CIS 500 Week 1 Discussion: Shadow IT for Business Operations

CIS 500 Shadow IT for Business Operations

Organizations do not always provide information systems that allow their staff to perform their responsibilities efficiently and effectively. Read the article,“Lifting the Veil Off Shadow IT.” Then, respond to the following:

Take a position favoring or opposing shadow IT.

If you are in favor, give one reason that shadow IT should be allowed. If you are not in favor, provide one way that the organization can reduce the risks of shadow IT.

What is the best way an IT department can meet users’ technology needs without additional cost or risk to the organization? Justify your answer by responding to another student’s post that differs from your answer. Explain why your idea is preferable.

Do not repeat suggestions from the article or that have been posted by another student.

Sorry, I’m not shadow  IT person but here are the four key risks of shadow IT. SAM compliance: Software asset management (SAM) is a big enough challenge when IT has decent processes for managing the procurement of software licenses. When licenses are procured outside of that process, without IT knowledge, SAM is not possible and the organization is exposed to unnecessary risk. Discovery of unapproved software could mandate a complete audit of the infrastructure, along with the associated financial and resourcing costs to ensure compliance. The ultimate sanction against unlicensed software for the CIO is jail and/or an unlimited fine.

Governance and standards: Organisations invest heavily to ensure they comply with regulations imposed by government and industry. In addition, organizations adopt standards such as ISO/IEC 20000 to demonstrate quality to their customers. Investing time and resources to document systems, process flow, and business models is wasted effort if documentation doesn’t reflect reality.

Lack of testing and change control: When new devices or applications appear within the corporate infrastructure without guidance from corporate IT, the change and release management processes are bypassed and impact on other aspects of the infrastructure are not considered. One of the main drivers for deploying software as a service (SaaS) is that the vendor takes ownership of the upgrade and release process, so SaaS customers are always on the latest version. However, upgrades can and do break systems. Managing the cycle of change, testing and release are taxing enough, but a new layer of complexity is introduced when third parties need to be included in the process.

Configuration management: IT groups may have spent months or even years populating a configuration management database (CMDB) and defining relationships between systems. If users go outside official channels, key services or systems may not be added or supported because IT is unaware.

References:http://www.computerweekly.com/opinion/Managing-shadow-IT