4 ms·

I do a lot of work with what you’d call ShadowIT, or the use of unsanctioned applications. I use cloud broker tools which use firewall logs to identify where th

I do a lot of work with what you’d call ShadowIT, or the use of unsanctioned applications. I use cloud broker tools which use firewall logs to identify where these websites are being used. The use of these file conversion tools is very common and is often used on sensitive information. Heck I’ve seen health companies use these tools to upload god knows what. Usually there is little to no data sovereignty rules that apply, in that by using the service for free that can own the file you upload and use it to glean information from. Firstly, employees need to be aware that they are not allowed to use this software and you need to therefore provide a solution. You should then use broker tools to actually block these conversion sites, in the same way that you might block the use of Dropbox and other cloud solutions if these are unsanctioned. Yes you’re absolutely right to question these services and organisations are having to deal with risk associated with using them. Which is only really an issue if it’s sensitive personally identifiable information.

nocubicles 4y ago
What are some examples of these “cloud broker tools”?
- NoPicklez 4y ago
  I have experience with the NetSkope CASB. Gives you all of those insights and the ability to block them.
KronisLV 4y ago
> Firstly, employees need to be aware that they are not allowed to use this software and you need to therefore provide a solution. As far as I understand, the usage of such tools is caused by the need to accomplish some goal that they don't know how to otherwise do. Therefore, wouldn't it be a good idea to self-host such a tool, even if it's not a part of any pre-existing platform that's in use for other business processes? For example, for various data format related concerns, I've seen CyberChef be pretty good: https://github.com/gchq/CyberChef https://github.com/gchq/CyberChef As for some binary file format conversations, HRConvert2 seems viable: https://github.com/zelon88/HRConvert2 https://github.com/zelon88/HRConvert2 If self-hosting things is too much of a bother/risk, then I guess all that's left is local tools, such as Handbrake on Windows for video: https://handbrake.fr/ https://handbrake.fr/ and maybe something like XnView for images: https://www.xnview.com/en/ https://www.xnview.com/en/ and so on... But then there's the risks of self-hosted or local software containing something malicious and needing to be audited etc. I recall that in my previous org, I helped develop a Wiki page listing many of the tools available within the company internally, so that anyone who needs to store files could immediately look at self-hosted Nextcloud (for example), as opposed to going for Dropbox or whatever. Of course, instructions alone probably aren't enough, restrictions are also necessary, but discoverability is always good!
- NoPicklez 4y ago
  That’s where in my post I said “you need to therefore provide a solution” Yes, you can’t just remove it you need to provide them with the capability to do it.
sharemywin 4y ago
That's seems like a brilliant business opportunity. file conversion with corporate friendly terms. charge a per seat license thats cloud based and easy to use. maybe offer a browser plugin that redirects to your site. go through security department of IT to get it approved.
- gjsman-1000 4y ago
  If it were possible, the biggest business opportunity would be a turnkey, self-hosted file conversion service. The only outbound internet traffic should be for software updates and responding to incoming traffic - and because it's self-hosted, the business could put it behind a firewall and have complete certainty in the privacy of their information, which would be huge. If you had that, plus an all-in-one, easily-deployable browser plugin which overrides standard file conversion websites to force users to the self-hosted business-approved converter (and, preferably, adds a Start Menu link)...
  - NoPicklez 4y ago
    I do think for many organisations this type of solution would be very niche. Conversion between different work, excel, powerpoint, .PDF formats can be done natively by the software itself. Heck even the built in image viewer in Windows can convert images between common formats. The predominant problem is around user education and showing them how to use the tools they have available to them already.

nocubicles 4y ago

What are some examples of these “cloud broker tools”?

NoPicklez 4y ago
I have experience with the NetSkope CASB. Gives you all of those insights and the ability to block them.

KronisLV 4y ago

> Firstly, employees need to be aware that they are not allowed to use this software and you need to therefore provide a solution. As far as I understand, the usage of such tools is caused by the need to accomplish some goal that they don't know how to otherwise do. Therefore, wouldn't it be a good idea to self-host such a tool, even if it's not a part of any pre-existing platform that's in use for other business processes? For example, for various data format related concerns, I've seen CyberChef be pretty good: https://github.com/gchq/CyberChef https://github.com/gchq/CyberChef As for some binary file format conversations, HRConvert2 seems viable: https://github.com/zelon88/HRConvert2 https://github.com/zelon88/HRConvert2 If self-hosting things is too much of a bother/risk, then I guess all that's left is local tools, such as Handbrake on Windows for video: https://handbrake.fr/ https://handbrake.fr/ and maybe something like XnView for images: https://www.xnview.com/en/ https://www.xnview.com/en/ and so on... But then there's the risks of self-hosted or local software containing something malicious and needing to be audited etc. I recall that in my previous org, I helped develop a Wiki page listing many of the tools available within the company internally, so that anyone who needs to store files could immediately look at self-hosted Nextcloud (for example), as opposed to going for Dropbox or whatever. Of course, instructions alone probably aren't enough, restrictions are also necessary, but discoverability is always good!

NoPicklez 4y ago
That’s where in my post I said “you need to therefore provide a solution” Yes, you can’t just remove it you need to provide them with the capability to do it.

sharemywin 4y ago

That's seems like a brilliant business opportunity. file conversion with corporate friendly terms. charge a per seat license thats cloud based and easy to use. maybe offer a browser plugin that redirects to your site. go through security department of IT to get it approved.

gjsman-1000 4y ago
If it were possible, the biggest business opportunity would be a turnkey, self-hosted file conversion service. The only outbound internet traffic should be for software updates and responding to incoming traffic - and because it's self-hosted, the business could put it behind a firewall and have complete certainty in the privacy of their information, which would be huge. If you had that, plus an all-in-one, easily-deployable browser plugin which overrides standard file conversion websites to force users to the self-hosted business-approved converter (and, preferably, adds a Start Menu link)...
- NoPicklez 4y ago
  I do think for many organisations this type of solution would be very niche. Conversion between different work, excel, powerpoint, .PDF formats can be done natively by the software itself. Heck even the built in image viewer in Windows can convert images between common formats. The predominant problem is around user education and showing them how to use the tools they have available to them already.