Shadow IT, the practice of using applications and systems without the explicit approval or knowledge of IT staff, is a growing challenge in higher education. The pandemic has accelerated cloud adoption not only at the enterprise level but also at the user level, increasing the likelihood that shadow IT will proliferate.
The Everest Group reported in 2019 that the cost of dismantling shadow IT accounted for 50 percent or more of IT spending in large enterprises. And shadow IT is as much a problem in higher education as in other industries — perhaps even more so, given the diversity of higher education user groups and its relatively open IT environment.
Shadow IT grows because of a lack of awareness, both on the part of users and the IT department. A wide variety of tools are brought into institutions under the radar, without explicit IT approval or knowledge.
A user needs something to get the job done and, without thinking, signs up for a web-based application: Need online messaging? Why not the same WhatsApp you use for your personal life? Want to do a VoIP or videoconference call? If you don’t love the videoconference solution your institution offers, why not just use the free version of Zoom you use at home? Need to transmit large files? It’s easy to sign up for a Dropbox account, particularly when you’re trying to get the job done remotely.
But in none of these scenarios is any thought given to control, management or security. Self-reliance is often a virtue, but not when it puts the university at risk.
The IT department may be blind to the issue, with no clue about how many unauthorized apps are being used, particularly when those applications are connecting from a home office.
It’s often unclear what security protections the applications are using, and frequent reuse of login credentials, weak passwords and phishing attacks leave user accounts on unauthorized services vulnerable.
With shadow IT, there is also the problem of application confusion and oversaturation. It’s messy when people are deciding for themselves which messaging application or file-sharing service to use.
Unauthorized software may not meet the security standards required by the institution. There are several categories of risk that need to be considered:
Fortunately, the sea of shadow IT is not as murky as it may seem. The best approach involves five steps:
Students, faculty and staff are constantly trying to work as efficiently as possible, particularly when they are doing so away from campus. It’s up to IT to provide them with secure solutions that make this easier.
Shadow IT is a problem, but it serves one good purpose: It provides a view of what capabilities users really need, while software asset management, virtual desktop infrastructure and cloud access security brokers can help IT exercise control and governance over the entire landscape of applications. As always, user education plays a key role.
It’s chock full of useful advice, exclusive events and interesting articles. Don’t miss out!