Operations

5/16/2017
07:00 AM
50%
50%

Majority of CEOs Knowingly Raise Risk Level With Their Shadow IT

Despite the increased risk shadow IT poses to security, a majority of CEOs surveyed say they are willing to take the risk, according to a survey released today.

A majority of CEOs are willing to put their organizations at risk by using shadow IT, even though they are well aware of the potential security fallout, according to a report released today by Code42, a cloud-based security company.

The survey of 1,205 IT and business decision makers revealed 75% of CEOs surveyed acknowledge using applications and programs not sanctioned by their IT departments, despite 91% of surveyed CEOs acknowledging this behavior could put their organization at a security risk, the study found.

When the top dog behaves in such a cavalier fashion, it can potentially set the tone for the entire organization, says Rick Orloff, chief security officer for Code42.

If employees see the CEO doing their own thing, it gives them a sense of entitlement and contributes to the friction with the security team and employees feel they don't have to comply with policies and best practices, Orloff says.

He added there is also an additional impact to the company.

"When CEOs behave this way, then the CISO is not reporting high enough into the organization. CISOs should ideally report into the CEO and not the CIO," says Orloff. "I bring this up because when the CISO reports directly into the CIO, there is an air gap between the CISO and senior leadership. When you remove the air gap, then you don't have the shadow IT."

Without the air gap, a CISO can work with the CEO to find the tools needed to do the job using existing authorized technology, or bring in the right secure tool onto the platform, Orloff explains.

Source: Code42
Source: Code42

Driving this behavior to use shadow IT is a desire by CEOs and other company executives to put convenience and productivity ahead of security, the study found. This long-held mantra of productivity over security is nothing new when it comes to rank-and-file workers, but for top-level management to knowingly disregard best security practices is somewhat surprising, considering that they recognize there is a risk, and that these executives themselves are increasingly held accountable for security breaches.

Although 83% of surveyed business decision makers are well-aware of the security risks that their actions pose when using shadow IT, they are nonetheless willing to take such action under these circumstances. According to the survey, respondents would:

  • Use an unapproved application or program if it would improve their productivity (65%)
  • Use shadow IT if it would make their lives easier (52%)
  • Use it because the IT department does not understand what is needed to get a job done (27%)

But the figures that surprised Orloff the most were the percentage of CEOs who knew use of shadow IT was a security risk. "I expected it to be around 35% and 40%," he says, versus the 75% and 91% figures in the survey.

The survey also found that business executives tend to be more concerned than IT security executives that a major data breach will happen in the near future. For example, while roughly half of business decision-makers and also IT leaders say they encountered a security breach in the past 18 months, of those who have not, 88% of company executives versus 50% of IT decision makers expect a breach to go public in the next 12 months, the study found.

Business decision makers expecting a public breach within the next 12 months may have more heightened concern than their IT department because they have heard about the sizable breaches hammering companies over the past 18 months and do not understand their own company's security footprint, says Orloff.

Although business executives and IT professionals have a gap when estimating the next breach, their differences are narrower when it comes to the likelihood their companies would face serious repercussions if they lost all their corporate data held on endpoint devices. The survey found that 90% of IT and business executives believe it could be serious to potentially fatal for their organizations, with 88% of IT executives and 83% of business decision makers finding their companies need to shore up their breach recovery abilities in the next year.

Related Stories:

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I'm not sure I like this top down management approach!"
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17358
PUBLISHED: 2018-09-23
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in _bfd_stab_section_find_nearest_line in syms.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a ...
CVE-2018-17359
PUBLISHED: 2018-09-23
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in bfd_zalloc in opncls.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file.
CVE-2018-17360
PUBLISHED: 2018-09-23
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executa...
CVE-2018-17361
PUBLISHED: 2018-09-23
Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php because $_SERVER['PHP_SELF'] is mishandled.
CVE-2018-17364
PUBLISHED: 2018-09-23
OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter.