Shadow IT, the practice of using applications and systems without the explicit approval or knowledge of IT staff, is a growing challenge in higher education. The pandemic has accelerated cloud adoption not only at the enterprise level but also at the user level, increasing the likelihood that shadow IT will proliferate.

The Everest Group reported in 2019 that the cost of dismantling shadow IT accounted for 50 percent or more of IT spending in large enterprises. And shadow IT is as much a problem in higher education as in other industries — perhaps even more so, given the diversity of higher education user groups and its relatively open IT environment.

Shadow IT Can Be a Slippery Slope

Shadow IT grows because of a lack of awareness, both on the part of users and the IT department. A wide variety of tools are brought into institutions under the radar, without explicit IT approval or knowledge.

A user needs something to get the job done and, without thinking, signs up for a web-based application: Need online messaging? Why not the same WhatsApp you use for your personal life? Want to do a VoIP or videoconference call? If you don’t love the videoconference solution your institution offers, why not just use the free version of Zoom you use at home? Need to transmit large files? It’s easy to sign up for a Dropbox account, particularly when you’re trying to get the job done remotely.

But in none of these scenarios is any thought given to control, management or security. Self-reliance is often a virtue, but not when it puts the university at risk.

The IT department may be blind to the issue, with no clue about how many unauthorized apps are being used, particularly when those applications are connecting from a home office.

It’s often unclear what security protections the applications are using, and frequent reuse of login credentials, weak passwords and phishing attacks leave user accounts on unauthorized services vulnerable.

With shadow IT, there is also the problem of application confusion and oversaturation. It’s messy when people are deciding for themselves which messaging application or file-sharing service to use.

How to Protect Against Unauthorized Access

Unauthorized software may not meet the security standards required by the institution. There are several categories of risk that need to be considered:

• Data protection issues: Where is the data being stored? How is it protected? Can the user upload sensitive data to the cloud, where it could be leaked? Is data encrypted? Who controls the encryption keys? Can the user download files that contain malware and spread them to other members of the team?
• Compliance: The university’s compliance efforts may be squandered if the actual state of software is unknown. Will use of the service put the institution in conflict with industry regulations or even laws?
• Software asset management: Licenses procured without IT knowledge expose the institution to risk, potentially with severe sanctions. How do unknown applications and data relationships affect the carefully populated configuration management database?

How to Develop Proactive Prevention

Fortunately, the sea of shadow IT is not as murky as it may seem. The best approach involves five steps:

1. Establish a baseline of acceptable applications. Recognize there are probably many instances of shadow IT in your institution, most of which use well-known tools such as mail, messaging, conferencing and large file transfer services. Focus on the most popular ones and determine if you can sanction a subset of them.
2. Clarify the policy. Establish a clear policy on which devices, systems and software your faculty, staff and students can use. Communicate that policy to all users — not just once, but often. Remember that consistent user education strengthens your first line of defense.
3. Gain visibility. Detect and catalog all software running in the organization by using a software asset management solution, such as an asset management suite. This can integrate compliance, license entitlement, discovery and more in one interface.
4. Triage unacceptable risk. Conduct a detailed analysis of the risks associated with unauthorized applications. A cloud access security broker, such as McAfee MVISION, ensures real-time data protection. For tighter control with virtual desktop infrastructure tools such as Citrix XenDesktop, let IT control a secure desktop image with only sanctioned applications.
5. Create a long-term plan to fill functionality gaps. Run strategic analysis of usage patterns. Recognize that the institution needs a full range of tools and services to function properly.

Students, faculty and staff are constantly trying to work as efficiently as possible, particularly when they are doing so away from campus. It’s up to IT to provide them with secure solutions that make this easier.

Shadow IT is a problem, but it serves one good purpose: It provides a view of what capabilities users really need, while software asset management, virtual desktop infrastructure and cloud access security brokers can help IT exercise control and governance over the entire landscape of applications. As always, user education plays a key role.