Shadow IT

Shadow IT is hardware or software within an enterprise that is not supported by the organization's central IT department.

This implies that the organization has not explicitly approved the technology, or it does not know that employees are using it.

Check Point's Approach to Shadow IT in Harmony Email & Collaboration

Based on email analysis (Office 365 and/or Gmail), Harmony Email & Collaboration gives you a direct line of sight into cloud applications in use at your company.

Harmony Email & Collaboration identifies emails from cloud applications to users that suggest they have been using a cloud application. For example, emails containing messages such as "Thank you for registering" or "You have a notification" suggest that a user has been using a cloud application. When such an email is detected in a user's mailbox, a security event is created with the type of Shadow IT.

Harmony Email & Collaboration inspects all licensed users' emails for Shadow IT.

Shadow IT Dashboard and Events

Shadow IT events are listed under Events. SaaS usage can then be visualized in the Shadow IT dashboard visible under Analytics > Shadow IT.

Shadow IT panel and description:

Panel	Description
Most Popular Services	Most popular SaaS applications discovered.
Accounts created over time	SaaS applications usage pattern over time.
Applications by Risk	A breakdown of apps per risk-score. The application risk is given by the Check Point app wiki:
Applications by Category	The categories of apps that are used.
Latest SaaS Usage	The most recent discovered events of app usage.

Shadow IT classifies the severity of events using these terms:

Panel	Description
Low	Events found during historical scan.
Medium	First event for a user.
High	Second or more event for the same user.

These actions can be performed on Shadow IT events:

Panel	Description
Dismiss	Changes the event state to DISMISSED. The event will be removed from the Shadow IT dashboard.
Approve this app	This will add the cloud application to Allow-List. Future occurrences of emails from this specific application to any user will not trigger an event. However, this will not update past events. Consequently, this will not impact the Shadow IT dashboard that will show past usage of the application. To view and manage the approved applications. contact Check Point Support.

Panel

Description

Dismiss

Changes the event state to DISMISSED. The event will be removed from the Shadow IT dashboard.

Approve this app

This will add the cloud application to Allow-List. Future occurrences of emails from this specific application to any user will not trigger an event. However, this will not update past events. Consequently, this will not impact the Shadow IT dashboard that will show past usage of the application.

To view and manage the approved applications. contact Check Point Support.