Shadow IT – software, hardware and data connections that employees use without supervision or permission from the IT department – ​​poses all kinds of risks. Controlling shadow IT is also a challenge in contact centers. What do you do when technology use becomes invisible?

 

In contact centers, the IT environment is often extra well sealed and standardized. This is necessary because there is often a lot of staff turnover and intensive work is done with customer data. When employees are allowed to work from home, the chance of using shadow IT increases. This not only concerns the use of software that the IT department has no insight into, but also data connections (Wi-Fi, 4/5G and routers) and hardware such as smartphones. What are the causes of the use of shadow IT, what are the risks for contact centers and what can you do to limit them?

What are causes of shadow IT?

1. De functionality of the official software is no longer sufficient. For example, the application is very outdated, not (any longer) user-friendly (think of alt-tab or different screens) or the development of new required functionality takes (too) a long time to develop.
2. The software is not well implemented (with sufficient attention to software adoption). For example, logging in or using it is complicated or the software is not suitable for performing specific tasks.
3. Have employees immediate needs which they can fulfill quickly and easily with self-found software; they don't want to wait for the IT department to come up with approval or an equally good alternative.
4. Employees have at home restricted access to applications and/or data and use their own work-arounds to still have full access. Working from home is a major cause of shadow IT.
5. Setting up allowed data connections is complicated, they work slowly or often suffer from malfunctions, as a result of which IT end users are hindered and/or delayed in doing their work and prefer other connectivity use.
6. The use of shadow IT is actively encouraged by colleagues or managers, in order to use more innovative or alternative solutions. Within the government this has been allowed for a while. In the book New ideas and practical tips for working in government 2.0 talks about “different ways of working together and working your way through an ever-growing mountain of information”.
7. The use of existing applications continues to change new functionality, which is not allowed, but which is used anyway. Think file sharing via WhatsApp, not the app's primary use case.
8. Employees use their private hardware (such as an iPad or a MacBook) for business purposes, because they have the business laptop not attractive or find it inconvenient.
9. Internal Procedures to officially request software take too long, are too complicated or are actively discouraged.
10. When certain equipment is purchased, specific software appears to be required and IT is bypassed to prevent delays in commissioning.
11. There is no IT budget available for new software, but alternative solutions can be purchased through other budgets. Think of cloud capacity from, for example, AWS, which you can purchase online with a credit card.

Shadow-IT: Examples in customer contact – Contact centers that are less mature in IT and data governance must take into account that employees exchange individual customer data with each other – for example by taking a screenshot or literally taking a picture of a screen. Sometimes separate apps are used to communicate with colleagues out of sight of management. You can also use e-mail, app or file sharing programs to have data available at home. Shadow-IT can also play a role in hardware and data connections. Think of working from home, from a mobile location or from abroad using public or open Wi-Fi networks or mobile phone hotspots.

Much 'practical' shadow IT is available online as a SaaS solution or is available online as an app for a smartphone or tablet or as a downloadable application. Even when the IT department has disabled or prohibited downloading and installing them on company hardware, these solutions can still be placed on private devices and used to retrieve, edit, store and exchange company data through other programs .

Other solutions that are widely used for work-arounds are converters for editing PDFs or transcribing audio files, for example; clipboard applications and screenshot applications, low-code and no-code applications and the independent procurement of cloud services for use in data analysis.

The most recent example of risky shadow IT is the massive use (often trial and error) of ChatGPT and other OpenAI solutions. In many cases functionality can simply be found on a website: upload data and get it back in edited form via a download. The risk is that company data will be uploaded and end up in training data sets.

Risks of shadow IT

The use of shadow IT carries several risks.
Data and data files can be stored in different formats on employee devices and/or end up in different places in the cloud, with the risk of data theft and data leaks.

Perhaps the greatest threat to organizations comes from universal clipboard applications. In these applications, someone can use their business machine to put something on a clipboard to transfer it from one application to another for a work-related activity, but that information can also be accessed at home when using the same application on their personal machine . Information can go roaming like this.

However, the main risk is that neither the size nor the intensity of the use of shadow IT is known. As a result, the scope of the security risk is also unclear. In any case, it is certain that the use of shadow IT increases the 'attack surface' of hackers: it makes your organization more vulnerable. The quality (reliability and stability) of shadow IT is also not always known; no one oversees updates or upgrades.

Use of business email addresses

Some shadow IT requires users to register prior to use. If business e-mail addresses and business credit cards are used, this can cause problems if the provider is rogue or does not have proper security around user data.

Another problem with shadow IT has to do with costs, management and maintenance. Apart from the fact that shadow IT is not managed and maintained, its network load is also not clear. Unforeseen obstacles can arise during software implementations, cloud migrations or transformations, because essential steps in everyday processes are not documented.

Financial setbacks in outsourcing

This can also cause financial surprises – paid solutions are not part of IT's budget; functionality that is required for certain processes is not included in the budget for software renewal or outsourcing, because the item is not known to IT.

When costs are booked to a cost center other than IT, costs can continue because users forget to 'turn off' or cancel certain functionality and the IT department cannot supervise the lifecycle management of software. This is particularly common in the purchase of cloud applications.

Finally, there are legal risks. Organizations are expected to be compliant with applicable laws and regulations. When shadow IT is used, this can no longer be guaranteed. Organizations that do not have a policy in this area run liability risks.

Tips and suggestions for controlling and/or monitoring shadow IT

Realists in IT say you can't prevent shadow IT. They prefer to advocate for increased awareness and training on responsible IT use, simply because many hundreds of shadow IT solutions are used in every large organization. Other measures are:

1.Clean desk policy – Privacy and security are of great importance in contact centers. If you want to prevent agents from using shadow IT, you must standardize software use and actively ensure compliance with a clean desk policy. That means: no paper and writing materials and no electronics in the workplace other than screen, headset, keyboard and mouse. Floorwalkers and team leaders can supervise and you can require employees to store the mobile in a locker during work. Anyone who nevertheless needs to be contactable can pass on the telephone number of a supervisor.

2. Full Monitoring – If you facilitate working from home, preventing the use of shadow IT is a lot more difficult. There are contact centers that maintain full call/screen recording and require the employee to use a webcam during work that registers the workplace. If you add a company laptop that can't take screenshots, you go a long way. In addition, there are apps and monitoring solutions that can detect shadow IT and analyze its risks. Network activities can also be monitored. In addition, the IT helpdesk is an important source of information, just like all employees themselves.

3. 'Comply or explain' – If you want to go a step further, you can focus on 'comply or explain': make employees responsible for their own choices when they start working with software, devices or data connections outside the IT department. Ideally, you combine this with policy in the field of shadow IT: who is allowed what, how do you deal with it, what do you document and what do you not, who takes care of management and payments, what requirements do you set for applications and devices and for the suppliers? This turns shadow IT into a tolerance policy – ​​not every CIO is equally enthusiastic about this.

Listen to your IT end user, also in the contact center

One of the better tips is of course to invest in software that always optimally meets the requirements and needs of end users and where talking about the use and avoidance of shadow IT is not taboo. Since the requirements and needs of IT end users are constantly changing, investing in new software or improving and expanding existing functionality is also an ongoing process. (zip tone)

Featured, Knowledge base, Technology