By Martin Fincham, CEO – LANSA

A common misapprehension in the financial services sector is that its tight regulatory infrastructure prohibits Shadow IT activity.Shadow IT is any unofficial application development project that is commissioned, introduced or executed outside the IT department’s formal control or plan. However, in reality, there are numerous areas in this market where the practice frequently occurs and threatens the governance, compliance and risk management provided by the organisation’s official IT function.

Why does Shadow IT creep in?

Shadow IT happens for a reason. Many IT departments simply cannot cope with the demands from line of business managers for the applications they need.Typically, this is because IT departments are already under pressure delivering major mobile or web applications, integration projects, getting cloud-ready or driving other pressing digital transformation initiatives.  In parallel, a significant percentage of their time is spent on the maintenance and support of enterprise apps. When it comes to developing new apps, Corporate IT usually has a 2-3 yr road map which is constraining a sector that is starting to feel the heat from new entrants such as Lemonade in the financial planning services space, which is making many more established players sit up and consider their own ability to respond.  Line of business managers need to be as agile as new entrants, which is challenging when they have legacy systems to maintain.  Inevitably,demand for new and innovative applications accumulates and Shadow IT is often the response of line of business managers as a means of ‘getting the job done’.

Line mangers, puzzled at the month or year long wait presented by IT to their demands, do what they believe is right for their own area of the business. In effect, they fill in the gaps for themselves. Typically, the skill level in Excel and other business tools is high, so business users are used to building solutions of their own.  However, whilst this may meet their short-term requirements, the Shadow ‘rebels’ don’t always appreciate the considerable risks or complexity involved, or the Pandora’s box they may be opening.

Proliferation of Data Silos

Getting a single view of the truth is a major thrust in Financial IT.  Just as IT pulls in the direction of integration in order to enable that single view, so Shadow IT can pull in the opposite direction, setting up new silos for their individual projects, using data which cannot be leveraged by the rest of the business.

The Dangers

The dangers of such proliferation are very real. Unchecked, Shadow IT can pose myriad risks.  Application usage can spread to greater numbers of users than intended, and performance can be crippled. In addition, data usage by Shadow IT apps can violate privacy laws and sensitive data can be leaked through embarrassing security breaches. Of particular relevance to the banking and financial services sector is the imminent arrival of GDPR compliance rules. Shadow IT systems pose a risk to such compliance as the projects have no governance or guidance over them.

Who’s working in the shadows?

The sources of such unofficial systems vary. Shadow developers, also known as ‘Citizen’ or ‘Stealth’ Developers, can range from creative and technically aware internal marketing staff exploring exciting cloud apps, through to external ‘offshore’ development teams keen to get a foot hold in or reference check from a respected financial services organisation through a friendly contact.

Discovery

From humble financial and management analysis systems through to highly sophisticated marketing and sales apps, the ‘outing’ of Shadow IT applications is often unexpected.

An executive might want to manipulate or represent their data in different ways. To achieve this, they download data from core systems, for example an asset management application, add macros and then run their own reports.These shared tools may include errors, and the misinformation proliferates. At some point, the error is discovered and IT is drawn in to fix it. The IT Department was most likely unaware that the application existed but are charged with fixing it regardless.In an attempt to control this activity,IT may allow circulation of files as PDFs only, but this in itself can be restrictive for business management.

In the insurance market, actuaries often create and use extremely complex spreadsheets to create precision pricing dependent on risk variables. Effectively, they are building their own complex pricing tools. They may involve hugely complex algorithms to generate pricing and which may be uploaded into corporate price books. The risk to the business in the event of errors being made is significant.  It is unlikely that any extensive testing on these applications takes place.

Another common example occurs in the Marketing department, where shadow IT can proliferate as organisations seek to ‘know their customers’ better. From customer and sales analyses through to unofficial promotional web pages, marketing managers are responsible for organisational creativity and demand ‘competitor beating’ solutions.However,as they struggle to get to the top IT’s priority list, they resort to crafting their own solutions.

Evidence of The Rapid Spread and Growth of Shadow IT

Shadow IT is growing, but not without risk. Gartner estimates that by 2020, one third of successful attacks on enterprises will be through Shadow IT doors.The 2017 Application Architecture, Development and Integration Summit in London highlighted a 2015 Cisco study indicating that companies are using up to 15 times more cloud services to store critical company data than CIOs were aware of or had authorized.  Supporting that claim, an NTT report in April 2016 indicated that 77% of business decision makers admitted to using a third-party cloud application without the approval or knowledge of their own IT department.Identity governance firm SailPoint claims that already over 70% of company employees have access to data that they shouldn’t have.

Outsourcers are acutely aware of this, as many discover unaccounted for servers after contract wins. Financial Services customers provide a detailed list of servers to the outsourcer and bids are submitted and accepted on this basis with only high-level due diligence available.  The real discoveries are made post contract award where additional servers and applications are found.  One outsourced service provider quoted an instance where e.g. 850 servers & 42 line of business internal applications are listed in the outsource RFP, yet 982 servers are discovered & 65 line of business applications exist, all additional servers and applications were shadow IT projects.

Shadow IT ina Low-Code Light

Shadow apps are not, in themselves, a bad thing. Many of these systems fulfill a valid need and play a role in the success and or survival of the organisation. Some IT departments are now openly recognising this and seeking to bring the alleged ‘rebels’ back into the IT fold.

What IT really needsto achieve this, is a technology approach that helps them deliver on these requirements at speed; technology that means that they no longer have to say ‘no’ or ‘yes, but later’ in response to requests from the business. Enabling IT to be agile by using ‘low-code’ rapid application development tools to build apps at high speed, can overcome the bottlenecks. So instead of outlawing Shadow IT ideas, this new approach recognizes and utilizes their creativity. Low-code platforms, such as those offered by LANSA, provide the kind of prototyping capabilities needed to validate business needs, direct with the users, iterate as they formalize their requirements, then speed up the final development way beyond the timescales they have been used to.  The resulting apps are robust, well architected, high performance, and, importantly, managed and easily maintained by IT. Low-Code can be a significant tool in the armoury of IT to keep IT relevant to the business.

Single View of the Truth

Once integrated within the confines of IT,management has a ‘single clear view’ of the entire IT estate, allowing them to utilize and maintain newly developed systems to optimal effect.

Through this approach, the very same IT managers and CIOs that are currently by-passed by ‘Line of Business’ managers are transformed into agile system leaders,able to respond quickly to business demands. They can take back control and re-establish a proper and secure governance infrastructure,through which they can monitor IT with a single integrated view of the truth. Most importantly, through the use of Low-Code development, organisations can now finally banish the spectre of Shadow IT & deliver a much brighter future for internal IT application development.