Mitigating Cloud Risks Starts With Full Visibility of Shadow IT

When asked to evaluate their understanding of cloud security risks, public sector agency managers and employees say that gets complicated. A recent survey from Netskope and GovLoop showed about 42% of 230 respondents citing good awareness of cloud security risks, 26% citing low or no awareness, and about 32% citing somewhere in between. 

That the responses are all over the map isn’t a surprise: Cloud security is still relatively early in its adoption by public sector agencies. But with the pandemic having rapidly accelerated the need for agencies to address remote-first security and connectivity requirements for employees, it’s important for all agencies to examine typical reasons for cloud security confusion and take practical steps toward changing how they handle people, processes and technology. 

Cloud security risks in the public sector (or in any industry) heighten due to:

• Always-changing threats and techniques, with state-sponsored cyberattackers and other bad actors continuing to broaden and deepen their capabilities.
• Human error, including misconfigurations, is still one of the key contributing factors to cyber incidents.
• Over-reliance on a wide variety of technology vendors, which are often limited in what their specific tools can do to prevent leakage of sensitive data, control risky user behavior, and other practices that sit with the agency as part of a shared responsibility model. 

These factors have a common thread: visibility and control. And one of the biggest visibility gaps is in the use of shadow IT, which every agency grapples with whether they know it or not. Shadow IT—meaning hardware, software or services in use by employees without the approval of the agency IT department—accounts for as much as 97% of all cloud applications in use by organizations. Survey respondents overwhelmingly indicated that their agencies did not have complete visibility into shadow IT applications, with 56% reporting that their organization lacked visibility into the use of shadow IT.

A loss of visibility and control, or a total lack thereof, leaves agencies open to many security vulnerabilities, including data loss. Consider what can happen if an employee emails data from a shadow IT application to someone outside the agency, deliberately or inadvertently making that data public. Or, if an employee uses his or her own private instance of Office 365 instead of an IT-sanctioned version, opening a path for data to be shared between those instances. Shadow IT can also be a scourge when it comes to compliance checks, and add costs and man-hours if security risks leave agencies open to noncompliance fines, security remediation costs, or significant waste in operational expenses on sanctioned applications employees don’t use.

The Right Approach

With the pandemic having forced all public sector agencies to address remote-first, cloud-centric work perhaps earlier than anticipated, older technologies such as virtual private networks and traditional secure web gateways won’t provide the kind of granular visibility and control they need to stay ahead of shadow IT and other cloud security risks. Adoption of a SASE architecture, in which cloud access security broker, next-gen secure web gateway, and zero trust network access capabilities are front and center, is recommended during the continued transition to cloud. 

But equally as important among any other architecture decision is to be data-centric. 

A data-centric approach to cybersecurity—which in turn helps improve overall visibility and control of the IT environment—must include: 

• Verification that a user’s device is authorized to access network resources.
• User authentication to limit the resources users can access.
• Verification that users have permission to access individual applications or data sets.
• Verification of the identity of users each time they access individual applications or data sets.

Data protection is ultimately about context, which is what connects the four requirements listed above using zero trust principles. By monitoring traffic between the user and the apps, teams can both allow and prevent data access based on a deep understanding of who the user is, what they are trying to do, and why they are trying to do it. Knowledge of the interplay among user, device, app and data enables security teams to define and enforce conditional access controls based on data sensitivity, app risk, user behavior risk and other factors.

Colby Proffitt is a cyber strategist at Netskope.