Part of the Network security glossary:

A shadow app is a software program that is not supported by an employee's information technology (IT) department.

In the past, shadow apps were often installed locally by impatient employees who wanted immediate access to software without going through normal corporate channels. With the growth of software-as-a-service (SaaS) and cloud computing, however, the meaning has expanded to include third-party consumer software that is accessed over the Internet.

Skype, Lucidchart, Dropbox, Google Spreadsheets, Docusign and CloudOn are all popular shadow apps. Although many shadow apps can improve productivity and collaboration with little or no financial cost to the company, their use comes with risks. If an employee accesses a cloud app with his personal account, for example, corporate data may be put at risk or even lost if the employee leaves the company. Shadow apps can also cause bandwidth issues on the corporate network, slowing things down and impacting everyone's productivity.

To prevent problems, an IT department should have a service audit process in place to inspect outbound packets and verify ownership of company-owned services in the cloud. The organization should also have policy in place that requires employees to use corporate accounts for web-based applications and restrict network privileges so end users cannot install software locally. If a large group of employees is using a particular cloud app, the IT department should consider providing the service in house and finally, the IT department should educate employees about the value of corporate data and the risks that shadow apps present.

See also: shadow IT, rogue IT

This was last updated in August 2014
Contributor(s): Matthew Haughn
Posted by: Margaret Rouse

Related Terms

Definitions

  • Pretty Good Privacy (PGP)

    - Pretty Good Privacy or PGP is a popular program used to encrypt and decrypt email over the Internet, as well as authenticate messages with digital signatures and encrypted stored files. (SearchSecurity.com)

  • confidentiality, integrity, and availability (CIA triad)

    - Confidentiality, integrity, and availability, known as the CIA triad, is a model designed to guide information security practices and policies within an organization. Elements of the CIA triad are ... (WhatIs.com)

  • encryption

    - Encryption is the conversion of electronic data into another form, called ciphertext, which cannot be easily understood by anyone except authorized parties. (SearchSecurity.com)

Glossaries

  • Network security

    - Terms related to network security, including definitions about intrusion prevention and words and phrases about VPNs and firewalls.

  • Internet applications

    - This WhatIs.com glossary contains terms related to Internet applications, including definitions about Software as a Service (SaaS) delivery models and words and phrases about web sites, e-commerce ...

Ask a Question About shadow appPowered by ITKnowledgeExchange.com

Get answers from your peers on your most technical challenges

Tech TalkComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.