Allow is the new Block - 10 requirements to safely say "yes" to shadow it

Cloud adoption in the enterprise continues to gain momentum with more than 1,000 cloud services used by employees in a variety of environments from retail to healthcare and everything in between. It turns out that fewer than 5% of these cloud services are sanctioned with IT having administrative access and the ability to manage or secure the deployment. Sanctioned cloud services often include suites like Office 365 and Google G Suite and apps like Salesforce, Box, ServiceNow, and dozens of others. While sanctioned cloud services often garner most of the enterprise focus, more than 95% of cloud services used by enterprises are unsanctioned, shadow IT services and are either shepherded in by lines of business or brought in by individual users that sign up for them because they are easy to access and use. Unsanctioned cloud services often fly under the radar of IT and security personnel. Many of these unsanctioned services are IaaS (think Amazon Web Services, Microsoft Azure, and Google Cloud Platform) solutions being used by DevOps teams building apps that access critical systems and contain sensitive resources to support the business. When misconfigured, IaaS resources like S3 buckets in AWS may expose sensitive data out in the open, leaving it easy for malicious actors to take advantage of the data or introduce threats.

Given the lack of visibility and control, what does the security team do about shadow IT? Do they take extreme security measures and try to block them using legacy security tools or do they allow their use and hope users stay secure from threats and don’t leak sensitive data? This is a difficult decision and presents a catch-22 between extracting value from the cloud and being secure. Let’s take a look at the potential impact resulting from an allow or block decision only versus a layered approach of multiple security policies and rules.