Which of the following BEST reflects the risk of a ‘shadow IT" function?

Shared Assessments CTPRP Question Answer

“Shadow IT" functions often fail to detect unauthorized use of information assets

“Shadow IT" functions often lack governance and security oversight

inability to prevent "shadow IT’ functions from using unauthorized software solutions

Failure to implement strong security controls because IT is executed remotely

Explanation:

Shadow IT refers to the use of IT systems, services, or devices that are not authorized, approved, or supported by the official IT department. Shadow IT can pose significant risks to an organization’s data security, compliance, performance, and reputation. One of the main risks of shadow IT is that it often lacks governance and security oversight. This means that the shadow IT functions may not follow the established policies, standards, and best practices for IT management, such as data protection, access control, encryption, backup, patching, auditing, and reporting. This can expose the organization to various threats, such as data breaches, cyberattacks, malware infections, legal liabilities, regulatory fines, and reputational damage. Additionally, shadow IT can create operational inefficiencies, compatibility issues, duplication of efforts, and increased costs for the organization.

According to the web search results from the search_web tool, shadow IT is a common and growing phenomenon in many organizations, especially with the proliferation of cloud-based services and applications. Some of the articles suggest the following best practices for managing and mitigating shadow IT risks123:

Performing SaaS assessments to proactively detect shadow IT

Prioritizing user experience (UX) and providing support for integrating tools

Streamlining user account and identity management

Using operating systems and devices with which employees are comfortable

Compromising and collaborating with users to minimize shadow IT risks

Educating and training users on the security risks and consequences of shadow IT

Establishing clear policies and guidelines for IT procurement and usage

Creating a culture of trust and transparency between IT and business units

Therefore, the verified answer to the question is B. “Shadow IT" functions often lack governance and security oversight.

References:

Shadow IT Explained: Risks & Opportunities - BMC Software

Start reducing your organization’s Shadow IT risk in 3 steps