Attention IT Departments: Is Your Business Going Behind Your Back with “Shadow IT Maneuvers?

Aug 28, 2012 | Cloud, Fresh Ink, Inside the Briefcase, Top Stories

Sales, management and other business departments have always had a mind of their own (as have, admittedly, IT departments). Lately, more and more departments are going behind IT’s back to implement technical solutions “on their own” (sort of).

As you might guess, these solutions typically involve cloud computing. While the cloud is great for VPN and usage spikes, it can be a mixed blessing when it comes to enterprise sales, HR and management solutions.

Shadow IT describes a situation when a department implements a technical solution without going through (or even alerting) the IT department. While this phenomenon is nothing new, it has changed faces over the years.

These days, Shadow IT usually involves sales or management signing up for a cloud solution, generally as a way to interact with customers and clients. By the time the real IT department finds out about it, data has been severely fragmented, security has been put at risk or even breached, and boundaries that were there for good reasons have been blurred.

Where Shadow IT Starts

One of the biggest reasons that other parts of an enterprise go around the information technology department is because of time considerations. Non-IT personnel often don’t understand amount of time it takes to integrate a fully functional and secure solution and that lack of knowledge leads to frustration, which leads to the dark side.

Nowadays, cloud computing services offer everything from mobile office and file systems to client interaction interfaces to data analysis for marketing and sales departments. These solutions are specifically tailored for ease of use by non-technical clients.

Look at it from the non-technical manager’s point of view: The kind of solutions that were out of their control and could take days or weeks to get approved and implemented by IT, are now easier to implement than having a phone line installed.

Control and ease of implementation are two big driving factors. When you consider that a company’s profits depend more and more on timely moves than they once did, it isn’t entirely illogical for management and other department to implement technical solutions behind IT’s back.

But it’s not exactly good, either.

The Dangers of Shadow IT

There is plenty to worry about when non-technical departments of a company implement their own technical solutions. The biggest concern to most IT departments is security.

Even if the cloud provider can be considered completely trustworthy, there’s still the matter of insufficient security measures being implemented. Most non-IT departments simply don’t know how vulnerable a network or application can be, and therefore fail to take appropriate safeguards such as using backup, even when they’re aware that such safeguards exist.

They also tend to under-appreciate the value of backing up data, how much time and effort it involves, and what the entire company stands to lose when this isn’t adequately done. When non-technical personnel have control of a technical dashboard it’s all too easy for one of them to wipe out months of essential information with a single decision. Misguided efforts at data restoration can damage the data even more.

These aren’t the only problems with Shadow IT; data integration is another huge one. But they are the most pressing problems.

How to Stop the Shadow IT Problem

The first solution that springs to most of our minds is to insist that other departments–or at least individuals with authority–be educated on the dangers of implementing technical solutions without going through the IT department. But this is only half of the solution.

The other half is that IT departments simply need to make and effort to work more closely with–and become more sympathetic to–the plight of non-technical personnel.

Like it or not, businesses don’t exist in order to support information technology departments. Information technology departments exist in order to support businesses. And once IT figures out what management gains by going behind its back and makes an effort to provide management with what management wants, that someone else is providing, things will look a lot brighter (and more secure) for everyone involved.

About the author: Dawn Altnam lives and works in the Midwest, and she enjoys following the business tech world. After furthering her education, she has spent some time researching her interests and blogging of her discoveries often. Follow her on Twitter! @DawnAltnam

Top 10 Cybersecurity Stories This Week: PHP2Shell Threatens 5.1 Million Internet-Exposed PHP Servers With Unauthenticated RCE, Eight eMudhra CA Private Keys Cracked From Public Certificates, CISA and FBI Warn SafePay Ransomware Has Hit 600+ Critical Infrastructure Organizations

Top 10 Cybersecurity Stories This Week: PHP2Shell Threatens 5.1 Million Internet-Exposed PHP Servers With Unauthenticated RCE, Eight eMudhra CA Private Keys Cracked From Public Certificates, CISA and FBI Warn SafePay Ransomware Has Hit 600+ Critical Infrastructure Organizations

October 23, 2026 | ITBriefcase.net Why it matters: Tuesday, October 21 delivered one of the heaviest single-day security disclosures of the year: PHP2Shell, GitLab CVE-2026-110264, and Node.js security releases all shipped simultaneously, each carrying unauthenticated...

read more
Top 10 Cybersecurity Stories This Week: Microsoft’s Largest Patch Tuesday Ever Tops 1,411 CVEs With Live Windows Shell Zero-Day, GhostAction GitHub Supply Chain Wave Hits 500+ Accounts and Tens of Thousands of Repositories, Ransomware Smashes Monthly Record at 1,073 Victims in August

Top 10 Cybersecurity Stories This Week: Microsoft’s Largest Patch Tuesday Ever Tops 1,411 CVEs With Live Windows Shell Zero-Day, GhostAction GitHub Supply Chain Wave Hits 500+ Accounts and Tens of Thousands of Repositories, Ransomware Smashes Monthly Record at 1,073 Victims in August

October 16, 2026 | ITBriefcase.net Why it matters: Microsoft's October 2026 Patch Tuesday is the largest software security release in the company's history — 1,411 flaws, three zero-days, 75 critical vulnerabilities, and a live Windows Shell security feature bypass...

read more
Top 10 Cybersecurity Stories This Week: FBI Warns FortiBleed Is Locking Admins Out of Their Own Firewalls, Attackers Hijack Three Country-Code Domain Registries to Obtain 12 Google HTTPS Certificates, ShinyHunters Suspect Arrested in Jordan

Top 10 Cybersecurity Stories This Week: FBI Warns FortiBleed Is Locking Admins Out of Their Own Firewalls, Attackers Hijack Three Country-Code Domain Registries to Obtain 12 Google HTTPS Certificates, ShinyHunters Suspect Arrested in Jordan

October 9, 2026 | ITBriefcase.net Why it matters: The FBI and US Secret Service issued a joint advisory on October 6 confirming that the FortiBleed credential-harvesting campaign — which has compromised credentials for 86,644 Fortinet FortiGate firewalls and SSL VPN...

read more
Top 10 Cybersecurity Stories This Week: Citrix NetScaler Dual Zero-Days Under State-Sponsored Attack, Pentagon DMDC Breach Exposes 3 Million Military Personnel Records for Nine Months, AI Agent Breaches Dutch Vulnerability Disclosure Organization Using Zammad Zero-Days

Top 10 Cybersecurity Stories This Week: Citrix NetScaler Dual Zero-Days Under State-Sponsored Attack, Pentagon DMDC Breach Exposes 3 Million Military Personnel Records for Nine Months, AI Agent Breaches Dutch Vulnerability Disclosure Organization Using Zammad Zero-Days

October 2, 2026 | ITBriefcase.net Why it matters: Citrix disclosed two critical remote code execution zero-days in NetScaler ADC and NetScaler Gateway on September 27 — CVE-2026-88771 (CVSS 9.5, unauthenticated RCE in default configuration, no special setup required)...

read more
Top 10 Cybersecurity Stories This Week: Brevo Supply Chain Attack Serves Malware to 100,000+ Websites via Stolen CDN API Key, Revolut Discloses Breach via Fake Government Requests, Gyazo 23.6 Million User Records Stolen

Top 10 Cybersecurity Stories This Week: Brevo Supply Chain Attack Serves Malware to 100,000+ Websites via Stolen CDN API Key, Revolut Discloses Breach via Fake Government Requests, Gyazo 23.6 Million User Records Stolen

September 25, 2026 | ITBriefcase.net Why it matters: Attackers compromised Brevo — the email marketing and CRM platform used by eBay, Louis Vuitton, Michelin, Amnesty International, and more than 100,000 other businesses — by exploiting a hardcoded, long-lived...

read more