Last updated at Mon, 05 Jun 2023 16:12:13 GMT
Overcome Nephophobia - Don't be a Shadow IT Ostrich!
Every cloud…..
When I was much younger and we only had three TV channels, I used to know a lot of Names of Things. Lack of necessity and general old age has meant I've now long since forgotten most of them (but thanks to Google, my second brain, I can generally “remember” them! Dinosaurs, trees, wild flowers, and clouds were all amongst the subject matters in which my five-year-old self was a bit of an expert. I would point at the sky and wow my parents with my meteorological prowess, all learnt from the pages of a book. Good times. These days I can manage about three cloud names off the top of my head before reaching for the Internet. Cirrus, stratus, cumulonimbus (OK I had to double check the last one).
Failing memory aside, I still love clouds, and frankly there's little that beats a decent sunset – which wouldn't be anywhere near as good without some clouds. So assuming you're still reading and not googling cloud names (because it can't just be me), I'd like you to think of a cloud please, an actual one, not a digital one. Chances are it's all fluffy and white, the cumulus (oh yeah) type. Of all the words I could use to describe a cumulus cloud “scary” isn't one of them. But did you know that Nephophobia - the irrational fear of clouds - is a real condition? Nephophobics struggle to look up into the sky, and in some cases won't even look at a picture of a cloud. Any phobia by its very nature is debilitating, leaving the sufferer feeling anxious at best, or totally unable to function at worst. I live with a six-foot strapping arachnophobe who is reduced to a gibbering wreck at anything larger than a money spider.
Digital Nephophobia
Nephophobia exists in our digital world too. Use of the cloud is written off and immediately written in to policy. “We don't use the cloud” is something I've heard far too frequently. And sometimes “don't” is more “can't” (blocked from doing so by government regulation) or “won't” (we just don't want to, we don't trust it), but actually “do…but don't know it” is more often
the reality. This is where anxiety caused by the cloud is at its most valid – lack of visibility into the cloud services your users are already using (aka Shadow IT is frankly terrifying for anyone concerned with data privacy or data security. I recently met with an IT Security Manager of a global network, who rightly said “if you're not providing the services your users need and expect, then whether you like it or not you are probably being exposed to Shadow IT”. Pretending it's not happening won't make it go away either, as many a mauled ostrich will merrily testify.
Digital Therapy
Many phobia therapies involve facing the fear head on. Now I'm not suggesting that the best medicine to cure digital nephophobia is to burn the “we don't use the cloud” policy and open up your network to every cloud service available, far from it. First of all, it's vital to understand what is really happening within your environment now – which cloud services your users have using without your knowledge. From there you can work out which cloud services you should be formally provisioning, which you should be monitoring, and which you should be locking down. Perform the due diligence – any cloud vendor worth their salt will be able to provide you with the reassurance that their service is secured, with in-depth details of how it is secured, what happens to your data in transit and at rest, how it is segmented from other organisations' data, who has access, and more.
Set yourself free
Once you've worked out what you need, and are confident in the service provider's security processes (which are likely going to be on par or indeed even better than those in your own network), the weight of digital nephophobia will begin to lift. The benefits of using the cloud are huge – a huge reduction in provisioning, administration, and maintenance overheads for a start. The speed in which you can provide new services compared to the old world of doing it all in-house is staggering – how many times have you heard users moan about how long it takes IT to bring in a new service? Speaking of moaning – how about those 79 bajillion helpdesk tickets and IMs and calls that come in because The Server's Down….Again? Distant memories – uptime is another benefit to embracing cloud services. You'll be in good company too - organisations from every vertical are using the cloud – financial institutions, governments, healthcare, defense, manufacturing, charities, the list goes on and on.
Tackling Shadow IT is the first step in the journey from Nephophobe to Nephophile
Our aforementioned ostrich friend wants to be a lesson to you. If you can't see where your problems are, you can't begin to do something about them, and if you bury your head in the sand you are in dire risk of becoming lion lunch. Visibility into cloud services, whether they are sanctioned or shadow IT services, is a string that every IT Security professional needs to have in their bow. InsightIDR gives you that string (and a whole bunch more too!) – at the tips of your fingers lies a wealth of information on which cloud apps are being accessed, who is using them, when they are being used, and how frequently. And you don't have to code a bunch of complex queries to access this information – the interactive dashboard has it all:
