www.darknessdreams.net/2007/02/23/users-who-know-too-mu -
[Cached Version]
Published on: 1/1/2007
Last Visited: 9/3/2009
"Employees are looking to enhance their efficiency," says André Gold, director of information security at Continental Airlines.
"People are saying, 'I need this to do my job.'" But for all the reasons listed above, he says, corporate IT usually ends up saying no to what they want or, at best, promising to get to it...eventually.
In the interim, users turn to the shadow IT department.
For many good and not-so-good reasons, the CIO's first instinct frequently is to fight the shadow IT department whenever and wherever he detects it.
...
According to Gold and Israel, getting a reputation for saying yes will encourage users to come to you with ideas.
...
Gold says that most shadow IT projects are attempts to solve simple problems, and it's easy for CIOs to mitigate the risks if they're willing.
For example, Gold found that people were taking files home on thumb drives.
Instead of trying to outlaw the practice, he began distributing thumb drives with encryption software on them.
The users' experience never changed.
"It was common sense to keep both security and how people work in mind," he says.
...
"IT doesn't know everything the business knows," says Gold.
...
"Ninety percent of the applications we have that involve sensitive data are things we've written," Gold explains.
All that data was protected...as long as the user accessed it from the application IT built.
But when a manager tried to compare revenue for different cities by copying the data into Excel (something Gold says happens routinely), the information was suddenly placed at risk.
With this in mind, Gold encouraged the IT department to build encryption and other safeguards directly into the applications.
...
"Controlled chaos is always OK," says Gold.