Segurança cibernética: shadow IT e suas implicações nas organizações

Abstract

The growth of information and communications technologies (ICT) has brought dynamism to the execution of processes and speed to the exchange of information, thereby increasing productivity in the business sector. Despite its benefits, its growth is also accompanied by an increase in cyber-attacks. Post that, ICTs must be implemented under the management of IT managers to guarantee cyber security and reduce the likelihood of cyber-attacks. The use of ICTs without the knowledge and support of those responsible for IT is known as Shadow IT and most of the time happens without any intention of damaging information security, but it can constitute risks to information security and can result in high costs for the organization and irreparable damage. This report sought to propose mitigation measures for Shadow IT risks, using a risk assessment based on the ISO/IEC 27001 standard, which is the main standard for information security. To perform this, we used surveys of the organization's users and an interview with the organization's IT manager, supported by a literature review. The main results of the survey and interview showed that the users of the grupo Meridian 32 have already used an application, device or service without the consent of IT in order to carry out an organizational task and the results of the risk assessment showed that there are risks in the use of Shadow IT for the grupo Meridian 32. Mitigation measures were presented for the risks identified, once again based on the ISO/IEC 27001 information security standard. In addition to the measures presented, it was recommended that policies and a training/awareness program on information security be implemented