Shining a Light on Shadow Data

It’s human nature to display caution when dealing with the unknown. Facing something we don’t completely understand can be scary. It’s why, as children, we’re afraid of trying new vegetables (looking at you, brussels sprouts) or finding monsters lurking in the dark. Back then, the monster in the dark typically ended up being nothing more than harmless noise. In today’s digital world, what lies in the dark may cause much more mayhem than a simple gust of wind. Having the ability to store everything in the cloud may be convenient, but it also comes with dangerous risks. Among those dangers lies something known as Shadow Data.

What is Shadow Data?

Shadow Data is more than an ominous term thrown around the world of cybersecurity. It refers to any sensitive information being housed outside an organization’s designated security locale. This includes data that has been backed up or stored in a manner that goes against the organization’s security protocols. This can look like:

Personal Storage Accounts

Any private information saved on a drive or device not authorized by the organization immediately becomes shadow data. Example: Jolene is updating customer billing information but is called away before being able to finish. Because it’s not yet completed and she’s already logged in, she saves the information on her personal Google Drive account.

Legacy Applications

As technology improves, there may be upgrades or replacements for the applications used to house sensitive information. During this transition, files and information from the original application left untouched become Shadow Data. Example: Jenny learns that the dealership’s current application for housing data is being replaced. Because the information automatically transfers to the new program, she doesn’t find it necessary to ensure that all information on the original application has been erased or secured.

Unauthorized Messaging Platforms

It’s normal for coworkers to discuss work-related items as they come up throughout the day. If these conversations take place within applications not authorized for sensitive information, Shadow Data is created. Example: During their lunch break, Tommy and Gina are chatting on Instagram. Tommy suddenly realizes an issue at the dealership regarding private customer information. Since they’re already mid-conversation, he asks Gina about it on the social media platform.

Why is Shadow Data dangerous?

Whenever Shadow Data is present, so are the security risks. Data breach possibilities increase with unauthorized access and unintentional exposure becoming more likely. Compliance violations arise as organizations fail to manage secure data properly, leading to major penalties. Losing intellectual property can ruin not only competitive advantage, but overall reputation.

Though Shadow Data can be created rather easily, steps to mitigate risk can be implemented with just a little additional effort:

• Start by implementing policies that define where data can and cannot be stored, discussed, or viewed.
• Educate all employees on the importance of following those established procedures when handling sensitive information.
• Create limitations on who can access important information.
• Incorporate multifactor authentication measures for all users attempting to log in.
• Conduct regular audits on all storage locations and remain in compliance with security policies.

With more and more moving digital, understanding the significance of Shadow Data is essential. As we hurdle towards technological dependency, the risks of online attacks increase. Simply being aware of those risks and taking proactive steps to prevent them can be enough to protect an organization from financial loss, operational disruptions, or reputational damage. There are quite a few dangers lurking out there in the dark, don’t let Shadow Data be one of them.