{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/shadow-it","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/shadow-it/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/shadow-it/"},"term":{"en":"Shadow IT","da":"Skygge-IT (shadow IT)"},"aka":{"en":["unsanctioned IT"],"da":["shadow IT","skygge-it"]},"domain":["security"],"cluster":"awareness","layer":"people","status":"current","era":2012,"summary":{"en":"Apps and tools staff use for work without the IT department knowing about or approving them.","da":"Apps og værktøjer, som medarbejdere bruger i arbejdet, uden at IT-afdelingen kender til eller har godkendt dem."},"body":{"formal":{"en":"Any software, online service or device used for work outside the organisation's approved set, and therefore outside its asset inventory, access management and security policy.","da":"Enhver software, onlinetjeneste eller enhed, der bruges i arbejdet uden for organisationens godkendte udvalg - og derfor uden for dens aktivfortegnelse, adgangsstyring og sikkerhedspolitik."},"plain":{"en":"Like tenants quietly adding their own extension cords and heaters - it solves their problem, but the landlord has no idea the fire risk exists.","da":"Som lejere, der i al stilhed sætter egne forlængerledninger og varmeovne til - det løser deres problem, men udlejeren aner ikke, at brandrisikoen findes."},"inPractice":{"en":"Case officers at a job centre start sharing citizens' documents through a free file-sharing site because the approved system feels slow, and no one in IT knows.","da":"Sagsbehandlere i et jobcenter begynder at dele borgeres dokumenter via en gratis fildelingstjeneste, fordi det godkendte system føles langsomt, og ingen i IT ved det."},"whyItMatters":{"en":"Nobody can protect what they do not know exists, so hidden tools become blind spots where data leaks unnoticed and the organisation cannot even say where its data is.","da":"Ingen kan beskytte det, de ikke ved findes, så skjulte værktøjer bliver blinde vinkler, hvor data slipper ud ubemærket, og organisationen ikke engang kan sige, hvor dens data ligger."}},"deepDive":{"en":"Shadow IT used to mean unmanaged hardware and locally installed software; since the SaaS boom it mostly means cloud services adopted with a credit card or a free tier, OAuth-connected apps and browser extensions, and increasingly generative-AI tools. The last category is often called shadow AI; the widely reported 2023 case in which Samsung engineers pasted confidential source code into a public chatbot, after which the company restricted such tools, is the standard example. A useful distinction is between unsanctioned (nobody asked), tolerated (known but never assessed) and sanctioned-but-misconfigured services, because each needs a different response.\n\nDiscovery is primarily a logging problem. Cloud access security brokers and features such as Microsoft Defender for Cloud Apps Cloud Discovery parse firewall, secure web gateway, proxy or DNS logs, or take endpoint telemetry, match destinations against a catalogue of thousands of apps with risk scores (certifications, data residency, encryption, breach history) and show volume and users per app. Identity is the second lens: every \"Sign in with Microsoft/Google\" and every OAuth consent grant leaves an entry in the identity provider, and restricting user consent, routing requests through an admin consent workflow and reviewing granted scopes (for example Mail.Read or Files.ReadWrite.All) closes one of the most dangerous paths, because the app's access rests on the consent grant rather than on the user's password, so a password reset alone does not necessarily remove it. Expense reports and procurement data catch paid subscriptions that network logs miss, especially for remote staff off the corporate network.\n\nThe compliance consequences are concrete. An unknown service processing personal data is almost always a processor without a data processing agreement under GDPR Art. 28 (databehandleraftale), missing from the records of processing under Art. 30, and possibly a third-country transfer under Chapter V without an adequacy decision or appropriate safeguards. For the ISMS it breaks ISO/IEC 27001:2022 Annex A 5.9 (inventory of information and other associated assets), 5.23 (information security for use of cloud services, new in the 2022 edition) and 8.19 (installation of software on operational systems), and CIS Controls v8 Controls 1 and 2 on enterprise and software asset inventory. NIS2 Art. 21(2)(d) on supply-chain security and (i) on asset management assume the organisation knows its suppliers and assets in the first place.\n\nBlocking alone tends to push usage further underground, onto personal devices and mobile data. Mature programmes treat discovered shadow IT as demand signal: a fast intake and assessment process, an approved alternative that is actually good enough, tiered policies (sanction, monitor, block) and data-loss prevention on the sanctioned channels. Security culture matters because the decisive moment is when an employee decides whether asking IT is worth the wait.","da":"Skygge-IT betød tidligere uadministreret hardware og lokalt installeret software; siden SaaS-bølgen dækker det især cloudtjenester, der tages i brug med et kreditkort eller en gratisversion, apps forbundet via OAuth, browserudvidelser og i stigende grad generative AI-værktøjer. Den sidste kategori kaldes ofte shadow AI; den meget omtalte sag fra 2023, hvor ingeniører hos Samsung indsatte fortrolig kildekode i en offentlig chatbot, hvorefter virksomheden begrænsede den slags værktøjer, er standardeksemplet. Det er nyttigt at skelne mellem ikke-godkendte tjenester (ingen har spurgt), tolererede tjenester (kendt, men aldrig vurderet) og godkendte, men forkert konfigurerede tjenester, fordi hver kræver sin egen reaktion.\n\nOpdagelse er først og fremmest et logningsproblem. Cloud access security brokers (CASB) og funktioner som Cloud Discovery i Microsoft Defender for Cloud Apps analyserer logge fra firewall, secure web gateway, proxy eller DNS, eller bruger telemetri fra endpoints, matcher destinationerne mod et katalog med tusindvis af apps med risikoscore (certificeringer, dataplacering, kryptering, historik med brud) og viser mængde og brugere pr. app. Identitet er den anden vinkel: Hvert \"Log ind med Microsoft/Google\" og hvert OAuth-samtykke efterlader et spor i identitetsudbyderen, og at begrænse brugernes samtykke, sende anmodninger gennem et workflow for administratorsamtykke og gennemgå tildelte scopes (fx Mail.Read eller Files.ReadWrite.All) lukker en af de farligste veje, fordi appens adgang hviler på samtykket og ikke på brugerens adgangskode, så en nulstilling af adgangskoden ikke nødvendigvis fjerner den. Udgiftsbilag og indkøbsdata fanger betalte abonnementer, som netværkslogge overser, især hos medarbejdere, der arbejder uden for virksomhedens netværk.\n\nDe compliancemæssige konsekvenser er konkrete. En ukendt tjeneste, der behandler personoplysninger, er næsten altid en databehandler uden databehandleraftale efter databeskyttelsesforordningens art. 28, mangler i fortegnelsen over behandlingsaktiviteter efter art. 30 og kan være en overførsel til et tredjeland efter kapitel V uden tilstrækkelighedsafgørelse eller fornødne garantier. For ISMS'et bryder det med ISO/IEC 27001:2022 bilag A 5.9 (fortegnelse over information og andre tilknyttede aktiver), 5.23 (informationssikkerhed ved brug af cloudtjenester, ny i 2022-udgaven) og 8.19 (installation af software på driftssystemer) samt CIS Controls v8 Control 1 og 2 om fortegnelse over enheder og software. NIS2 art. 21, stk. 2, litra d, om forsyningskædesikkerhed og litra i om styring af aktiver forudsætter, at organisationen overhovedet kender sine leverandører og aktiver.\n\nBlokering alene skubber ofte brugen længere under jorden, over på private enheder og mobildata. Modne organisationer behandler opdaget skygge-IT som et signal om behov: en hurtig proces for anmodning og vurdering, et godkendt alternativ, der faktisk er godt nok, differentierede politikker (godkend, overvåg, bloker) og DLP på de godkendte kanaler. Sikkerhedskulturen er afgørende, fordi det afgørende øjeblik er, når en medarbejder vurderer, om det er ventetiden værd at spørge IT."},"edges":[{"type":"requires","to":"security/security-policy","confidence":"high","strength":"normal"},{"type":"causes","to":"security/vulnerability","why":{"en":"Unapproved tools are not updated, reviewed or watched by IT, so their weaknesses go unhandled.","da":"Ikke-godkendte værktøjer bliver ikke opdateret, gennemgået eller overvåget af IT, så deres svagheder står uhåndterede."},"confidence":"high","strength":"primary"},{"type":"causes","to":"security/data-breach","why":{"en":"Data placed in unknown services can be exposed without anyone noticing.","da":"Data, der lægges i ukendte tjenester, kan blive afsløret, uden at nogen opdager det."},"confidence":"medium","strength":"normal"}],"depth":1,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"Wikipedia - Shadow IT","url":"https://en.wikipedia.org/wiki/Shadow_IT","tier":"reference"}],"draft":true}