The Suncor attack reflects the accelerating vulnerability of organizations in the infrastructure space – see Colonial Pipeline and JBS Foods for earlier examples of high-profile ransomware events that resulted in widespread consumer impact. It also comes on the heels of a warning from the Canadian Centre for Cyber Security (CCCS) that the oil and gas sector is increasingly being targeted by opportunistic cybercriminals.

Barely two months ago, the Globe & Mail newspaper reported on pro-Russian claims that they had successfully targeted gas pipeline infrastructure in Canada. While no victims were publicly identified and no evidence of a specific attack was ever released, the report sent shudders through the industry and renewed questions around whether enough was being done to counter future events.

TRIMMED BUDGETS HAVING AN IMPACT

The truth for organizations watching all these headlines and wondering how they might be affected is sobering: it’s a matter of when, not if, and recently published data from HackerOne paints a worrisome picture. Specifically, 75% of the companies surveyed said pressure to reduce security budgets via layoffs, hiring freezes, and cancelling investments in new or upgraded technology is compromising their ability to efficiently manage their cybersecurity infrastructure.

A report from the Neustar International Security Council confirms the widening gap between cybersecurity funding and expanding threats. It goes on to say that 51% of organizations don’t devote enough funding to current or projected cybersecurity needs.

Over one-third – 35% – of respondents to the NISC report said their cybersecurity budgets were either static or shrinking. Of those, 44% said they were worried their organizations were at increased risk as a result. 60% said they were worried tightened budgets would limit their ability to implement new technologies and processes.

The timing for all this is particularly troubling, as Federal Bureau of Investigation data collected during the pandemic confirms cybersecurity worsens during times of economic distress.

According to the FBI’s 2020 Internet Crime Report, complaints of suspected internet crime almost doubled between 2019 and 2020, and reported losses topped $4.2 billion USD. Thanks to ongoing spikes in inflation, high interest rates, uncertain job market prospects, the Russian invasion of Ukraine, and ongoing global economic instability, the cybersecurity threat landscape is expected to worsen in the months and years to come.

NO INTEREST IN (CYBER) INSURANCE

Whoever the victim ultimately is, these types of attacks take advantage of the soft underbelly of cybersecurity – namely the fact that employees are often inadequately trained in recognizing the signs of the phishing attempts that almost always kickstart these events. Most organizations of any size and in any sector have historically under-resourced their cybersecurity competency – a reality made worse by the pandemic-fed explosion in remote and hybrid work.

A recent Hornetsecurity report said a third of all companies offered remote workers no cybersecurity training at all – despite the fact that 74% of employees had access to critical data.

Unfortunately, training knowledge workers to recognize a phishing attempt is sadly not as sexy as buying cool new machines or opening up a fancy new data center. Business leaders don’t always appreciate the business value of cybersecurity investments – or the risks incurred when those investments aren’t prioritized.

The pandemic added additional pressure on CIOs, CTOs and CSIOs, as they focused on keeping the lights on while employees transitioned, virtually overnight, to remote work. While technology leaders were making significant progress in recent years getting CEOs, CFOs, and COOs to appreciate the business value of cybersecurity investments, the pandemic abruptly shifted everyone’s attention elsewhere.

THE BOTTOM LINE

Ask any IT or business leader flat-out if cybersecurity investments are worthwhile and they will undoubtedly agree that they are. Yet, the data highlighting systemic underinvestment in cybersecurity continues to pile up. So, what’s the answer?

It’ll take more than a single blog article to answer that question – so stay tuned – but for starters, IT leaders must shift gears out of their pandemic-era focus of keeping the lights on and get back to reinforcing the business benefits investing in cybersecurity.

Organizations that do cybersecurity particularly well are those that don’t treat it as a unique discipline. By incorporating cybersecurity best practice into all facets of the business, it becomes easier to ensure all projects are properly resourced and are planned and deployed in a safe, sustainable manner.

Here at STEP Software, we don’t just develop software: we work with our business partners to understand their most pressing challenges, and then, design and deploy solutions accordingly. Cybersecurity isn’t just something to be tacked on; we build it into everything we do. We welcome the opportunity to have similar discussions with you.

The post Cybersecurity budgets fail to keep pace with intensifying threat landscape first appeared on STEP Software.

It’s easy to understand why the broader economy is pulling back after over a decade of historic expansion. Early pandemic spending sprees are giving way to late-pandemic pullbacks. The Russian invasion of Ukraine is sending shockwaves around the globe. Between chaotic energy markets, broken supply chains, waves of layoffs, rampant inflation, and spiking interest rates, there’s no shortage of frightening economic headlines.

Historically, IT has followed the rest of the business herd as economic indicators have started to trend downward. As everyone else’s budget got cut, IT similarly stood by and watched as its bottom line was pulled back in the name of corporate efficiency and survival.

But IT has assumed a far more profound role in organizational success since the last global recession 15 years ago, and this new reality calls for a very different approach to spending.

The good news: Gartner predicts global IT spending will increase 5.5% in 2023. The bad news: that’s well below International Monetary Fund figures that pegged inflation at 8.8% in 2022 and 6.6% in 2023. That means IT must fight even harder for its business critical slice of the budget pie.

WELCOME TO THE NEW IT

Times have most certainly changed. IT is no longer a passive contributor to organizational success. Technology is no longer seen as a straight-up cost, and the CIO is no longer a junior member of the C-suite who must beg others for resources.

Today, technology is a strategic driver of organizational performance, CIOs own their own budgets, and IT is now a central player in ensuring the organization remains competitive. We wrote about the change recently – Today’s CIO role is evolving more rapidly than ever. Here’s what’s driving it. – and we believe IT has never been as central to overall organizational performance and strategy as it is now.

All of this is especially true as the economy hits the brakes. And it presents a uniquely historic opportunity for IT professionals to lead the charge as organizations adjust themselves to the landscape.

IT’S TIME TO PRIORITIZE

As CIOs, CTOs, CISOs, and other technology leaders adapt themselves to this new reality, they’d do well to focus on the following intelligent fixes to best prepare the IT budget for the challenges ahead:

1 – Bump up security spending

While a Fortinet study suggests 71% of CIOs view their security as good or excellent, a full 43% admit they are either “somewhat” or “very” unprepared for what comes next. Given the catastrophic business impact and spiralling costs of even a minor security breach on an organization’s operations and brand, it’s becoming increasingly clear that cutting the cybersecurity budget is tantamount to a corporate death wish.

Now is the time to funnel more money into cybersecurity, and to use the current uncertainty to accelerate investments in automation, self-service solutions such as portals, and employee training to reduce security friction points and ensure maximum compliance.

2 – Simplify the toolset

Technology assets tend to multiply over time, with organizations taking on new hardware, platforms, subscriptions, development tools, and other resources. While having the right systems on-hand to power growth is crucial, it’s just as true that having too many tools in the toolkit leads to higher acquisition and maintenance costs, greater diversion of resources to manage them all, and reduced agility.

Consider conducting a comprehensive asset inventory and assessment process to identify what you’re currently using. Assess all resources to ensure they continue to drive business value. Decommission those that don’t and integrate or consolidate disparate systems to streamline management.

3 – Streamline the software estate

Software licensing represents one of the most significant opportunities for quick-win improvements to the budget, as many organizations often buy more than they need, then fail to adjust their ongoing spending to better align with requirements.

Monitor usage – particularly among subscription-based offerings – to identify what is and is not being used, and areas where the organization is over-licensed for current and projected business requirements.

Don’t be afraid to use the resulting savings to invest in critical systems that can drive agility and competitiveness. Or improve your cybersecurity resilience.

4 – Revisit contracts

There’s a lot of opportunity hiding in the fine print of most IT contracts. Review them to identify areas for optimization and negotiate with vendors for improved terms. There’s no rule preventing customers from renegotiating contract terms mid-stream – in fact, it’s considered best practice to routinely revisit and tweak terms to benefit the organization.

5 – Stretch out hardware timelines

Ditch the set-in-stone schedules that dictate when employees receive new laptops, phones, and related hardware. Conduct cost-benefit analyses to assess optimal lifespans for given categories of hardware, then track maintenance costs to identify how they evolve over time, and where optimal points in time for retirement and replacement.

Use monitoring software to determine how certain classes of equipment are being used and continue to invest only in resources that drive ongoing business value.

6 – Link technology investments to ongoing revenue

All organizations are now technology organizations – and we’re long past the point where IT is considered a cost center. Similarly, all technology investments are now directly linkable to specific business outcomes, and it is incumbent on IT to paint this picture for the rest of the organization.

Track metrics for all technology initiatives that relate investments to tangible business benefits. Use this direct relationship to cultivate a culture where leaders across the organization understand the value and ROI of tech-related spending.

7 – Accelerate spending on training

Human factors rarely get the attention they deserve. They should. Well-trained staff and contractors are better equipped to squeeze more business value out of the technology they use. They are also better able to recognize – and avoid – attempts by malevolent actors to compromise organizational security.

There’s a competitive benefit to a training-first culture, as well: better-skilled resources spend less time trying to get their technology to work and more time working with customers, vendors, and other stakeholders to creatively drive the business.

8 – Double down on hybrid workstyles

Employees across all industries have spoken even as the pandemic slowly recedes, they wish to retain the option to work both remotely as well as in the traditional office. A truly hybrid work environment helps recruitment and retention efforts and allows access to a broader talent pool that can, in turn, benefit the performance of technology projects and the organization at-large.

A hybrid-friendly HR landscape similarly reduces pressure on existing office facilities and allows organizations to support a larger workforce with a smaller real estate footprint. Those savings can be easily reinvested in innovative technologies that drive organizational agility.

THE BOTTOM LINE

Years of strong economic growth have made it easy for IT shops to ignore the need to optimize their budgets. As the external landscape begins to contract, however, IT needs to tighten its pencils and sharpen its focus on what it spends, and why.

Fortunately, IT has never been more critical to top- and bottom-line performance. Now more than ever, technology drives competitiveness, and in the process has been given a generational opportunity to reshape the organizational roadmap.

It’s no longer about spending less: it’s about streamlining spending in less value-added regimes and freeing up resources for investment in next-generation technologies. Give us a call if you’d like to discuss how technology can reshape your own recessionary roadmap.

The post Batten down the hatches and hit the gas: 8 steps to recession-proof your IT budget first appeared on STEP Software.

So what do these planning sessions look like?  From a simplistic approach, if business strategy is defined as “the means by which it sets out to achieve its desired objectives” the answer would include these: 

1. What does the company do?  What is its mission?
2. For whom does the company do these things?  Who are their customers?
3. How does the company excel?  What will make the company successful? 

With these answers in hand, the IT strategist can respond with their own question: How can technology help accomplish these goals?  The computer organization deals with data and needs to comply with the business objectives.  To do so, examine functional areas like the following:

Input of the data – How will the customer place orders? The business strategy may say we want customers to have mobile access as well as an in-store experience.  IT will need to be equipped with the software and security tools to provide customer’s this ability.

Availability of the data – The business plan may require that customers have on-line access to order status and history without direct company intervention.  Employees will need the same access and possibly more.  IT will have to ensure these capabilities are available within their current environment.

Reporting the data – The decision makers will want to have current accounting and metric data readily available.  IT will need to provide the tools for managing the large sums of “big data” that can now be gathered and stored.

B2B partnering in order to share data – It may be decided that in order to grow and expedite customer requirements, direct interaction with vendors and partners is necessary.  It requires interfacing applications and software to implement this process safely.

Intertwined into all the discussions, agreements are needed to guarantee service levels and proper connectivity and security expectations.  As IT and business have this “one strategy” conversation, these areas will need to be negotiated and built into the company overall plan.   It should be a coming together of IT and business planning to ensure success.

The post Information Technology and Business Strategies  first appeared on STEP Software.