News for hackers. Stuff that matters.

A comment on Show HN: Shadow IT Scan – Uncover SaaS Apps, Users and Risky OAuth Scopes. Parent comment

Re:Show HN: Shadow IT Scan – Uncover SaaS Apps, Users and Ri... by PhLR on Thursday August 01, 2024 @01:46AM (#41126482)
The biggest challenge is that there's an abundance of SaaS tools that are free to use or have extensive free trials. This often lures employee's in "just trying" a platform and ending up importing critical company data.

Slack and Loom are great examples of SaaS that profited from being "Shadow IT". They gained traction by employee's quickly self-onboarding onto the free-plan, without their IT or Security knowing what data is being shared.

[ Parent | on HN ]
Re:Show HN: Shadow IT Scan – Uncover SaaS Apps, Users and Ri... by thanksgiving on Thursday August 01, 2024 @01:58AM (#41126529)
If you block marketing from using the tools they want, they will do it anyway but using personal email addresses like Gmail or something like that especially with the generous free tiers.
[ Parent | on HN ]
Re:Show HN: Shadow IT Scan – Uncover SaaS Apps, Users and Ri... by mathiasn on Thursday August 01, 2024 @02:56AM (#41126761)
Which makes it even worse because you cannot detect that then :/

Shouldn't people just be able to try out new things? How can a company be innovative otherwise? And at a specific point (e.g. putting customer data into it), they need to start a proper vendor assessment process.

[ Parent | on HN ]
Re:Show HN: Shadow IT Scan – Uncover SaaS Apps, Users and Ri... by NoPicklez on Thursday August 01, 2024 @08:10PM (#41134958)
People can absolutely try new things, but time and time again you cannot trust people to not put sensitive data into those platforms and they continually do.

It's always a balance of information security awareness, culture and technological solutions within an organisation.

[ Parent | on HN ]
Re:Show HN: Shadow IT Scan – Uncover SaaS Apps, Users and Ri... by PhLR on Thursday August 01, 2024 @02:17AM (#41126594)
100%. Instead keep track of where they sign up with their business email and explain why they can't use those tools.
[ Parent | on HN ]