A recent study revealed that security professionals face a new kind of shadow IT due to the widespread migration of custom apps to the cloud.
In December 2016 and January 2017, the Cloud Security Alliance and Skyhigh Networks polled 314 qualified IT personnel for the new report, “Custom Applications and IaaS Trends 2017.” The results suggested that infrastructure-as-a-service (IaaS) initiatives may be the driving force behind shadow IT.
Researchers also made the bold prediction that 2017 will be a tipping point, with less than half of the enterprise workload located in a data center by the end of the year. Cloud migration is inevitable.
Clouded Judgment
This transition introduces a new kind of shadow IT, the report noted. Traditionally, the shadow IT problem arises when employees use apps without the IT department’s approval.
But a new flavor involves employees — even IT staffers — moving custom apps to the cloud without informing the security team. When this happens, security teams have an incomplete view of the data they must protect since they don’t even know what’s in the cloud.
According to the report, the average enterprise deploys 464 custom applications, and security professionals are aware of just 38.4 percent of them. That’s a huge number of apps or use cases that security stakeholders don’t know about.
“Rather than security being a barrier to development, it appears development is occurring without involvement from security,” the researchers wrote of the current cloud migration process.
Shedding Light on Shadow IT
An enterprise’s apps need to be protected in a public cloud. SecurityWeek noted that the need is acute, since almost 73 percent of study respondents reported having at least one business-critical application. Furthermore, 46 percent of these business-critical applications are either completely deployed in the public cloud or in a hybrid cloud.
The report revealed that IT security professionals are hobbled with severely limited visibility as to the deployment and operations of these cloud apps. Additionally, 66.5 percent of respondents ranked the potential of an unprotected cloud app to exfiltrate data as a top concern.
So far, cloud security has required a collaborative effort between enterprises and vendors. This trend will continue for the foreseeable future. If all parties are not involved in developmental projects, security will be an elusive goal no matter where data is stored.
Principal, PBC Enterprises
Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE mag...