Shadow IT User Behaviors

We write a lot about Shadow IT because it’s revolutionizing the way we all work. The faster technology and communications evolve, the easier it is to work the way employees are increasingly seeming to prefer — remotely. In fact, in 2016, 47% of employees (in a survey of 15,000 adults) reported that they work remotely at least some of the time.

But all that freedom can usher in error and negligence when it comes to keeping a company secure. As well, since employees just aren’t stuck in the office under the watchful eye of a manager or sysadmin anymore, it can be easier for Shadow IT behaviors, whether malicious or not, to go undetected. And unfortunately, that behavior can include putting essential company info on resources outside of the company.

IT can set up tools to monitor employee actions, which can be tedious, but companies and managers must also understand why employees are engaging in Shadow IT and what their intent is. Keep reading to learn which behaviors should put you on guard.

Issue #1 The Wrong Tools

In perfect world, IT would have plenty of time to assess and implement new technologies and tools for office staff. But more often, especially in organizations that don’t prioritize IT, their primary job is to put out fires.

And while IT is working to do what they can, employees are looking for better ways to do their work. Even if it means finding a tool outside of what is approved by the IT department.

A lack of progress in finding new tools is just one of the issues that leads to employees engaging in Shadow IT. In a paper entitled Behavioral Drivers Behind Shadow IT and Its Outcomes in Terms of Individual Performance Emergent Research Forum Papers, the authors hypothesize four main behaviors for why employees seek tools outside of the company even though it may put their employer at risk.

The User Experience

Tools on the consumer market cater to users with a really exceptional user experience. Employees simply expect their work tools to mimic this experience and when they don’t, they look outside the company for new tools.

Perceived Usefulness

When presented a new tool with which to do their job, an employee may do a quick analysis on how useful that tool will or will not be to their job. This is before they may even use the tool (i.e., their perception). This concept is called perceived usefulness, and if an employee finds instructions too complex or if a tool looks clunky, they may stop using the tool because it looks like a lot of hassle.

Social Presence

The authors infer that because apps like the G Suite and Skype are the first to appear when employees seek outside tools, employees are susceptible to social presence. Because so many things we do inside and outside of work involve communicating with people on different media, employees expect to be able to do that at work. The highest level of social presence would be face-to-face, while text-based communications like writing would have the lowest amount of social presence.

Apps like the two mentioned above have a higher instance of social presence because they are both immediate and interactive; they allow employees to work while not inhibiting the desire to communicate and seek a better social presence. If follows that tools that have a lower social presence are less desirable to employees.

Social Influence

Social influence is exactly what it sounds like — employees will be influenced by the opinions of their managers and peers regarding new technologies, as opposed to the previous influence that was enjoyed by IT departments. Because IT is now just one of the many influencers in the business technology game, their opinions (which may be the most informed) don’t hold as much sway as they used to.

Long story short, those are some behaviors that may be leading to your business having a Shadow IT problem. While this isn’t the most desirable behavior, it is something that can be changed with the proper leaders and policies. Essentially, employee intent here is not to get the company in trouble, but to get their job done.

Issue #2 The Trouble With Single Access

There are times when employees just need to get a document or file out as easily and quickly as they can. If in a rush, employees can naturally default to the application or platform they’re used to using, whether it’s personal email or a consumer cloud account.

This behavior is to be expected, but what if an employee seems to be frequently accessing different file sharing apps? It could be nothing, as most employee behavior isn’t typically malicious, but it could also be an employee storing company information for use at a later date.

Employees could be doing this at any time, but it’s much more likely when they’re about to leave the job. According to Entrepreneur, “85% of employees admitted to taking company documents and information they had created” before they left the company.

It gets even scarier from there with increasing numbers of employees admitting to taking source code, patent filings, customer data, strategy documents and presentations. On top of that, 20% said they’d be more likely to steal data and pass it on to competitors if they had been let go on bad terms. So, it’s important to pay attention to any employee-company conflict in the past as well as terminations, (even if they are extremely gruntled now), as they may be more likely to take information out of revenge.

When framed this way, those bouts of single access may suddenly seem alarming.

Monitoring is Necessary to Keep Your Company Info Safe

So, with all those remote and/or disgruntled employees, how does a company ever keep their information safe?

It all comes down to tracking and monitoring. Web applications or tools that allow file uploading and downloading (e.g., Dropbox or Slack) should always be tracked. That can take a lot of time on the part of IT, but not so if they have the right tool.

The right tool saves IT time and enforces security policies put down by the company. For instance, we’re developing a new product called FileHub™ that not only tracks the entire lifecycle of a file, but gives companies the control on which file sharing apps and programs employees are allowed to use, all while tracking user and file behavior on their laptop, in the cloud and on your network.

Specifically, if a user travels to a file sharing or storage website or application, they will be pinged by FileHub™. Either they will be told the application isn’t authorized or they can allow the organization to index and monitor the files in that storage tool. If the employee says “no,” then access won’t be granted. If the employee says “yes,” then a company can now have full access to the files in that account as well as the activity around them.

This is just one of the ways in which FileHub™ will make company file protections stronger whether employees are inside the office or working remotely. It can also work concurrently with existing security tools to safeguard your company information.

Want to be one of the first to learn about FileHub™ when it’s released or learn more about becoming an early tester? User the form below!

Learn More About FileHub™

Get insight into answering the tough questions about how your employees use their files to help you investigate incidents or breaches, spot trends or help thwart employee data loss.
About the author

I am the Content Marketer at SmartFile, which means I get to learn everything and write about it -- my two favorite things. I firmly believe that oatmeal cookies should contain chocolate chips, not raisins.

Leave a Reply