Like many, you could be in budget planning mode. (Does is EVER actually end?) In our conversations with customers and industry partners, there are some common themes in planning for an IT budget.
Cyberthreats keep pace with technology gains
As is the case with technology, there have been major gains in performance, capabilities, and reliability for both hardware and software since the last budget cycle. Unfortunately, there have also been similar gains in performance, capabilities, and reliability of cyber threats thanks to advances in the cyber-criminal ecosphere.
A Holistic Path to IT Budget Planning
Many new vendors and studies would have us increasing our spending based solely upon their research and reports of new cyber threats. Yet, throwing more money at IT won’t necessarily safeguard against threats. We’d like to suggest an process that offers a more complete approach to determining actual IT budgeting needs.
#1 Complete an Internal Review
Let’s begin by looking inside at infrastructure and business goals. Today, are staff able to perform their duties to an acceptable performance level? Are there any activities around month-end close that suffer due to a lack of technology? Are front-line workers able to reach or exceed performance requirements? It is wise to do a deep dive, with the help of your IT staff, into the problems that have a recognizable and painful impact on the business. The purpose of this first exercise is to see what needs attention from an internal perspective and prioritize budget allocations for that. Beyond that, you’ll have identified what is actually working so you don’t try to fix a problem with technology that doesn’t need fixing.
#2 Complete an External Review
The next area to examine and document has an external focus. Are there new regulations or rules, either on a state or federal level, that are coming? Have these changes been reviewed, and the potential impact defined in terms of dollars, time to invest, and potential penalties? Once the regulatory changes have been reviewed, detailed, and quantified, move on to looking at potential criminal-focused areas.
#3 Minimize Known Unnecessary Risk
Cybercrime continues to expand and those in the market are adapting to and taking advantage of every opportunity to make inroads. There is a need to do a cost-benefit analysis of your current infrastructure and systems to understand the risks of decisions made against the cost of changing to a more secure environment. An important shift includes moving away from a terminal server environment to one that is not client-server using Remote Desktop Protocols or RDP. Note that this topic is too complex for any number of blogs. The executive summary and recommendation are to move away from RDP as quickly as possible! RDP is a historical original protocol for server environments and as such is inherently not secure as it was never designed for security. As a result, cybercriminals know exactly where to attack the server and end up either getting in or crippling the performance of the server by flooding it with requests thereby consuming all resources.
#4 Investigate Additional Cyberthreat Exposure
If you do not have a RDP-based environment, look at the new threats. Engage with your IT team or service provider to ask what new clear and present threats they see for your company. Remember no two companies are the same so do not accept a generic answer.
#5 Increase Security Measures for High-Value Employee Targets
Specific high-value end users should be stepped up another rung on the secure authentication ladder to hardware-based authentication. Note this presumes that all users are using multi-factor authentication with a password manager already.
Summary
In closing the takeaway is to look inside first and see what improvements are needed to support how things are done then to examine what needs to be changed to support goals for the upcoming year. Then, look outside your business and see what external forces are coming to bear. Make a risk assessment based on your goals, objectives, and priorities. Be realistic and detailed about risk factors and plan for them accordingly.
We can help!
All Lead IT Consulting clients know that we appreciate the differences in each business we support and work with each client to reduce anxiety to an acceptable level. As you roll up your sleeves in earnest on IT budget planning, you may still feel unsure about the complete scope of what you will need in terms of $$s, internal or external resources, and systems and safeguards. We can help you navigate the IT budget planning process by suggesting IT solutions that fit your unique business needs best. We’d love to work with you on this! Book a meeting to discuss or complete a contact form and let us know how we might help.
