provide developers with the most cutting-edge industry solutions.

What are the examples of Shadow IT?

The most widely used Shadow IT examples are listed below:

• Excel macro 19%

• Software 17%

  • Slack
  • Skype
  • Zoom
  • WhatsApp

• Cloud services 16% (including IaaS, PaaS, SaaS)

  • Dropbox
  • Google Docs
  • Microsoft Office 365

• ERP 12%

• BI systems 9%

• Websites 8%

• Hardware 6%

• VoIP 5%

• Shadow IT support 5%

• Shadow IT project 3%

• BYOD 3%

  • Laptops
  • Smartphones
  • Tablets

What are the Risks of Shadow IT?

If the IT team isn't aware of an application, they can't maintain it or assure that it's safe. A Gartner report, written in 2020, says that one-third of successful cyber attacks encountered by organizations would be on their shadow IT resources. Shadow IT brings the following risks and drawbacks to your organization:

• System Inadequacies: Shadow IT is often a complicated issue. That is to say if a company fails to give its workers the resources they need to execute their jobs, and those individuals then rely on their resources to compensate, the company is less likely to notice the need for infrastructure investments, new skills, or processes. In addition, firms using shadow IT do not have a single source of truth for their data. This indicates that data analysis and reporting may be erroneous, inconsistent, or lacking. This may diminish the quality of insights derived from the data and pose compliance difficulties.

• Data Loss: Shadow IT isn't all intrinsically harmful, but specific capabilities like file sharing/storage and collaboration (e.g., Google Docs, Office365) may result in critical data breaches. And this threat is not limited to apps. 63 percent of workers who work from home transmit business papers to their email, exposing data to networks that cannot be managed by IT. Another difficulty with shadow IT is that company-wide access to data or other assets housed in personal accounts is restricted. If an employee resigns or is dismissed, they may retain access to cloud-based assets, but the company may lose access. Another significant factor is that shadow IT is not governed by business rules and processes. This may indicate that cloud-based data is not backed up, preserved, or encrypted by corporate policy.

• Visibility and Management: Indeed, you cannot defend what you cannot see. Shadow IT is, by definition, invisible to IT security, which raises the likelihood that vulnerabilities, misconfigurations, and policy breaches will go unnoticed.

• Cost: In many instances, workers use shadow IT to save money. However, long-term usage of these services or growing them throughout the enterprise may not be cost-efficient. For instance, a personal cloud storage service that is expanded to serve a business account is prohibitively expensive in comparison to systems created particularly to accommodate corporate customers. Shadow IT also brings indirect costs in the form of noncompliance fines and penalties, reputational damage in the case of a data breach, and timely and intense IT assistance if the service must be relocated or de-provisioned.

• Attack Surface Enlargement: While data loss is a significant worry for businesses, data theft may pose an even greater threat. Each instance of shadow IT increases the organization's attack surface. These assets are not protected by the organization's cybersecurity solutions, such as endpoint detection and response (EDR), next-generation firewall (NGFW), antivirus, and cyber threat intelligence services, since shadow IT is not visible to the IT or cybersecurity team. Further, shadow IT services are often constructed using weak or default credentials or may be prone to misconfigurations, all of which may be abused by attackers to gain access to the organization's larger corporate network.

• Non-compliance: The threat of shadow IT may have far-reaching impacts on firms subject to severe compliance standards. Shadow IT generates extra audit points at which evidence of compliance must be augmented. For example, if healthcare institution IT users store sensitive patient data in Shadow IT cloud storage systems, they may be compelled to audit, identify, and report the breadth and effect of each event. In addition to exposing privacy-sensitive information to cyber attacks, the company may face expensive litigation or penalties for noncompliance, which may harm its business and brand name.

• Wasted Time: Shadow IT adds hidden expenses to firms, consisting mostly of non-IT personnel in finance, marketing, etc., who spend a substantial amount of time reviewing and re-checking the veracity of specific data, setting up and operating systems and software without expertise.

• Increased Downtime: If anything goes wrong with shadow IT, the amount of downtime might be worsened by the user's lack of expertise. When an employee has a problem, it may take them many hours to resolve it. A qualified IT specialist with experience resolving this sort of issue, on the other hand, might do it in only minutes.

• Collaboration Ineffectiveness: Collaboration becomes ineffective when staff depends on distinct apps across departments. What happens, for instance, if one department utilizes Google Drive for file sharing and another uses Box, and the two teams must collaborate on a project? How often will a document be posted, modified, and downloaded between the two services? The typical business utilizes more than 50 distinct file-sharing services. Cooperation would be much simpler if a company decreased the number of enterprise licenses to two or three.

• Configuration Management Disruption: IT departments must develop a configuration management database (CMDB) to assist in determining how systems interact. When an unapproved program or piece of hardware is introduced, it is unlikely that it will be supported or added to the CMBD since IT is ignorant of its presence. Shadow IT has the potential to disrupt the delicate operations that the IT staff has spent months or years designing.

What are the cyber-attacks related to Shadow IT?

Among the many cyber threats caused by shadow IT are the following:

• Ransomware: Unprotected personal devices linked to workplace networks are entry points for ransomware. According to Verizon's 2019 Data Breach Investigations Report, 70% of all malware infections occur in healthcare because patient health data is a bestseller on the Dark Web, with prices ranging from $250 to over $1,000 per record. Once ransomware infects a computer or network, it threatens to withhold access to or destroy an organization's data. After being inadvertently downloaded by an employee on a corporate or personal network-connected device, ransomware may readily infiltrate an enterprise network.

• Botnet: According to Verizon's most recent 2019 Data Breach Investigations Report, the creation and targeting of Botnet armies that exploit weak IoT devices to attack business networks is on the increase. According to a 2019 report by Verizon, "Botnets is genuinely a low-effort assault that recognizes no borders and offers attackers either direct income via bank account". Botnets are also used to steal privileged access credentials to company systems accessed using the same personal devices workers use to view social media and make purchases. According to Verizon, there have been over 40,000 breaches launched by botnets so far this year. The research said a variation of the Mirai IoT botnet started searching for susceptible Drupal servers and was successful in locating the most vulnerable systems worldwide to install crypto mining software. A straightforward entry point for hackers to get data from company systems.

• DDoS: Distributed Denial of Service (DDoS) attacks are frequently initiated by a collection of compromised connected devices, which are frequently the least protected threat surface on corporate networks. It's common for DDoS attacks to begin with malicious actors seizing whatever susceptible device they can to send repetitive and frequent requests that overwhelm the Domain Name Server (DNS) in an attempt to impede its capacity to process legitimate inquiries, sometimes to the point where it ceases to operate.

• DNS Tunneling: Every unsecured personal device on a corporate network is an attractive entry point for hackers and other malicious actors to compromise an enterprise network. The most prevalent method is DNS tunneling, which allows attackers to implant malware or sends stolen information into DNS requests, thereby establishing a covert communication route that circumvents the majority of firewalls. Project Sauron remained undiscovered for five years by several firms that exploited DNS tunneling for data exfiltration.

What are the Benefits of Shadow IT?

Shadow IT is not all negative." Despite its concerns, shadow IT provides the following benefits:

• Increased Productivity: For many workers, IT approval impedes productivity, particularly when they can have their solution up and operating in only minutes. Rapid access to necessary resources boosts productivity and encourages innovation.

• Better User Experience: A favorable user experience via administrative and bureaucratic simplification. Improving employee happiness and retention by empowering end users to choose the tools they use. Allowing workers to provide feedback on new software improves acceptance as well. Thus, shadow IT may aid in the retention of outstanding people.

• Less Time for Employee Training: In addition to finding speedier innovations, when a corporation utilizes shadow IT, the process of implementing new technology may be significantly accelerated. Each employee educates themselves on how to utilize new technologies, as opposed to the primary information technology staff spending days designing and polishing training materials and then conducting training sessions. This dramatically accelerates the adoption of new technologies. If many workers encounter a similar problem during self-education, the IT staff can assist them to overcome it. This often involves far less time than a company-wide training project.

• Reduced IT Costs for the Employer: When effectively deployed, shadow IT may help an organization make substantial improvements to its IT budget. Each contact between a member of the IT team and an employee requires time and, thus, costs money.

  Each employee receives assistance installing, administering, and troubleshooting their devices and apps in a typical IT environment. With shadow IT, employees can handle most of it on their own, which may eliminate the need for IT professional assistance. This might free up cash allocated for IT employee wages, enabling them to be spent elsewhere inside the organization.

• Superior Technology: Businesses must stay up with the rapidly evolving, constantly growing array of technologies that are advantageous to the contemporary industry. A benefit of a shadow IT system is the availability of new, more efficient technology that a company would have otherwise overlooked. When a firm adopts a shadow IT strategy, each team member is entrusted with the responsibility of exploring creative methods to do their duties more effectively and efficiently.

• Lower Initial Cost During Onboarding: With shadow IT in place, you may spend fewer resources in the onboarding process since new workers can manage a significant portion of their own IT. During onboarding, the IT staff often educates new workers on a variety of security practices. This may be necessary for numerous devices using several platforms. Training requires time away from the IT staff, so tying up vital human resources.

What is a Shadow IT Policy?

A shadow IT policy assists a company in establishing standards for the adoption, approval, and administration of new hardware and software. These policies are established by IT departments, which may modify them in response to changing security threats and business requirements.

Shadow IT rules are one of the procedures required for regulating and managing systems and services inside a company while preventing the entrance of unauthorized technologies.

Creating a shadow IT strategy allows firms to function more effectively, limit risk, and save expenses. There are three main phases to developing a shadow IT policy.

• Agree on a level of risk: The first stage in establishing a functioning shadow IT policy is to identify how stringent the company will be regarding shadow IT. Everyone has a different level of comfort with danger. No matter what a corporation chooses, the policy finally has to be generally adopted.

  To achieve that, IT and business stakeholders must meet to speak about risks and advantages and reach a compromise. Is the corporation trending towards a more authoritarian or tolerant stance? Accommodating the demands of many departments is important to designing a well-adopted policy.

• Establish an IT procurement process: Developing the procedure behind proposing and adopting shadow IT systems or initiatives is likewise a collective endeavor.

  If shadow IT is acceptable, part of the process may include encouraging business users to develop a case for why the new technology is important for workers to thrive in their position and why present IT solutions do not meet their requirements. Once a new technology is authorized, IT might engage with the company to negotiate acceptable levels of access, service level agreements, and maintenance requirements.

  If shadow IT is not acceptable for the organization as a whole, the IT department must establish a method for business users to seek a new system or service from their department. Whatever the organization selects, the IT Procurement Process should be clearly articulated and communicated across the business.

• Educate users: Employees must feel heard and understood if any shadow IT policy is going to be supported. Opening up the interaction between IT and the company helps both sides to learn from one another.

  It may be difficult for people to comprehend how much risk "shadow IT" poses. When adopting the shadow IT policy, IT might have an opportunity to explain why particular technologies can be challenging to integrate with existing corporate systems or maintain safe. Giving the workforce actual examples of what is on and off-limits is vital to policy acceptance.

How To Perform A Shadow IT Audit?

You could utilize IT tools to conduct an audit, but most of the information you would get would pertain to activity on your organization's web proxy and a firewall.

If you want to know what is occurring on your workers' end-point devices that are outside of your firewall, you will need to build a mobile device management (MDM) system that will inform you of what users are doing on their equipment.

This may be accomplished by assigning agents to each device and having those agents report back information. Large businesses often have the financial and technological means to make this a reality. However, this would not be worth your time or money for a tiny firm.

Therefore, you must consider the following auditing approaches for shadow IT:

• Monitor help desk requests: Monitoring the inquiries submitted to your help desk or IT department might assist you to establish whether or not workers are inquiring about unauthorized apps or connections. Usability concerns are widespread among users of unknown or unapproved programs, so it is often worthwhile to examine them in further detail.

• Review the facts you already possess: You already own a portion of the information you want on the programs your workers are using. Consider what individuals are claiming on their expense reports. This will tell you what your organization is paying for, which can provide you with crucial information about how much you're spending on unauthorized applications.

• Inquire what users are utilizing: Another simple suggestion is to just inquire as to what staff is utilizing and why. This might be done in person or through surveys or questionnaires. Keep in mind that you want to come across as helpful, not invasive, or closed-minded; you don't want them to believe you're going to stifle their entrepreneurialism. If you are going to conduct a question-based shadow IT audit, attempt to formulate as many positive questions as possible.

  • What apps do you continue to use after the trial period?
  • What apps do you find most helpful on your devices?
  • What apps facilitate your work performance?

These three stages will help you discover what applications your workers are using and why, enabling you to establish a policy-driven rule set and implement the appropriate solutions for your organization.

What are Shadow IT Tools?

Shadow IT may threaten a company's security if we allow it. However, there are various methods to preserve firm data while allowing individuals access to technologies that increase their productivity and morale.

Balancing risks and advantages is crucial to building a successful shadow IT strategy. Leveraging shadow IT to reveal new procedures and technologies that might empower all workers to flourish in their professions is plain sensible business practice. Cloud-based solutions with the possibility of interacting with numerous systems provide contemporary enterprises with a solution that may gratify both IT and the business.

Some shadow IT tools are given below:

• CrowdStrike Falcon Horizon: CrowdStrike Falcon Horizon is a cloud security posture management (CSPM) instrument that identifies and avoids misconfigurations and controls plane threats, removes blind spots, and assures compliance across all cloud platforms, such as Azure, AWS, and Google Cloud.

  Falcon Horizon provides total insight into your multi-cloud environment through a single truth source for cloud resources.

• Talend Data Fabric: Talend Data Fabric is a cloud-native, unified suite of applications with the potential to enable self-service access to the correct data to make outstanding business choices in real-time. Talend Data Fabric offers 900+ components to make integrations simple and can handle reliable data across any form of environment. It is adaptable enough to aid with data management, data preparation, and cloud integration.

• KMicro: KMicro provides a variety of cybersecurity solutions to assist organizations to achieve visibility and control over their shadow IT. They assist organizations in identifying the apps their staff are utilizing without their awareness, in consolidating their cloud services, and in bringing everyone back on the same page.

• SpinOne: SpinOne is an API-based Cloud Access Security Broker that interfaces with Office 365 and G Suite. This enables organizations to extend their on-premises shadow IT policies into the cloud. This includes insight into how corporate data is shared, accessed, and which third-party apps are permitted to interact with corporate data.

• SecurityScorecard: The SecurityScorecard security rating platform gives easy-to-read A-to-F grades that provide instant insight into your security posture. SecurityScorecard Sentinel, discovers and identifies all devices on your network, including IoT devices. You can improve your security and compliance posture if you can identify and manage these previously difficult-to-manage IT threats. The SecurityScorecard security rating platform delivers notifications that assist IT and security teams in prioritizing remedial efforts to mature the security program. Its warnings also provide remedial actions so that your teams may eliminate risk more quickly.

Which Technologies Reduce Shadow IT Risks?

When shadow IT is linked with the appropriate technologies, a business gains network visibility and control. You should utilize the following technologies to enhance your cybersecurity against shadow IT risk.

• Next-Generation Firewalls (NGFWs): NGFWs provide a far more powerful defense. Standard firewalls are only capable of identifying protocols, ports, and IP addresses. NGFWs provide the ability to monitor workers' application use in real-time. Additionally, you may see how patterns evolve and produce reports to assist the IT staff and higher management in enhancing performance.

• Cloud Access Security Broker (CASB): Open access to cloud-based systems without sufficient visibility and control may result in security breaches and uneven data management. A CASB enables you to monitor who is doing what and to implement safeguards for every cloud activity. This consists of the capacity to:

  • Control access privileges for users
  • Keep tabs on cloud-based data
  • Risk monitoring your system
  • Permit only authorized apps in your cloud system

• Network Access Control (NAC): The practice of preventing unapproved people and devices from connecting to a corporate or private network is referred to as network access control, which is frequently abbreviated as NAC. Another name for this procedure is network admission control. Through the use of NAC, the network is protected by ensuring that only users who have been authenticated and devices that have been permitted and are compatible with security regulations may access it.

• Analytics and Automation Software: Tools for analytics offer comprehensive security fabric analytics, providing visibility into network security related behavior. For instance, if a new employee engages in shadow IT, these technologies may detect and report the conduct. The IT staff may then determine if the activity can be supported and how. In addition, if an instance of shadow IT poses a danger, the system will make it easy to analyze the system's vulnerability. This information might be useful as the IT staff strives to ensure that all employee IT activity is within permissible parameters.

• Application Control: With technologies like an application control service, you may remove a number of the hazards associated with shadow IT, improve security, and ensure that users adhere to acceptable usage regulations. This enables you to define rules dictating who may access certain apps or groups of apps.

  These services also enable you to remove harmful or troublesome programs that might harm your network or jeopardize its security. To enhance their efficacy, control points might be located at the network perimeter, inside the network, or in the data center.

How Does Zenarmor Help To Reduce Shadow IT Risks?

Zenarmor NGFW offers a suite of robust features specifically designed to effectively mitigate the risks associated with shadow IT. By leveraging functionalities such as Advanced Reporting, Application Control, Device Identification, Device Access Control, Application Control, and User-based Filtering and Reporting, organizations can implement comprehensive strategies to enhance their security posture. We will briefly explain Zenarmor capabilities that are helpful to prevent Shadow IT risk below:

• Device Identification and Access Control: Zenarmor empowers network administrators with the ability to intricately link network activities to individual users and devices. This granular control allows for the detection and filtration of devices based on parameters such as MAC address, IP, VLAN, or network. Zenarmor continuously scans network traffic and detects devices connected to your network. In addition to categorizing devices based on their types, such as mobile, IoT, desktop, and servers, etc., you can classify them as trusted and untrusted according to their confidence level. You can easily prevent unauthorized devices from using your internet resources without your acknowledgement. With this level of precision, organizations can enforce stringent shadow IT policies, preventing unauthorized devices from accessing sensitive resources and establishing a robust defense against potential security breaches.
• Application Control: The Application Control features in Zenarmor provide organizations with a powerful tool to manage and regulate the applications operating on their network. This proactive approach aids in preventing the use of unauthorized applications, a common hallmark of shadow IT. Through the blocking or limitation of specific applications, organizations can ensure that only approved tools are utilized, thereby significantly reducing the risk of security breaches and compliance issues.
• Advanced Reporting: Zenarmor's advanced reporting capabilities empower organizations to monitor and analyze network activities comprehensively. This proactive stance enables the identification of patterns and trends indicative of shadow IT activities. Armed with this insight, administrators can take preemptive measures to address potential risks, ensuring a more resilient and secure network environment.
• User-based Filtering and Reporting: Zenarmor facilitates organizations in filtering and reporting on network activities based on individual users. This level of granularity proves instrumental in identifying users engaged in shadow IT activities. Armed with this information, organizations can take swift and appropriate action to address the issue, ensuring a proactive approach to security management.

The various features of Zenarmor allow organizations to systematically decrease shadow IT risks through the implementation of accurate security policies, the control of unauthorized applications, and the vigilant monitoring of network activity.

What are the Best Practices for Shadow IT?

Some examples of shadow IT are unavoidable, even in the most modern businesses. To successfully identify and handle these occurrences, firms must develop methods for identifying them. The following actions may be taken by businesses to mitigate the shadow IT risks:

• Implement Detection of Shadow IT: Using a shadow IT discovery tool may assist IT departments in discovering, tracking, and analyzing all of the allowed and unapproved systems and services that workers are presently using. IT teams may then set rules to permit, limit, or prohibit the use of these technologies as required.

• Tighten Security: Some firms block off access to specific programs using the corporate firewall or software audits. There are various solutions on the market that may help IT departments uncover and stop shadow IT. These technologies monitor the usage of cloud services throughout a company, giving IT teams the name of cloud services that workers are utilizing and reporting on possible security threats. Some technologies can even inhibit shadow IT.

• Utilize a Cloud Access Security Broker (CASB): A CASB protects cloud-hosted applications and services with bundled security technologies, such as shadow IT detection, data loss prevention (DLP), access control, and browser isolation.

• Assess Risks: Not every shadow IT technology or device poses the same risk to company security. By routinely reviewing Shadow IT resources in the workplace, businesses may get a better understanding of the dangers they face and take the necessary steps to minimize or eradicate them.

• Improve Staff Training in Risk Management: Employees may be unaware of the potential security dangers posed by shadow IT. Training users on acceptable practices, such as avoiding using personal email to access business resources, declaring the use of unauthorized hardware and software, and reporting data breaches, may reduce the probability of data loss or theft.

• Improve IT Governance: The governance framework should let the IT department swiftly evaluate and deploy new solutions to fulfill user needs and foster increased creativity without compromising security. By encouraging business users to develop a business case for a new tool, the IT team may get more insight into the tool's needs and evaluate its potential security risk. If they accept the new tool, they may then collaborate with users to set access limits, best practices for using it securely, etc.

• Communicate with Staff: Employees often know which technologies work best for their jobs, but they may not feel comfortable requesting formal IT permission owing to budgetary limits or other considerations. These dialogues and the implementation of a "no-blame" culture (for those who may have previously implemented shadow IT) may lead to a more open and secure workplace.

• Consider Compromise: Create an easy submission procedure for workers. Employees may either seek a particular capability or answer security questions and establish a case for a tool they have been using. This method provides workers a voice and helps IT make a faster conclusion regarding the feasibility of a product.

  Publish a list of IT-vetted tools each year. Employees will still have a choice as to whatever software they wish to use, but will be constrained to solutions that already meet IT's security standards.

• Practice Leniency: When users pick the apps they want, they are more engaged in IT and their careers. Using technologies they are comfortable with helps individuals be more productive, efficient, and joyful at work. A permissive shadow IT policy also enables the IT staff to focus on other activities.

  None of this addresses the possible security hazards of shadow IT usage. A corporation with a flexible position on shadow IT may strengthen security in other ways with greater data encryption and more restricted access to sensitive data, for example.

  These firms may offer rules and recommendations to assist workers to utilize their technologies safely. Employees may download and use their software, for example, but they must not utilize it to share or keep customer data, use the same business password, etc.

Figure 1. Best Practices for Shadow IT