How Shadow Analytics’ Growing Popularity Is Putting Companies at Risk

Shadow IT emerged in the past decade as a trend in which IT professionals solve technology problems themselves—usually with tools or services that are not vetted, secured or approved. Shadow analytics is an evolution and specialization of this trend—and also a security problem for organizations. Popular tools like Tableau, for example, make it easy for employees to analyze data, but accessing the data requires IT intervention. With shadow analytics, however, business users extract data from controlled sources into spreadsheets and other uncontrolled environments to access data more quickly, without waiting on IT. This eWEEK slide show, based on industry information from Tomer Shiran, CEO and co-founder of Dremio, which makes a new-gen data analytics platform for data scientists, takes an in-depth look at shadow analytics and the challenges it brings to IT.

Shadow analytics is a major risk to the enterprise and a major burden on IT. The solution is not greater limitations on employees’ access to systems and tools. Instead, IT needs to embrace a model where users have self-service access to data using tools that make them more productive while governing their access.

Companies use relational databases, data lakes, cloud services, NoSQL and other technologies to store their data in many formats. Each of these systems presents unique challenges in terms of accessing and analyzing data.

While most companies have data warehouses and data lakes, rarely is all their data located in these environments. In addition, moving data to these systems takes significant time, and so many analysts and data scientists look to the “original” source for data that is fresh.

A decade ago, innovators such as Qlik, Power BI and Tableau transformed business intelligence by introducing tools that allowed analysts to analyze and visualize data without help from IT, ushering in the self-service era. Today, vendors are trying to do the same in almost every area of technology.

Because of the size and complexity of modern data, analysts and data scientists are just as dependent on IT as they were more than 10 years ago. Thus, we’ve taken a step backward in independence from IT.

Analysts and data scientists—not just line-of-business enterprise employees—are now saving data into spreadsheets and cloud storage to avoid the controls and complexity presented by IT.

As data is copied into uncontrolled environments, it is cut off from the centralized controls that IT uses to secure and govern data. For example, an employee who no longer works at a company can continue to access sensitive data that is saved into an Excel spreadsheet in Dropbox.

Unauthorized users seek vulnerabilities in an organization’s infrastructure to gain access to its systems and data. An important strategy in securing sensitive information is to make the attack surface area as small as possible. Shadow analytics, however, significantly increases the attack surface area because data is stored in environments that do not follow the vetted security controls of an organization’s core systems.

Business data is in constant motion, changing quickly to reflect the current state of an organization. Shadow analytics orphans data from these changes, making the data potentially misleading for analysis.

As mentioned earlier, the solution is not greater limitations on employees’ access to systems or tools. Instead, IT needs to embrace a model where users have self-service access to data using tools that make them more productive while governing their access. In short, IT needs to remove the reasons why the business is taking risks to go around them.