{"id":46324,"date":"2023-12-27T06:28:38","date_gmt":"2023-12-27T03:28:38","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=46324"},"modified":"2026-03-28T04:50:47","modified_gmt":"2026-03-28T01:50:47","slug":"in-the-shadows-the-risks-unauthorized-it-products-pose-to-business","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/in-the-shadows-the-risks-unauthorized-it-products-pose-to-business\/","title":{"rendered":"In the shadows: the risks unauthorized IT products pose to business"},"content":{"rendered":"\n

26 December 2023<\/p>\n\n\n\n

Companies are at an increased risk of becoming targets of cyber incidents due to the use of shadow IT by their employees amid the growing trend towards a distributed workforce<\/strong>, a recent study has found<\/strong>. According to research by Kaspersky, 78% of companies in the Middle East, T\u00fcrkiye and Africa suffered cyber incidents in the last two years, and 10% of these were caused by the use of shadow IT.<\/strong><\/p>\n\n\n\n

A recent Kaspersky study<\/a>[1]<\/sup><\/a> showed that, in the last two years, 11% of companies worldwide have suffered cyber incidents due to the use of shadow IT by employees. The consequences of the use of shadow IT can be diverse in their severity, but they are never insignificant, whether it\u2019s the leak of a piece of confidential data or tangible damage to business. <\/p>\n\n\n\n

So, what is shadow IT? <\/strong><\/h2>\n\n\n\n

Shadow IT is the part of the company\u2019s IT infrastructure that is outside the purview of the IT and Information Security departments, i.e. applications, devices, public cloud services etc. but that is not being used in accordance with information security policies. Deployment and operating shadow IT can lead to serious negative outcomes for businesses. Many instances were found in the Kaspersky study, which revealed that the IT industry \u2013 had been the hardest hit, suffering 16% of cyber incidents due to the unauthorized use of shadow IT in 2022 and 2023. Other sectors hit by the problem were critical infrastructure and transport & logistics organizations, which saw 13%. <\/a><\/p>\n\n\n\n

Recent case of Okta<\/a> clearly proves the dangers of using shadow IT. This year, an employee using a personal Google account on a company-owned device unintentionally allowed threat actors to gain unauthorized access to Okta\u2019s customer support system. There they were able to hijack files containing session tokens that could then be used to conduct attacks. This cyber incident lasted for 20 days and impacted 134 company\u2019s customers according to Okta\u2019s report<\/a>.<\/p>\n\n\n\n

Outlining \u2018blurry shadows\u2019<\/strong><\/h2>\n\n\n\n

So, when you are looking for shadow IT, what to look for? These can be either unauthorized applications installed on employee computers, or unsolicited flash drives, mobile phones, laptops, etc.<\/p>\n\n\n\n

But there are also some options that are less conspicuous. One example of this is abandoned hardware left over after the modernization or reorganization of the IT infrastructure. It can be used \u2018in the shadows\u2019 by other employees, acquiring vulnerabilities that will sooner or later find their way into the company\u2019s infrastructure.<\/p>\n\n\n\n

Regarding IT specialists and programmers, as it often occurs, they can create a tailored programs themselves to optimize work within a team\/department, or to solve internal problems, making work faster and more efficient. However, they don\u2019t always ask to the Information Security department for authorization to use these programs, and this could have disastrous consequences. <\/p>\n\n\n\n

\u201cEmployees who use applications, devices or cloud services that are not approved by the IT-department, believe that if those IT-products come from trusted providers, they should be protected and safe. However, in the \u2018terms and conditions\u2019 third-party providers use the so-called ‘shared responsibility model’. It states that, by choosing ‘I agree’ users confirm that they will perform regular updates of this software and that they take responsibility for incidents related to the use of this software (including corporate data leakages). But at the end of the day business needs tools to control the shadow IT when it\u2019s used by employees. Kaspersky Endpoint Security for Business and Kaspersky Endpoint Security Cloud, offer this control with Application, Web and Device control functions that limit the use of unsolicited apps, websites and peripherals. The Information Security department will of course still need to conduct regular scans of their company\u2019s internal network to avoid the unauthorized use of uncontrolled and unsafe hardware, services and software applications.\u201d<\/em> comments Alexey Vovk, Head of Information Security at Kaspersky.<\/p>\n\n\n\n

In general, the situation with the widespread usage of shadow IT is complicated by the fact that many organizations do not have any documented sanctions where their employees will suffer as a consequence of going against IT policies in this matter. Moreover, it is assumed<\/a> that shadow IT could become one of the top threats to corporate cybersecurity by 2025. The good news is that the motivation for employees to use shadow IT is not always malicious, even more often, it\u2019s the opposite. Employees in many cases use this as an option to expand the functionality of the products they use at work because they believe that the set of allowed software is insufficient, or they simply prefer the familiar program from their personal computer. <\/p>\n\n\n\n

To mitigate the risks of using shadow IT in an organization, Kaspersky recommends:<\/strong><\/h2>\n\n\n\n