Shining the light on Shadow IT is critical to understanding unauthorised application usage in the enterprise, says M-Files

Julian Cook, Director of UK Business at M-Files Corporation, states: “Understanding the use of unauthorised devices and apps will allow stakeholders, including the CIO, IT department and employees themselves, to identify and agree sanctioned solutions. Not only will this support both security and data protection across the business, but more importantly such collaboration will help ensure employee buy-in.”

Cook’s comments follow on from a recent report from the research firm Frost & Sullivan, which revealed that 49 per cent of employees are more comfortable with using unapproved applications within the enterprise as it allows them to get their jobs done quicker and easier. According to the research a further 38 per cent of line business employees surveyed identified “slow or cumbersome IT approval processes for the needed service”, with almost a quarter stating “the unauthorised application met needs better than IT’s alternative.”

Last year M-Files conducted a similar study and the findings revealed that almost half of those surveyed stored confidential company information on their personal file sharing and sync apps. Additionally, 56 per cent of participants also revealed that their organisation did not have a policy in place to prohibit use of file sharing.
For some CIO’s reviewing these results, the findings are likely to make for uncomfortable reading. In light of this Cook suggests there needs to be a fundamental rethink regarding how key stakeholders approach IT:

“Ultimately, data is the lifeblood of any business, and that is why substantial investment is made into ensuring its safekeeping. Unfortunately, many applications currently in use for managing and collaborating information can often be clunky and unnecessarily complicated for the user. This inherently drives employees into choosing simpler, more versatile alternatives, which are not sanctioned by the business.”

Cook continued: “For the IT department, preventing use of these unauthorised applications presents numerous challenges, largely due to their scale and acceptance amongst the working world. To do this effectively, it’s important that the IT department understand and learn about employee preferences, notably the speed and requirements needed for accessing, sharing and collaborating on information with internal and external colleagues. Doing so will allow them to identify which IT solutions can best support their daily workplace functions, jobs and interactions.

“Next, you must clearly define what you want your polices to be. These must support effective collaboration with individuals in and outside of the business, as well as adhering to strict data protection and security policies. It is also vital that employees are educated and understand the reasons for the policy being put into place. This can be supported through documentation including guidelines, best practice procedures and suggested security frameworks.

“From this, you will then be able to determine the solutions most suitable to your workforce. This is likely to consist of an equal mix of ease of use, ease of deployment and a full set of information management features and capabilities. For this to be effective, it must have buy in and be driven by management throughout the business.”