'Shadow' Cloud Services Rampant In Government Networks

Shadow cloud services pose nearly as much of a risk to government organizations as they do to private sector companies.

Skyhigh Networks recently conducted a study of cloud services usage among 200,000 employees at public sector organizations in the U.S and Canada. The study found that on average, there are some 721 cloud services running inside government organizations at any time, only 61 of which IT is actually aware about. In other words, there are about 10 times as many shadow cloud services being used by public sector employees at work than are being managed by the IT group.

The numbers show just how rampant the shadow cloud problem is in government networks that, in theory at least, should be better locked down than private sector networks, says Rajiv Gupta, CEO of Skyhigh.

“Government organizations tend to think of themselves as somehow different,” from private companies on the security front, Gupta says.  “What we found is there is as much risk of shadow IT in government as any other organization. People are people. They want to do things more efficiently.” In many cases, cloud services help them do that, with or without the IT organization’s help, he says.

The Skyhigh report follows a similar study by CipherCloud, which showed that a staggering 86 percent of cloud services consumed by employees at private companies were unsanctioned by IT. An earlier report by Frost & Sullivan on behalf of McAfee found that even when cloud services are formally purchased by business groups, there’s a good chance that at least 35 percent of the purchases will happen without any IT oversight.

Shadow, or unmanaged, cloud usage by employees can pose a major security problem for organizations. Many security analysts have warned about how the growing use of consumer-oriented, cloud-hosted collaboration, file sharing, storage and social media services can expose companies to inadvertent data leaks, data exfiltration campaigns, malware threats and compliance problems.

For example, when cloud security provider Elastica ran an analysis on some 100 million files being shared and stored on cloud services by employees, it found that more than 20 percent were sensitive and confidential data -- including personally identifiable information and financial data. Gupta said that Skyhigh’s analysis of cloud service usage among public sector employees showed the most popular categories to be collaboration, file sharing, content sharing and software development related sites.

Microsoft’s Office 365, Yammer and Hotmail were among the most popular collaboration services used by public sector employees, followed by services like Webex and online presentation platform Prezi. The most commonly accessed file-sharing services included Dropbox, Box, Hightail and Google Drive, while the most popular social media services included Facebook, Twitter, LiveJournal and LinkedIn. Meanwhile, services like GitHub and SourceForge were among the more popular development services being accessed by government employees

In many cases, the use of these services was approved by IT, while in many other cases they were not, Gupta said.

What was interesting is the apparent gap that exists between the perceived use of such services within public sector organizations and actual use. For instance, when IT managers were asked to estimate DropBox use within their organizations, the average number tended to be around 16 percent. Actual use was much higher at 80 percent. Similarly, the gap between perceived and actual use of Apple’s iCloud was a remarkable 42 percent.

Such numbers illustrate that government IT groups have little idea of cloud service usage by employees, Gupta said. Often, cloud policies are based on incomplete information and tend to be either overly restrictive or too permissive.

“This really is an example of ‘what you don’t know can hurt you,’” Gupta says.