Shadow IT In Remote Work

Remote and hybrid working have brought major benefits to businesses, but they have also opened the door to one of the most persistent security challenges - shadow IT. Employees regularly use unauthorised devices and applications to access, store, and transfer corporate data, often bypassing security policies in the process.

This introduces risks that IT teams struggle to control, particularly when it comes to removable storage devices such as USB sticks.

Securing portable storage and enforcing stricter device controls must be a priority. Without clear policies and robust security measures, businesses risk data breaches, regulatory non-compliance, and reputational damage.

The Hidden Risks Of Shadow IT

Shadow IT occurs when employees use personal devices or unapproved software to carry out work-related tasks. Often, this isn’t malicious, staff may turn to familiar tools for convenience or efficiency. However, these unauthorised actions create security gaps that traditional IT frameworks may fail to detect.

A major issue is the use of personal USB sticks, external hard drives, and other portable storage devices. These devices can easily be lost or stolen, putting sensitive corporate data at risk. Worse still, they can introduce malware into an organisation’s network, bypassing existing security defences.

Apricorn’s latest research highlights that 74% of surveyed IT decision makers said that their organisation’s mobile/remote workers are willing to comply with security measures, but they don’t have the necessary skills or technology to keep data safe and 60% expect their mobile/remote workers to expose them to the risk of a data breach. Securing corporate data is an ongoing challenge, and with remote work now standard practice, it is becoming harder for IT teams to monitor how and where data is being stored and transferred.

Why Securing Portable Storage Is Critical

Organisations cannot afford to ignore the risks posed by unmanaged storage devices. Recent high-profile data breaches have demonstrated just how damaging the loss of sensitive information can be. Financial penalties for non-compliance with data protection regulations such as GDPR can be severe, and the reputational fallout can be even more costly.

Blocking the use of all portable storage devices isn’t a practical solution. Employees need secure ways to move and store data, particularly when working remotely or travelling. 

Companies must implement strict policies that allow only corporately issued, hardware-encrypted USB devices to connect to company systems. These devices provide a controlled environment, preventing unauthorised access and ensuring that all stored data remains protected. Positively, a staggering 96% of organisations now enforce a policy that mandates encryption for all data held on removable media, according to Apricorn’s latest research.

Locking down USB ports to accept only approved devices is another crucial step and a good addition to eliminate the risks associated with personal storage use.

Enforcing Security Policies In Remote Environments

Even with secure storage in place, policies must be actively enforced. Businesses need to establish clear guidelines on device usage, making it explicit that personal USB sticks and external drives are not permitted. These policies should be supported by technical controls that prevent unauthorised devices from connecting to corporate networks.

Endpoint Detection and Response (EDR) solutions can play a key role here, helping IT teams monitor which devices are being used and flagging any unauthorised access attempts. Real-time tracking and automated alerts ensure that any suspicious activity is quickly identified and dealt with before it can escalate into a security incident.

Education is equally important. Employees must understand the risks of shadow IT and the role they play in protecting company data. Regular security training should include best practices for handling sensitive information, recognising potential threats, and securely using authorised storage devices.

Balancing Security With Usability

Businesses need to strike a balance between security and usability. If security measures are too restrictive, employees may try to bypass them. The key is to provide approved alternatives that are both secure and convenient.

Mandating the use of encrypted USB devices and locking down ports is not about limiting productivity, it’s about ensuring that sensitive data stays within a controlled environment. By giving employees the right tools, businesses can reduce reliance on shadow IT without disrupting workflow and productivity.

Businesses that fail to address shadow IT risk losing control of their sensitive data, putting themselves at greater risk of breaches and compliance failures.

By securing portable storage, enforcing strict device policies, and educating employees on best practices, organisations can significantly reduce their exposure to security threats. 

Jon Fielding is Managing Director, EMEA at Apricorn

Image: Pixabay

You Might Also Read: 

Taking The You Out Of USB:


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

 

« What Apple's Standoff With The UK Government Means For Your Data

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Kenna Security

Kenna Security

Kenna Security is a risk intelligence & vulnerability management platform that helps prioritize and remediate vulnerabilities.

Aeriandi

Aeriandi

Aeriandi is a leading provider of hosted PCI security compliance solutions for call centres, trusted by high street banks and major Telcos.

SecureDevice

SecureDevice

SecureDevice is a Danish IT Security company.

Armadillo Sec

Armadillo Sec

Armadillo provide penetration testing and vulnerability assessment services.

Grimm Cyber

Grimm Cyber

GRIMM makes the world a more secure place by increasing the cyber resiliency of our client’s systems, networks, and products.

NetKnights

NetKnights

NetKnights is an independent IT security company which offers services and products for strong authentication, identity management and encryption.

Nexis

Nexis

Nexis GmbH is a German IT security company specializing in IAM, access control, and risk management.

Bluink

Bluink

Bluink specializes in identity and access management and customer identity verification, using your smartphone as a strong authenticator and secure identity store.

ArmorText

ArmorText

ArmorText offers a seamless channel for communication and collaboration for organizations concerned with keeping communication data private and secure.

Intraprise Health

Intraprise Health

Intraprise Health is a Certified HITRUST Assessor and award-winning provider of health information security products and services.

Netacea

Netacea

Netacea provides a revolutionary bot management solution that protects websites, mobile apps and APIs from malicious attacks such as scraping, credential stuffing and account takeover.

Mindsight

Mindsight

Mindsight is a technology consulting firm with expertise from cybersecurity to cloud, disaster recovery to infrastructure, and collaboration to contact center.

NuID

NuID

NuID is a pioneer in trustless authentication and decentralized digital identity.

Toka Group

Toka Group

Toka empowers government agencies with critical and previously out-of-reach digital forensics, force protection and Intelligence capabilities, tackling the fields' most pressing challenges.

Birch Cline Cybersecurity

Birch Cline Cybersecurity

Birch Cline specializes in helping Local Government and Education agencies, as well as mid-market organizations, build and maintain successful cybersecurity programs.

EVVO LABS

EVVO LABS

EVVO Labs empower your business with the latest IT capabilities to get you ahead of your competitors. We are experts at converging technologies to build your digital transformation.