Shadow IT - Unkontrollierte IT außerhalb der IT-Governance

Shadow IT isn’t malicious—it’s a symptom of IT that fails to meet users’ needs. If the ticketing system takes two weeks to approve an app, employees will solve the problem themselves. The result: uncontrolled data flows, data breaches, and security vulnerabilities that no one is aware of.

Scope and Types of Shadow IT

Real-World Statistics (Gartner 2024)

• 41% of all corporate IT spending goes to shadow IT
• Companies are aware of only 49% of the cloud apps actually in use
• CIOs underestimate the actual number of apps by a factor of 30–40

Most Common Shadow IT Categories

Communication:

• WhatsApp/Telegram for customer communication (GDPR issue!)
• Personal Gmail for project work (“Company Outlook is too cumbersome”)
• Consumer Zoom instead of an enterprise license

Data storage:

• Dropbox, Google Drive, iCloud: Company data on personal accounts
• USB drives: "I’ll just take the file home for a bit"
• Photos of screens taken with personal phones (meeting presentations!)

Productivity:

• Trello, Notion, Airtable without IT approval
• ChatGPT/Claude for contract drafting, code review (!)
• Canva, Adobe Express for marketing materials

Technical:

• Developers use npm packages without security review
• AWS/Azure accounts on the developer’s credit card
• Chrome extensions with data access (Grammarly reads emails!)
• Public GitHub repositories containing internal code

Devices:

• Personal smartphones used for business purposes (no MDM)
• Smart home devices connected to the office network (Alexa is listening!)
• Personal computer for home office (no EDR, unencrypted)

Risks of Shadow IT

1. Data Protection/GDPR

Scenario: Sales team uses personal Dropbox for customer list

• Personal data outside the controlled environment
• No data processing agreement with Dropbox Consumer (mandatory under Art. 28!)
• Data breach: GDPR notification, 4% of revenue fine
• No deletion policy: Data remains on private account forever

2. Data loss

Scenario: Developer deletes private AWS account containing company data

• No IT oversight → no backup
• No cost control → unexpected cloud bill

3. Security vulnerabilities

Scenario: Marketing uses an untested webinar tool

• Tool has a vulnerability (RCE)
• Attacker uses tool as an entry point into the company network

4. ChatGPT risks (currently very relevant)

Scenario: Employee pastes customer contract into ChatGPT for a summary

• Data may be used for OpenAI training
• Contract contains PII + trade secrets
• De facto disclosure to third parties without legal basis
• Samsung case 2023: Internal source code entered into ChatGPT → became public!

5. Compliance violations

• ISO 27001: Uncontrolled assets result in loss of certification
• NIS2: Security measures that do not cover IT-controlled systems
• Industry compliance: HIPAA, PCI DSS, TISAX require control

Detecting Shadow IT

1. Cloud Access Security Broker (CASB)

• Web traffic analysis: Which cloud apps are being used?
• Microsoft Defender for Cloud Apps (M365): ready to use
• Shows: "1,247 different cloud apps in use" (typical!)
• Risk score per app: Dropbox Consumer = HIGH RISK

2. DNS Analysis

• Analyze DNS logs: Which domains are being accessed?
• Categorization: "File Sharing," "AI Services," "Consumer Social"
• Tools: Zeek + ELK, Pi-hole for visibility

3. Firewall Logs

• Analyze outbound connections
• Suspicious: many uploads to file-sharing services (exfiltration?)

4. Endpoint Analysis

• Intune/SCCM: inventory installed software
• Browser extensions in corporate browsers
• Local shares: files being shared externally

5. Employee Survey

• Honest questions: "What tools do you use that IT doesn’t know about?"
• Anonymous survey: more honest answers
• No penalties! Otherwise, no honest answers

6. Financial Data

• Credit card statements: SaaS subscriptions?
• IT budget vs. actual cloud spending
• AWS Organizations: all AWS accounts under one roof

Manage Shadow IT (don’t eliminate it!)

Wrong Response (common)

> "Block all unauthorized apps immediately!"

Result:

• Employees bypass the block (VPN, personal cell phone)
• Loss of productivity
• IT perceived as the enemy
• Shadow IT goes even further underground

Correct response

1. Understand: Why are employees using these tools?

• What need is not being met by official IT?
• Often: too cumbersome, too slow, too outdated

2. Risk Assessment:

• Which shadow IT is critical (customer data)? → Address immediately
• Which poses an acceptable risk (personal note-taking app)? → Tolerate

3. Sanction vs. Legalize:

• Frequently used tool → Purchase the enterprise version!
• "Employees use Dropbox → IT purchases OneDrive for Business"
• Communicate: "Here is the official, secure alternative"

4. CASB Policies:

• Block high-risk apps: Consumer cloud storage for uploads
• Allow and monitor medium-risk apps: Kanban tools
• Low-risk: allow

5. AI Policy (currently critical!):

• Deploy enterprise ChatGPT (Azure OpenAI, Claude Enterprise)
• Communicate clearly: no company data in consumer AI tools
• Technical control: DLP rule "Credit card number / Contract keywords" → Block uploads to ChatGPT/consumer AI

Cultural: IT as an enabler, not an obstacle

• IT department: "You have a problem; we’ll help you solve it securely"
• Not: "You’re not allowed to do that"
• App request process: max. 5 business days, clear criteria