The importance of online privacy

September 2, 2020 by Leave a Comment

Online privacy is a topic that is often misunderstood. Many people believe that since they are not involved in doing anything wrong that there is nothing to hide and therefore online privacy is not an important issue. However, online privacy is more about service providers profiling you, including your likes, dislikes, habits, beliefs and beyond, so that you can be the target of advertising, misinformation, and beyond. Ultimately, service providers you have trusted use your information to generate revenue. Who knows where it all goes from here and perhaps one day that profile intersects with insurance companies, healthcare providers, employers, and government if it hasn’t already.

Everywhere you travel, every move you make, the nuance of your writing, emails, phone conversations, essentially everything you do, is being logged and analyzed through artificial intelligence with the aim of monetizing the information. We are all subjected to a conglomerate of big tech company experiments. While corporate attorneys may have written language in their terms of use agreements for the applications or services we use, explaining how your information may be used, most of us never bother to read or consider the impacts of misuse.

We are barraged by privacy statements with many sites now asking you to accept their use of cookies and privacy policies.  Here is one of note:

“YouTube Privacy Warning”

“YouTube (owned by Google) does not let you watch videos anonymously. As such, watching videos here will be tracked by YouTube/Google.”

Have you ever turned off location services for Apple Maps 0n your iPhone only to have it tell you later that your car is parked 150 feet away? Did you know that Alexa has features that allow it to listen and record private conversations and forward them on to contacts? Do you know when Alexa is listening or any other “smart” devices? Have you ever had Siri speak to you when you weren’t talking to her? The point is we don’t know how a lot of the technology works and what happens with the associated data. Have we invited devices into our homes and businesses naively thinking they’d help without considering adverse consequences? How often do you see advertisements for products that you were viewing online elsewhere being presented to you as an advertisement on social media or another website?

Big tech is doing its best to monetize your private information by either directly targeting you with adds, or through the sale of your private information to other data mining companies. Google now buys credit card data so they can better understand your purchasing habits to better target adds and know when you bought an item after an advertisement was presented. Online marketing campaign metrics have become very precise.

So still, why care about privacy? The Cambridge Analytica scandal speaks for itself where a vast amount of personal information was provided by Facebook and shared with Cambridge Analytica who exploited the information for political purposes during 2016, targeting profiled potential voters with disinformation in attempt to get them to vote a particular way. This was business as usual for Cambridge Analytica who had been helping politicos win elections throughout the world with its tactics. Weaponizing personal information is clearly crossing the line.

The free services model being provided by companies like Google and Facebook are at the heart of the problem where services like email and social platforms are provided in exchange for users personal information being collected, analyzed and eventually monetized. Unfortunately our representatives are underwhelming in there knowledge of and response to the problem. This was demonstrated during a 2018 US Senate hearing where senators asked questions of Facebook’s CEO such as how do you make money. Between lobbyist and uninformed representatives we have little hope in solving the core issues in the near term.

So how can you begin to protect yourself? 

  • For starters take care in how you utilize online platforms such as Facebook and other social media applications. The questionnaires that your network routinely share that seem harmless are utilized to directly profile you and may be later used against you in the form of advertising and disinformation campaigns.
  • Use Internet Security Software that blocks website tracking by web analytics, ad agencies, behavior trackers and social networks.
  • Consider utilizing VPN services that can enable you to browse anonymously and encrypt your data end to end, so that your activity is not tracked by your Internet Service Provider nor intercepted by prying eyes.
  • Utilize web browsers, email platforms, search engines and internet security software, or services who have stated missions to support your privacy.
  • Some names that come to mind are Mozilla, Proton, DuckDuckGo, among others.

Network Management Solutions has been helping business navigate technology challenges since 1996. Please contact us for a free, confidential assessment. We can be reached at 908-232-0100 or on the web at www.nmscorp.com

Filed Under: News Tagged With: , ,

The Value of Independent Oversight

April 3, 2019 by Leave a Comment

The other day I was working in my shop. I mistakenly placed an expensive tool in a precarious spot and as circumstance would have it, the tool fell and was damaged. I was of course upset but it was my fault and I own the mistake. I was focused on the task at hand and not paying attention to details. Well, when I checked for a new part to repair the tool and found it was more than half the cost of the original tool, I was even more regretful. It was a hefty price to pay and an expensive lesson learned.

I identified the supplier for the part, a well known company, and begrudgingly placed the order. The quicker I ordered the part the sooner I’d get over the sting of my hurried mistake. Ordering the part was easy and my credit card was charged immediately. I waited for an email to relay the shipping details, one day, three days, one week passed before I finally decided to call the supplier for an update.

Upon calling the supplier the phone was answered within a matter of minutes and the support person pleasant. I was advised that the part had yet to ship because the company warehouse was 6 days behind schedule due to a failed IT upgrade. I was assured however that the order would ship within the next week. I was not happy as the payment was processed the day of the order.

I had never dealt with the company prior. It’s likely if I listed their name you would know the brand and perhaps like me, having dealt with them or not had a positive image of the operation. The reviews I read prior to ordering were largely favorable. My opinion however has changed and I know that’s harsh. The reason is that had I been advised before placing the order I would have had an opportunity to consider a different source, or been an informed, understanding customer that waited for the part through the delay. Instead there was no communications prior, and I had to call for the company for the reason of the long delay.

Does this major tool supplier realize the cost of their failed IT upgrade? A six day delay in processing orders is a big deal. What is the cost in terms of revenue, rebates and apologies to big buyers and future sales, but far beyond that the damage to the brand’s reputation? What other companies that depend on the supplier were unable to meet their customer deadlines?

Often organizations large and small don’t consider all the details of a complex or even routine upgrade. Personnel sometimes don’t speak up due to politics or their input is dismissed. Many times companies don’t measure the business impact of failure and hence there is no back out plan to restore service or communicate status with management and other stakeholders. 

At a minimum when undertaking an upgrade consideration needs to be given to items such as, can the current infrastructure support the new requirements; can the in-house personnel support the project; is there sufficient knowledge and planning by the stakeholders to ensure success; and most importantly what are the potential impacts to the company if the project fails? Critical to every project is a back out plan. Should the project fail, how are negative impacts to the company and its customers minimized? Finally if necessary at what point does the company communicate with their customers and what is the specific messaging?

Of course I don’t have the detailed reasons for the disruption. I do however know one thing as do many of the company’s customers and that is they failed. While failure is not uncommon in the complex information technology world, it is largely due a lack of planning and oversight, and when things go wrong negative impacts are magnified. Perhaps if there had been a back out plan to revert to the prior state no one except the company and maybe it’s vendor would have known. Even planning customer messaging would have minimized impacts to the company’s brand and its customers.

Network Management Solutions has been assisting companies since 1996 to design, implement, monitor and mange IT infrastructure. We have helped companies recover from failed projects, security breaches and outages. Contact NMS for a free, confidential, consultation to understand how we may contribute to your business’s success and its good name.


Filed Under: News Tagged With: , , , , ,

Why You Should Care About Information Security As A Small or Mid-Sized Business Owner

December 5, 2018 by Leave a Comment

You’ve seen the news, heard all the hype; Marriott, Chinese State sponsored hacking, DNC email leaks, along with Saks, Lord and Taylor, Panera, Facebook, Under Armour among others becoming victims of data breaches. You’ve probably also seen the TV shows and commercials portraying hackers and their potential targets being defended by some slick cybersecurity group. While it’s dramatic, what does this have to do with you, the small to mid-sized business owner or manager?

Perhaps at first glance little to nothing you would say. Who would want my company’s information, no one will target us you think. Well, while yes the big companies, political organizations, governments, and others are direct targets you may be a target as well, albeit indirect. 

While no named organization, or government entity is going to directly attempt to hack your company you may be the target of smaller groups that crawl the Internet searching for vulnerable anonymous systems. So why do they look to do this especially if you and others truly have nothing to offer you ask? Well, at the very least you have some information as well as servers or other infrastructure that is of value to the perpetrator.

Hackers have differing motives. Some may be in search of sensitive information such as credit card data or personal and private information, others may seek to take control of your systems to anonymously launch hacking operations on others from your systems, while others may look to store stolen information for sale, or host pornography. Many who conduct this type of activity may do so from Internet cafes in far off places with limited chances for prosecution. Many have little means and any payoff from compromising a system is welcome. It’s not glamorous like what you get from TV or the media, not dramatic but the ‘work’ pays off.

So how do they find me?

Hackers use simple scanning tools readily available as freeware and test address ranges, identifying networks that have weak security controls or improperly configured networks. While they may not have specifically targeted your company they may stumble upon your company as its Internet addresses lie within the range of their target scan.  

So what’s next?

When an IP address is found to have technical vulnerabilities the next step by the hacker is to exploit the vulnerability with more free pre-packaged hacking tools and see if they can gain access to your network or systems. With success additional tactics and tools will be employed to poke around inside the network to see what information or hosts may be readily available for compromise.

What’s the payoff?

If they do obtain records of value, such as credit card information they look to sell it to other criminals that will exploit the information.  Values vary but here are some rough numbers.  Credit card information roughly sells for  $5 to $8. Data that includes the number as well as a bank ID number or a date of birth sells for $15. “Fullzinfo” information, which may include details like a cardholder’s full name, address, mother’s maiden name, Social Security number, and other details, can sell for $30. $30 to someone that lives in a far away place may be more money than the average person normally sees in weeks or a month. Beyond that they may disrupt or take control of your system just to show they can.

What’s your potential harm?

The potential for reputational harm or an inability to operate may far exceed the value of any stolen data. You may loose customers, business partners and revenue should your compromise be known or legally need to be reported. Business impacts could be severe if you can’t operate for a period of time.  Beyond that you may find that you are facing lawsuits from customers or business partners.

While I can continue to write the Internet is full of information and articles related to this topic so don’t just take my word for it.  Take a look on your own though some simple Google searches.

We have helped numerous companies recover from hacking, viruses and other security events as well as strengthen defenses against random hacking. Please feel free to contact us at 908-232-0100 for a discreet, confidential discussion as to how Network Management Solutions can be of assistance to you and your company.

Filed Under: News Tagged With: , , , ,

What Applications Are Running In Your Network?

February 18, 2018 by Leave a Comment

Do you know the answer?  While perhaps your company is well equipped and can answer the question, many small to mid-sized companies cannot. If you find that you are among the firms that cannot answer the question you should take an interest in knowing.

Why you ask?  Here are five important reasons:

  1. Financial – Computing and network resources are costly. Resources that are utilized for non-business purposes consume precious resources and cost the company money. Some personal communications may be acceptable but there are limits that certain individuals might take advantage of.
  2. Security – Unauthorized or rouge applications may impact information security. When properly utilized as part of an overall strategy, applications such as Dropbox or Google Drive may be great for your business. However they may also provide a platform for lost data, data leakage, or theft if being utilized without company knowledge or appropriate safeguards. The problem may be further compounded when an employee has resigned and maintains the information stored on Internet devices.
  3. Productivity – It may be within the boundaries of your business policies to allow employees to use Facebook, Twitter, personal email, and surf the web within certain timeframes. Without being able to measure usage you may have undesired activity that negatively impacts productivity, is detrimental to the business culture, and or potentially creates a hostile work environment
  4. Piracy – Software piracy not only affects the developer but also the company that installs the software. An IDC study found that 37 percent of midsized companies that participated in software audits had pirated software within their environment. While there are obvious impacts to the developer with lost revenue and potential dissatisfaction of those using pirated software, many times pirated software contains vulnerabilities including viruses, worms and Trojans. Employee devices containing pirated software that are used within the business environment can contribute to compromise of  the company network.
  5. Reputation – With all of the online media your business reputation can suffer serious harm. Social media can help spread news around the globe in a matter of moments. With companies searching online for the products or services your company offers having bad things show up in search engines can directly impact your bottom line. News of a breach, low employee morale, or piracy can seriously damage the business reputation.

Engaging a consulting company that can perform regular audits of your business infrastructure or managed service providers that can monitor activity in real-time can be a cost effective solution to the problem.

Network Management Solutions has been providing pragmatic solutions for business since 1996. For more information please contact us.

Filed Under: News, Operations Management Tagged With: , , , , , ,

Security Risks Imposed By The Use Of USB Drives

September 15, 2017 by Leave a Comment

Portable flash drives also called thumb drives, USB drives or memory sticks have become commonplace.  They offer high capacity data storage and portability of information between computers easily plugging into USB or FireWire ports.   Flash drives have become novelty giveaways at trade shows containing marketing material or other information the presenter wishes to convey.  USB drives offer convenience but they don’t come without some potential security risks to your business .

So you now can carry around terabytes of data in your pocket, that’s great but it also means you can easily misplace the data stored on the device.  Considering your line of business and what you or your or your employees might store on the drive you may have regulatory issues to address.

While covered entities (organizations that maintain regulated information) need to report lost or stolen computers containing personal and private information such as social security numbers or healthcare information, or other sources of data leakage, the same holds true for portable data storage devices.  Not only do these requirements apply to your business they also apply to any business partner you might engage to work with protected information on your behalf.

Earlier this year a small Massachusetts physician practice was fined $150,000 after the theft of an unencrypted USB flash drive containing the medical records of 2200 patients from an employee vehicle.  The fine was levied principally due to the failure of the organization to have conducted a risk assessment in using flash drives and putting in place proper data handling and notification procedures.

Hackers write custom viruses that target USB drives as the threat is easily ported between computers by simply plugging the device into its USB port.  Making certain that anti-virus software is up to date and that flash drives are scanned when plugged into a computer is essential to blocking such threats.  Some organizations go so far as to turn off the USB ports on their computers to stop viruses from being imported via employee USB memory sticks.

So what should an organization do to protect itself?  Here are some recommendations:

  • Consider if USB or other portable drives should be utilized within the business.
  • If so, is this a necessity or more of a convenience and are there other ways to produce the same outcome?
  • Consider what data is permissible to be stored on flash drives and who within the organization may do so.
  • Develop policies and procedures that cover acceptable use, storage, handling and notification procedures should a drive come up missing.  Share these documents within the organization and hold your employees responsible for following them.
  • Encrypt sensitive data stored to memory sticks.  The best encryption is hardware based and not all memory sticks are the same.  You can get more information here on the best devices.
  • Password protect thumb drives and consider using tamper proof devices that can overwrite the contents if a maximum number of password attempts is reached or the device case is tampered with.
  • Maintain all computer based antivirus software and scan all thumb drives as they are inserted into computers.
  • If you must use USB drives store them in a safe place where they will not be lost or stolen.
  • Do not allow personal USB drives, or company data to be stored or accessed on personal use machines.  If your employees work from home provide a business computer that is secured and maintained by the business.

Network Management Solutions has been providing pragmatic solutions for business since 1996.  For more information please contact us.

Filed Under: News Tagged With: , , , ,

Small Business A Prime Data Breach Candidate

June 14, 2017 by Leave a Comment

Has the news reached your computer?  Small business is a prime candidate for hackers looking to capitalize on an unprepared target.  What do I have to loose you might think, but think again.  You may have financial assets, bank accounts, intellectual property, credit cards, protected personal information, or even your business reputation at risk.

While you may believe that none of this matters, the turmoil created by a breach is a nightmare to remediate taking months or longer to recover from.  Some incidents carry on undetected for years and end in court cases with the compromised business as a defendant fighting lawsuits and regulatory fines. Not withstanding the legal challenges you may find your business suffering from reputational harm or an inability to recover funds from a financial hack.

When business magazines such as Forbes and Inc. are writing about small business being targets you know things have reached a tipping point.  For further information check out the list of identified firms compromised so far this year at the Identify Theft Resource Center.

So why is small business a prime candidate for data breaches, the answer is simple.  Small businesses typically have weak information security programs.  The technology deployments are limited and improperly configured; management and employees are not security aware; the ability to detect most compromises early on is non-existent; and the business is information and asset rich to a would be attacker.  Business owners compound the problems being technology averse, believing that it’s all too complex and all too costly to manage.  So the task gets delegated, underfunded, or left to chance, none of which are viable in the long term.

Pragmatic solutions are available that won’t disrupt business operations or strain company budgets.  Employees and management can become better stewards and learn simple security best practices and the reasoning behind them.  A robust program integrates technology, business practices, operational procedures and point insurance products.  A well-crafted security program protects the business from financial, reputational, legal and regulatory issues.  Integrated within the business operation the security program is generally simple to maintain and effective in its objectives.

Ensuring that you engage the appropriate resources, as part of your security strategy is key.  Most small companies don’t have the internal resources to commit to develop and maintain the security program and hiring such resources can be costly.  Utilizing a managed service provider is an excellent cost affective approach to identify business requirements, develop solutions and maintain the program ongoing.

About Network Management Solutions

Network Management Solutions (NMS) has been helping companies address their business and technology issues since 1996.  We are currently serving a variety of customers within New Jersey, New York, and the surrounding metro areas of New York and Philadelphia.

Please contact NMS to schedule a no obligation, consultation to discuss your concerns.  We will provide expert advice in simple business terms on how to best meet your business needs.  NMS can be reached by phone or email at 908-232-0100 or info@nmscorp.com.  More information on Network Management Solutions can be found at www.nmscorp.com.

Filed Under: News Tagged With: , , , , , ,

Facing The Realities Of A Data Breach

December 21, 2016 by Leave a Comment

Most small to mid-sized business don’t consider themselves to be a data breach target and therefore never develop an incident response plan.  Having to respond to a data breach in real time without a plan can be challenging at best.  Some would call it a nightmare.

Your obligations and approach can vary widely depending on your business and the type of information you maintain.  Has data been destroyed or deleted, have passwords and accounts been compromised, have financial accounts been accessed and funds diverted, or has a database containing credit card or other sensitive information been inappropriately accessed?  How do you know?  A plan helps you to sort out the questions and set a direction to meet your business obligations and move systematically towards recovery.

How did you become aware?  Did an external source notify you such as your bank or law enforcement?  Do you believe that the incident was triggered by an internal or external event, was it intentional?  Often errors by internal staff can create an exposure of sensitive information that is then utilized by an outside source or it can be a calculated collaborative effort between the two.  An external hack may be the result of a targeted effort or weakness that is exploited through non-solicited emails, or a web or application interface.  Regardless of what has happened and how it happened still requires action.

So what are the steps to recovery and whom do you notify? A general approach might be as follows:

Build A Team: Form a team that will be tasked with specific events addressing legal, information security, management, public relations and other concerns.

Discuss Events and Develop Approach: Identifying timelines and events leading up to the incident can be key in establishing a direction and approach for remediating and investigating the breach.

Discuss Legal and Public Relations Requirements: Understanding your business obligations is critical as this will determine what steps you must take to address any legal or regulatory concerns.  Effective public relations will help preserve your business name.

Engage Appropriate Resources: This may include your financial institution, law enforcement, incident response resources, legal counsel, among others.

Commence Data Collection and Analysis:  Collection of computer data, log records and other digital forensic evidence is key to any investigation.  Professionals are required to ensure proper protocol and preservation of evidence. Many untrained computer personnel destroy evidence or miss the breach source so the compromise continues.

Address Legal and Regulatory Requirements: Based on your analysis you may be legally obligated to notify regulatory bodies and affected entities.  Timely response is of great importance. Your business partners may need to be engaged.

Notify Affected Parties: Those affected by the breach may need to be notified by law and the protocol may vary state to state.  This includes individuals that may have had credit card information, or personal and private information exposed.  Others such as business partners may need to know to ensure that they too are not affected.

Assuming that law enforcement will investigate is highly unlikely.  Unless your compromise a matter of national concern or has a multi million-dollar impact or you can pinpoint insiders there is little aw enforcement will do.  You will need to manage the investigation largely on your own.

Maintaining a robust information security program will greatly reduce the likelihood and severity of a data breach.  Having an incident response plan will provide the roadmap to address a data breach in a timely and concise manner protecting both your business and its reputation.

Please contact Network Management Solutions for more information.  We can be reached at 908-232-0100 or info@nmscorp.com.  Our website can be reached at www.nmscorp.com.

Filed Under: News Tagged With: , , , ,

A Critical Need for Strong Information Security Practices

June 24, 2016 by Leave a Comment

Who is responsible for your information security practices and why?  If you are the business owner, CEO, or other key executive have you discussed with the individual or organization what your information security goals are?  I am not talking about a technical discussion but rather a discussion in business terms.  Are there defined security standards to which the organization adheres?  Is information security become part of the business culture?

Too many business leaders don’t find a discussion necessary and assume that their input is not necessary or the conversation too painful to manage.  Having spent a career dealing with information technology and security personnel I can relate.  However when your input is not part of the conversation don’t assume that anything is secure.  Don’t believe what your “expert” tells you unless its been verified.

Now perhaps you are a large organization and as the CEO you are too busy to deal with the techies.  Your CIO or CISO are boring and you believe you’d be more productive painting your dog’s nails.  Well there is a long list of CEO’s and board members that might wish they were more involved.  The Target Corp and Neiman Marcus are more of the same.

Hackers are sophisticated and operate in ways most organizations don’t understand.  Their probing, testing and theft happens over long periods of time.  It’s not like a theft at a storefront or bank.  Hackers rely on being stealth and their activities can last months or even years.  They are operating within your company walls from far off places on the other side of the world and your security operations staff has no idea this is occurring.

Most organizations find out about their compromise from law enforcement as they investigate criminal activity on a global scale.  However it’s still your problem. Unless your hack is a matter of national security the amount of cooperation you receive from the FBI or USSS will be negligible and may be non-existent.  Its not that they don’t want to help but these agencies are focused on national security and money supply and their resources are stretched.

So you’re a small business and you believe that you are off the grid, out of the loop.  Well that is not the case.  Depending on how events are tracked and who is reporting statics show that about one-third of all attacks involve small business

and sometimes these “attacks” come from inside the organization.  That may be shocking to a small business owner but small business is easy prey.  As a small business owner you should be asking all the right questions since your banking accounts, operation, customer information and reputation are at risk.

Often the hacker can penetrate a small organization because the architecture is flawed, devices are not properly maintained, patches are not applied, and no one is being held accountable.  As a small business owner you must be involved and must be asking the right questions.

Network Management Solutions has been helping companies address business driven technology issues since 1996.  We are currently serving a variety of customers within New Jersey, New York, and the surrounding metro areas of New York and Philadelphia.

Please contact NMS to schedule a free one-hour no obligation consultation to discuss your concerns.  We will provide expert advice in simple business terms on how to best address your issues through NMS or another provider.  NMS can be reached by phone or email at 908-232-0100 or info@nmscorp.com.  More information on Network Management Solutions can be found at www.nmscorp.com.

Filed Under: News Tagged With: , , , , ,

Remote Access Risks – Protecting your data outside of the office

June 25, 2015 by Leave a Comment

Internet cafes, hotel rooms and airports can all be convenient places to catch up with work tasks. But how safe is your data when you access your office systems, email or financial accounts from a public place?  Well, in the age of tablets, laptops, and smart phones, the answer is complex—however, knowing these few facts can help keep your data safe.

Just like home burglary, Internet theft is most often conducted by opportunists. Online thieves are on the prowl for passwords and other information that can give them direct access to your confidential information, as well as your money!

Be your own security guard by following these three steps when you connect publicly with your laptop, tablet or phone:

1.) Check that the network requires a password and shows a lock icon next to its name, indicating it utilizes encryption. Without this, others can easily steal what you send and receive.  Alternately, if you do connect to an unencrypted network, make sure the accounts you access have encrypted login (authentication), and encrypt any sensitive data that you might exchange (the web address will start with https).

2.) Confirm that you have the latest security updates installed for your computer’s operating system, as well as for any applications. Cyber-criminals are clever, and OS and app updates help counter their latest tricks.

3.) Always utilize a system firewall or similar application, PLUS a full-featured Internet security software suite that includes traffic filtering, intrusion prevention, and anti-virus capabilities.  This will not only protect you in public places, but at home or in the office as well.

Besides policing your own devices, it’s also wise to be very wary of computers that are offered as a customer service in hotels, lounges, libraries and Internet cafes.  You put yourself at risk whenever you use these machines to access sensitive accounts or information, including email, because the browser cache could be configured to store your login credentials. You can’t know that an open-access machine doesn’t have malicious software installed to burgle passwords and information, so sit down at any public computer with extreme caution!

Finally, a special word of advice to business owners since employees now commonly work out of the office on a variety of personal use devices … Take the time to get assurance that remote access to your systems and data is properly configured to provide optimal security. Workplace servers that are left open to the Internet are easily compromised, with potentially disastrous results. Consult with professionals to minimize your system vulnerabilities and invest in mounting your best defense to protect your valuable information and financial assets.

Network Management Solutions is a proven service provider that enhances the security, manageability of IT systems for small businesses, while reducing costs.

For more information about our range of services, and helpful tools for evaluating your IT security, visit us at www.nmscorp.com

Filed Under: News Tagged With: , , , , ,

Are Shadow Cloud Services In Use Within Your Business?

March 4, 2015 by Leave a Comment

Shadow Cloud Services are unsanctioned networks and services that are subscribed to by individuals and business groups without the involvement or knowledge of Information Technology, Security, Compliance Groups, or others.  These services can pose serious risks to the business including data leakage, data integrity, business continuity, and regulatory compliance issues. This is a formidable exposure for both the small business owner and the larger enterprise.

The ability for an individual or group to procure services for collaboration or individual use at a low cost price point makes it an attractive way for some to bypass IT and do things “on their own”.  Services that fall under this can include collaboration software, remote storage, customer relationship and human resources applications.

There may be considerable financial implications in larger enterprises due to duplication of services.  However, there are business risks that can far outweigh operating costs, including loss of intellectual property and trade secrets, regulated data exposures and the breach of rules pertaining to data handling, along with business continuity problems.  For the small business owner a rogue employee(s) utilizing personal cloud storage could lead to serious issues.

In a survey, conducted by Frost and Sullivan, of 300 IT employees and 300 business unit managers 80% of respondents reported using SaaS (Software as a Service) applications that were not approved by IT.  This is the equivalent of business units running non-sanctioned manufacturing facilities, offices, or lines of business.

Skyhigh Networks recently conducted a study of 200,000 public sector employees with various organizations in the U.S. and Canada.  The study found that the use of shadow cloud services was on average 10 times greater than the applications that IT was running within these government organizations.  A copy of the report can be downloaded here.  This is a serious issue that must be addressed if the government is to protect our personal information and control costs.

The ability to identify unsanctioned or rogue usage can be a complex issue to solve for most organizations large and small.  The outcome however can be well worth the effort and potentially avert serious issues.

About Network Management Solutions

Network Management Solutions (NMS) has been helping companies address their business and technology issues since 1996.  We are currently serving a variety of customers within New Jersey, New York, and the surrounding metro areas of New York and Philadelphia. For more information please contact us.

Filed Under: Uncategorized Tagged With: , , , ,
Next Page »