IT’s Dirty Little Secret: “We’re aware of ‘Shadow IT’, we just can’t stop it”

The "cloud" is a huge problem in the finance, legal, healthcare, and educational fields. Confidential client/patient/student data leaking out all over the place is a disaster waiting to happen, not to mention often outright illegal.

Let me give you an example: I recently bought a Livescribe Skypen, the new one with Wifi. It automatically syncs with Evernote, and works like a charm. But I can't use it for purpose, taking notes at work, because I can't have attorney work product for a client floating around on Evernote's cloud. That's just a no-go. My father in law encountered a similar problem. He's an IT director at a school district, and he has been trying to get teachers/staff to stop sending student information through GMail/Google Docs. It's almost certainly a violation of student privacy laws to expose that information to third parties without student consent.

I think there is some disruption to be had in this space. People want to use their iPads/tablets/etc and other cloud-reliant devices in their work flow, but at the same time that information has be stored in a way that adheres to security protocols and privacy policies. Google could over a "local Google Drive" service where a company could let its employees use Google Docs, but have that data stored in the company's internal network, with assurances that Google can't troll through the information to target ads or any similar privacy breaching and potentially illegal activity.

Security in IT can be a way to reduce cost (via risk mitigation), but all too often it's just a form of authoritarian power play by petty tyrants.

In my experience, executives will get "dust in their eyes" if you bend a few rules to get things done in a bureaucratic environment. Plausible deniability, effectively. They want productivity without having to pay for it.

Dropbox, for example, is mostly free (up front), but with a level of risk cost associated with it. An enterprise on-premise Dropbox alternative is not free (up front) and may or may not have less risk than Dropbox. What's the better one? It's hard to measure. What's the ROI of sharing files? Depends on if your management likes fancy numbers games or just approves projects based on personal preference with numbers to make it look like they're doing some due diligence.

I remember at an old job on a stock trader's last day he emailed himself (from corporate email to gmail) a spreadsheet that contained proprietary models, client holdings, etc. That's a serious breach, and luckily traders are dumb enough to use corporate email to do this because if he used something like dropbox it probably would never have been caught. I don't like being restricted ever, but you can see why a company might try to block these cloud storage services to protect itself and its clients.

I don't think so. That certainly forms a part of it, but there are also the aspects of e.g. senseless policies, large sub-organizations doing nothing useful for no good reason, people engaged in turf wars instead of doing something productive, etc. Authoritarian or dictatorial regimes can be quite efficient if the dictator is good, and I don't really associate those features with authoritarianism, but they are definitely stereotypical (if not necessarily real) communism.

TBH, client details really should belong to both the firm and the traders, since at the end of the day those clients most likely will continue to execute trades with that trader regardless of what firm they work at. Back when I worked in finance, many traders I knew were hired based on the clients with whom they had a solid professional relationship.

The value of a trader to a firm is essentially their professional relationships with clients combined with the efficiencies and information provided by the firm itself. The trader needs information from the firm and his co-workers to effectively monetize his client relationships, but those relationships really are his/hers at the end of the day. It's not like a trader can leave a firm and some other trader can pick up those relationships right where the other trader left them off. They can try of course, but the relationships are likely to move from firm to firm with that trader.

The spreadsheet is also dubious grey area. Yes, it may be proprietary information created by the trader while at that firm, but it is just as likely to have been created by that trader before he joined the firm that he brought with him when he joined. The only thing that changes when a trader joins a firm is that he ceases to use inputs from the economists and analysts at his previous firm and now begins using the figures from the economists and analysts at his new firm. Proprietary models often are created by a trader and intelligible to that trader and only that trader, unless they happen to have trained a junior trader to understand the ins and outs of their own model.

I was one of the analysts myself and every single model created by any senior analyst was reused by their junior analysts, but was often scrapped anytime a new senior analyst who joined the firm to replace the previous senior analyst. When you have your name and reputation on the model and the investment advice, the tendency is to do a big rewrite.