NewsFebruary 16, 2017 @ 11:45 AM

Shadow IT Clouds Security

A recent study revealed that security professionals face a new kind of shadow IT due to the widespread migration of custom apps to the cloud.

In December 2016 and January 2017, the Cloud Security Alliance and Skyhigh Networks polled 314 qualified IT personnel for the new report, “Custom Applications and IaaS Trends 2017.” The results suggested that infrastructure-as-a-service (IaaS) initiatives may be the driving force behind shadow IT.

Researchers also made the bold prediction that 2017 will be a tipping point, with less than half of the enterprise workload located in a data center by the end of the year. Cloud migration is inevitable.

Clouded Judgment

This transition introduces a new kind of shadow IT, the report noted. Traditionally, the shadow IT problem arises when employees use apps without the IT department’s approval.

But a new flavor involves employees — even IT staffers — moving custom apps to the cloud without informing the security team. When this happens, security teams have an incomplete view of the data they must protect since they don’t even know what’s in the cloud.

According to the report, the average enterprise deploys 464 custom applications, and security professionals are aware of just 38.4 percent of them. That’s a huge number of apps or use cases that security stakeholders don’t know about.

“Rather than security being a barrier to development, it appears development is occurring without involvement from security,” the researchers wrote of the current cloud migration process.

Shedding Light on Shadow IT

An enterprise’s apps need to be protected in a public cloud. SecurityWeek noted that the need is acute, since almost 73 percent of study respondents reported having at least one business-critical application. Furthermore, 46 percent of these business-critical applications are either completely deployed in the public cloud or in a hybrid cloud.

The report revealed that IT security professionals are hobbled with severely limited visibility as to the deployment and operations of these cloud apps. Additionally, 66.5 percent of respondents ranked the potential of an unprotected cloud app to exfiltrate data as a top concern.

So far, cloud security has required a collaborative effort between enterprises and vendors. This trend will continue for the foreseeable future. If all parties are not involved in developmental projects, security will be an elusive goal no matter where data is stored.

Share this Article:
Larry Loeb

Principal, PBC Enterprises

Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek. He wrote for IBM's DeveloperWorks site for seven years and has written a book on the Secure Electronic Transaction Internet protocol. His latest book has the commercially obligatory title of Hack Proofing XML. He's been online since uucp "bang" addressing (where the world existed relative to !decvax), serving as editor of the Macintosh Exchange on BIX and the VARBusiness Exchange.