https://www.sikich.com

The Threat of Shadow IT to Data Security in Microsoft 365

Sikich

Nov 30 2023

3 min read

The rise of shadow IT, where employees use unauthorized apps and tools outside of officially sanctioned IT systems, can introduce significant risks to data security in Microsoft 365 environments. While Microsoft 365 provides robust data protection capabilities, these can be undermined if proper governance is not in place. Some of the key data security risks introduced by shadow IT include the following as listed below.

Data Leakage

With shadow IT, data is often moving outside of the control of IT and security teams. Sensitive documents and information may be shared through unapproved apps, increasing the risk of data leakage. For example, an employee may upload a sensitive client report to a consumer-grade file sharing service that lacks adequate access controls and auditing. Unauthorized external sharing and accidental public exposure of files are common data leakage paths with shadow IT.

Unauthorized Access

Shadow IT apps allow employees to bypass authentication and authorization mechanisms put in place by IT, such as single sign-on through Entra ID. Consumer-grade apps often have minimal identity management capabilities. This increases the risk of accounts being compromised, hacked, or illicitly accessed by unauthorized internal or external parties. Lack of visibility into external sharing also heightens the unauthorized access risk.

Compliance and Data Residency Violations

Many shadow IT apps used for file sharing, messaging, and collaboration are cloud-based. Storing organizational data within third-party, consumer-grade apps can result in non-compliance with industry regulations related to data security, privacy, and residency. For example, HIPAA-regulated healthcare data may be impermissibly processed and stored outside of the United States.

Increased Attack Surface

Consumer-grade apps often lack enterprise-grade security, providing hackers with more potential entry points into an organization’s IT environment. Connecting unauthorized apps to Microsoft 365 through over-broad API permissions expands the attack surface further. Malware infections, phishing attacks, and account takeovers are all enhanced risks.

Lack of Auditing and Controls

The lack of visibility and auditing make it extremely difficult for IT and security teams to implement appropriate data security controls and policies around shadow IT usage. Unauthorized apps will not integrate with data loss prevention, rights management, and other Microsoft 365 security tools. Forensic investigations are also hindered by fragmented auditing.

To reduce shadow IT security risks, organizations should aim for data security through governance: restricting access, continuously auditing, and monitoring usage, providing approved apps, enforcing multifactor authentication, and educating employees. With a balanced approach, the business benefits of SaaS innovation can be safely harnessed.

Have any questions about avoiding shadow IT and preventing associated data security risks? Please reach out to our experts at any time!

This publication contains general information only and Sikich is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or any other professional advice or services. This publication is not a substitute for such professional advice or services, nor should you use it as a basis for any decision, action or omission that may affect you or your business. Before making any decision, taking any action or omitting an action that may affect you or your business, you should consult a qualified professional advisor. In addition, this publication may contain certain content generated by an artificial intelligence (AI) language model. You acknowledge that Sikich shall not be responsible for any loss sustained by you or any person who relies on this publication.

About the Author

Sikich

Sikich is a global company specializing in technology-enabled professional services. With more than 1,900 employees, Sikich draws on a diverse portfolio of technology solutions to deliver transformative digital strategies and is comprised of one of the largest CPA firms in the United States. From corporations and not-for-profits to state and local governments and federal agencies, Sikich clients utilize a broad spectrum of services* and products to help them improve performance and achieve long-term, strategic goals. *Securities offered through Sikich Corporate Finance LLC, member FINRA/SIPC. Investment advisory services offered through Sikich Financial, an SEC Registered Investment Advisor. 