The company announced a $20 million Series B venture funding on Wednesday, bringing the total raised to more than $26 million. Sequoia Capital led the new round, which also contains a contribution from Greylock Partners.

Along with highlighting problematic use across multiple cloud services, the Skyhigh software also lets IT administrators take steps to minimize impact of the rogue behavior by controlling access to certain clouds and encrypting data, which could make activity more secure. Cisco and Equinix use the Skyhigh product. Skyhigh wants to add more customers and also invest in marketing and engineering with the new funding.

The news falls in line with an increase in investments in security recently. In addition to the Skyhigh investment, Blue Coat Systems has announced plans to acquire Solera Networks, and McAfee said it would buy Stonesoft.

But shadow IT is just one challenge facing CIOs these days, along with the push to try cloud services and implement big data projects. My colleague Barb Darrow will discuss challenges like these with the CIOs of the Clorox Co. and the Pabst Brewing Co. at GigaOM’s Structure conference in San Francisco on June 19.

Feature image courtesy of Shutterstock user alexmillos.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• New challenges for the IT organization
• A near-term outlook for big data
• Dissecting the data: 5 issues for our digital future

One out of five of 1,300 business users surveyed said they use the consumer file-sync-and-share system with work documents, according to new research by Nasuni, an enterprise storage management company. And, half of those Dropbox users do this even though they know it’s against the rules.

The most blatant offenders are near the top of the corporate heap — VPs and directors are most likely to use Dropbox despite the documented risks and despite corporate edicts. C-level and other execs are the people who brought their personal iPads and iPhones into the office in the first place and demanded they be supported.

These findings should not be news to anyone who’s been paying attention. Dropbox, the popular service that consumers use to store and share photos, files and other documents, has become the proxy for “shadow IT” — technology that comes inside a corporation but is beyond the control and tracking of corporate IT departments.

Dropbox claims a whopping 100 million users — and its popularity is driven by the exploding use of smart phones and tablets to send, sync and share documents. This whole bring your own device (BYOD) movement causes huge headaches for corporate IT departments which are supposed to keep company data secure. The problem with many corporate file-share-and-sync solutions, is they aren’t as easy to use as Dropbox and don’t necessarily support personal smartphones or tablets. So if you’re trying to work and need your document, you take the path of least resistance: Dropbox.

Here’s the problem: if corporate workers put sensitive internal files up there, the door is open to abuse. According to the survey:

“The sensitive data stored in Dropbox is not secure and just as importantly, not controlled by IT. This means that if an employee leaves the company, the information that [a] user has stored goes with them, creating a significant risk of data loss or exposure. Furthermore, as the amount of sensitive corporate data stored in Dropbox increases, the online file-sharing service will become a
more attractive target for hackers and other malicious groups.”

Companies like Nasuni — or rivals like TwinStrata and StorSimple as well as companies like Box, OwnCloud and LogMeIn — pitch their services as enterprise-class secure cloud storage. So, the survey is self-serving for Nasuni, but that doesn’t mean the results aren’t worth noting.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• AWS Storage Gateway jolts cloud-storage ecosystem
• New challenges for the IT organization
• A field guide to cloud computing: current trends, future opportunities

Shadow IT projects crop up in much the same way. Gridlocked by the processes and protocols imposed by IT management, developers very often give in to the temptation of moving their projects outside where they can progress faster. These “shadow IT” or “dark ops” which happen when developers go outside the firewall — spinning up and provisioning their work on beyond-the-firewall cloud resources to support time-sensitive project delivery. These efforts typically happen without the knowledge of IT (or accounting) departments.

Dark ops: a symptom of impatience, colliding objectives

Dark ops emerge when dev/devops teams hit communication breakdowns, governance constraints, and resource limitations. The whole rationale for the devops movement — in which company developers and operations people — who often work at cross purposes — are encouraged to work together to build, then deploy,  incremental software updates and improvements. It sometimes doesn’t work that way, hence the rogue developer.  sometimes that’s because IT management has implied or stated outright that it doesn’t have the time, in-house skills, resources, or desire to deal with their projects. At the same time, developers are under pressure to innovate to keep the enterprise competitive.

The public cloud breakdown lane: tempting, but risky

Look at it from the developer’s perspective. Would you jump into the dark ops breakdown lane? Cloud offerings such as Amazon’s Web Services are tempting, quick options for developers looking for bandwidth, scale, and resources, without having to go through time-consuming IT channels. But without IT’s involvement, issues abound.

For instance, think of the “success-failure” scenario: What happens if the shadow project is a successful trial, and corporate end users demand broader rollout? IT has to integrate that shadow project back into the corporate network, connecting it to legacy applications, databases, and service frameworks. Trying to do that after the project is already under way is far more difficult and resource-intensive than if IT were involved in plans from the start.

Even worse: What if the third-party service provider suffers an outage or a security breach? IT is a corporate risk manager, and determines maximum tolerable failure windows, necessary protections against data theft/loss, and how often to back up data on-site. In addition, IT constantly measures corporate cloud utilization to avoid overage costs that can get out of hand. It’s not likely that a developer would consider these critical factors when purchasing immediately available public-cloud VMs. In most organizations, the developer’s understandable lunge towards Shadow IT can expose the company to risk and unnecessary expense.

So, how do you foster developer creativity and still maintain IT control?

1. Embrace dark ops culture

Resolve the culture wars being waged by your development and IT teams. In spite of their respective biases, developers and IT management share a common goal: to do what’s right for the company. If your devs are going rogue, review your deployment administrative processes. It’s a problem if they aren’t following the rules, but it’s a much bigger problem if your rules are hindering developers’ ability to innovate. Acknowledge the developer’s lament: “Don’t make me write another report! I’d rather be coding!” Then empower them: They want to be able to provision their apps. Take advantage of virtualization technologies to enable that.

2. Invest in the cloud

Instead of imposing arcane processes on the dev team, establish new infrastructure to support the best way for them to work. If your devs want to go to the cloud, give them a cloud to go to. If you need to keep data in-house, get a private cloud and give your devs control over their own piece of the sky. Otherwise, outsource your hosting to a public-cloud provider. The important thing is that your devs can spin up VMs and not have to wait weeks for approval to do so.

On the IT side, set up management and control procedures— as non-intrusively as possible—to make dev cloud work visible. Middleware in public or private PaaS models can provide sophisticated cloud management solutions for IT without burdening devs with overhead administration.

3. Collaborate

Hold a hackathon. Bring your teams together for a day or even a week to brainstorm on new ideas, build prototypes, and learn from each other. Make multi-day quarterly hackathons open to all employees and impose just one rule: work must benefit the company. Hackathons can get your teams thinking creatively, boost morale, and make your company and products better.

4. Open up your enterprise’s breakdown lane

With mutual respect established, virtualization options made available, and team collaboration under way, you’ll see positive changes in the enterprise developer/IT relationship. That unity will lead to faster, more cost-effective, and less-risky research and development. Open communication and mutual respect will focus your team on what’s important: moving the enterprise forward. You just have to open up that extra lane to get past the traffic.

Bart Copeland, CEO of ActiveState, a cloud software provider, will be speaking at GigaOM’s Structure Europe in Amsterdam later this month. 

Feature photo courtesy of Shutterstock user Viktor Gladkov

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Continuous delivery and the world of devops
• Infrastructure Q1: Cloud and big data woo enterprises
• New challenges for the IT organization

According to new research from Forrester, the unintended, but entirely predictable, consequence is that many of those frustrated employees just turn to new, unsanctioned devices instead.

After surveying 5,102 business users for its “Five Steps to a Successful BYOC Program” (Forrester prefers the term “computer” to “device”), here’s what Forrester has to say:

Today’s workers often need more than the locked-down corporate PC’s and are spending an average of $1,253 annually of their own money on computers to do their jobs. … Yet the same survey reveals that only 12% of firms encourage those who do so, with the rest actively discouraging it – and some even penalizing employees. The mismatch between employee needs and IT’s position is obvious, but few organizations are adequately prepared to change course.

The examples of this tactic are piling up. IBM, for example, disables Siri in employees’ iPhones and forbids the use of Dropbox, the wildly popular cloud-based file storage, sync and sharing service. That raises interesting questions in the cloud computing era, where users can tap consumer-oriented services from their personal phones and laptops that may be verboten in the corporate context. It’s the very definition of shadow IT.

Shadow IT: not necessarily a bad thing

Often, workers have much better technology at home than they do at work. For example, Forrester found that more than half of the businesses surveyed still run 11-year old Windows XP on their PCs. The question then is: Which would you use, that moldy PC or your shiny new iPhone? I rest my case.

And even if you have a modern PC at work but it can’t access your Dropbox account, would you stop using Dropbox? Not likely.

Forrester analyst David Johnson, blogged about the topic here, and reinforces what most of us already intuit:

When the tools a person depends on for their job belong to them, we often can observe 3 things: 1) They will buy tools that align best with their own strengths and help them do the best work they can, 2) They will generally select good quality tools given the choice, because they don’t have time to waste dealing with cheap ones that break, and 3) They buy them from companies who stand behind them and will pay more to get better service. In their world, as in ours, time is money.

As another data point: a survey of 4,000 business users by cloud-based storage and file sharing company SkyDox, found that nearly two-thirds (60 percent) of respondents use free file-sharing apps and of those more than half (55 percent) do so without informing IT.

So what to do? Forrester recommends that IT staffs be encouraged to stop fighting the rank-and-file and really learn about the tools they want to use and, where possible, facilitate rather than fight that use.

And, where security and compliance are a concern, IT should investigate the use of virtual desktop technologies and other options to provide a standard Windows environment without requiring a corporate PC.  That would give users access to secure corporate applications that are easily managed, patched and updated, while also allowing them to use their device of choice for both work and personal tasks.

Photo courtesy of Flickr user DieZBW.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Work media tools in 2012 and beyond
• New challenges for the IT organization
• Connected world: the consumer technology revolution

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• CES 2012: a recap and analysis
• Connected world: the consumer technology revolution
• Research In Motion: future scenarios for its fate

As companies move more workloads to the cloud, DevOps, the practice where software developers actually work with the operations side of the house — becomes even more important, according to IT executives.

Developers and operations people still work in separate bubbles far too often, said Ben Rockwood, director of systems engineering for Joyent, speaking at the USENIX LISA 2011 Conference on Wednesday.

When the development side and business operations side collaborate, chances are the resulting apps and infrastructure will do what they are supposed to and satisfaction will be higher. That, in turn, can help contain the tendency of employees to spin up applications in the cloud — something IT pros have complained about since the advent of cloud computing. DevOps adoption could also mean the workloads that should be offloaded to SaaS providers, such as Salesforce.com, will be, but in a fully sanctioned way.

While a big proponent of cloud computing in general, Capgemini CTO Joe Coyle has one big reservation. “The worst part of cloud is it’s re-enabling the whole shadow IT world in a huge way.  In the old days, you’d worry when ARCnet networks popped up, and the next thing you knew, desktops were running all your mission-critical apps. That comes back with a vengeance now when someone with a credit card and $50 can spin up a bunch of Linux instances out on a public cloud,” he said.

Rockwood agreed cloud has changed the game completely in that developers can bypass IT at will — for better and worse.

On the plus side, developers tend to know a lot more about cloud APIs than inward-focused IT people. On the other hand, bad things can happen.

That’s something Joyent, which offers cloud services to customers, has witnessed first hand.

“A customer can fire up apps that we can flag as abuse,” Rockwood said. In one case, Joyent was about to shut a customer application down because of what looked like rogue activity in their account, but the customer’s development staff intervened at the last minute. “They told us that their internal IT guys suck, so they started up a big project with a private credit card.” That operation was satisfying some very important needs for that customer, but it was done completely outside the purview of official IT.

These communications gaps have to be plugged. The DevOps school holds that the overall process of building software implementations is an evolution and improvements can be incremental. It also needs to be holistic and involve all parties from the get go.

“If you want to start DevOps … take your developers, your management, and your ops teams and buy them a bunch of beers and chips.  You need to open a channel, sit together, ask questions and implement the no  [expletive deleted] rule,” Rockwood told the assembly of systems administrators at the show.

The stakes for failing to do so only get higher as cloud computing takes hold. The lesson IT has to learn is that it can no longer just say no to new apps that a business unit or developers want to try. It’s better off trying to accommodate and foster that creativity in as safe a way as possible.

Image courtesy of Flickr user cliff1066™

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Continuous delivery and the world of devops
• Cloud and data first-quarter 2013: analysis and outlook
• Understanding and managing the cost of the cloud