• Skeet Spillane

2021 Cybersecurity Budget Must-Have's

By: Pillar Technology Partners Incident Response Team 1


Top-of-the-list Cybersecurity for 2021


Business Email Compromise threats (phishing, malware, ransomware etc.) are at all-time highs. The pandemic, the holidays approaching and so many working remotely have created a perfect storm for cyber criminals. Their tactics are every evolving, take advantage of holiday and confusing times, and their intent is absolutely malicious.


There has never been a more critical time for smart cybersecurity practices. If funding security is a low priority in your 2021 budget, here are some reasons to reprioritize.


Funding cybersecurity doesn’t have to feel expensive. You can create a prioritized approach that fits your budget. Start by identifying your highest risks and spend there first.


No security strategy is the worst security strategy.


in some variation, almost every breach response we’re involved in centers around poor cyber hygiene, either within IT and security operations or on behalf of users. Here are common blind-spots that we see recurring,

1. Conflicting cyber culture (No ownership and/or leadership support for security)

2. Lack of MFA, password management and patch management

3. Poorly configured cyber tools (or no configuration)

4. Inconsistent or no vulnerability management

5. Unenforced security policies and procedures


These are textbook risks that make it very easy for cyber criminals to ruin your holidays. But keep in mind, most breaches can be prevented with some basic best practices.


If you don’t want to be the next cyber victim, you can’t wait any longer to develop your strategy.


Let’s take a closer look at these risks.


1. Conflicting cyber culture (No ownership and/or leadership support for security) There are a lot of moving parts in cybersecurity. It can be overwhelming and feel like

cybersecurity should be driven by IT. It’s technology, right? Kinda, but not completely. Cybersecurity is an enterprise risk. It impacts people, process and technology. A technology-

only approach creates a culture of dependence that IT can never live up to or fully support.

Operationally, IT is trying to keep the lights on and support the technology that runs the

business. Protecting the data most often gets de-prioritized. Cybersecurity is focused on protecting information assets (data). It is most dependent on

employee behavior. How are they protecting their information and the company’s

information? Cyber criminals are mounting social attacks, and IT is building firewalls. This

misalignment creates blind-spots and undetected breaches. When the executive leadership team does not recognize where real cyber risks exist, the

organization will not understand it either. Smart cybersecurity begins with priority from leadership and developing a culture of

awareness that is both visible and important to the organization.

2. Lack of multi factor authentication, password management and patch management Cyber hygiene is about basic discipline we need to be practicing both personally and

organizationally. Our biggest enemy is convenience. We want quick and easy access to information. But, we

don’t want to perform basic practices because it requires a little set up and a couple extra

clicks. Busyness creates an illusion of inconvenience and false security. Personally, cyber hygiene means enabling MFA (Multi-Factor Authentication) on all your email

accounts, bank/investment accounts and your social media accounts to start. Secondly, it

means use a password manager. Never reuse passwords. It gives the cyber criminals easy

access across your digital footprint. When they learn one password, then they have access to

your entire digital portfolio of accounts. Organizationally, you should also deploy MFA as well across the enterprise, know what your

critical assets are and where they live, create a patch management process and perform

regular vulnerability scans and remediation.

Cyber hygiene is as fundamental as blocking and tackling. Technology is becoming smarter.

However, it can’t think for us and manage our behavior. We MUST develop clean cyber habits,

and MFA is a great place to start.

3. Poorly configured cyber tools (or no configuration) Utilizing security tools is an important technology component of your cyber strategy.

However, it’s more than plug-n-play. Protecting your email is a major focus for your security tools. The migration to o365 has

presented major security risks. Microsoft makes a great productivity tech suite, but

cybersecurity blocking, alarming and adjustment to meet user behaviors is very difficult for

most organization.

The most important thing to think about is defense-in-depth. What does that mean? It means

that you have must multiple tools configured and tuned to protect effectively in different

ways. This starts with understanding your environment, your architecture (on-prem, cloud, hybrid),

your data flow, identity & access management. There are many different security tools. And, each one seems like a silver bullet. Harmonizing

the tools in your environment involves a lot more than reading the instructions on the box.

4. Inconsistent or no vulnerability management Protecting your data requires a very dynamic strategy. Technology’s changing, threats are

changing, new technology is emerging. But, developing, maintaining and maturing your cyber

strategy means you have to know your environment. To protect a dynamic environment, you have to develop a dynamic strategy. One that’s

continuously monitoring and remediating your risks and vulnerabilities. Creating a vulnerability management program is a proactive approach to keeping your

environment updated and protected from emerging threats and changes in risks and

vulnerabilities. Don’t wait to react to a breach. Be proactive and prevent or block attacks. Breach prevention

is MUCH cheaper than breach response.

5. Unenforced security policies and procedures To drive the importance of security throughout an organization, there has to be guidelines

that are both executable and enforceable. In short, this is security governance. If the people don’t understand what security means for the organization and how to comply

with the rules, there is great security risk. Don’t leave security to guesswork. Make it clear, important and enforceable.


These are some of the basic principles for a secure organization. Practicing these fundamentals will not eliminate all your risk. However, these are foundational to building a solid program without breaking the budget.


Security begins with the right culture. Don’t ignore the risk because it feels expensive. Many aspects of good cyber hygiene do not require additional investment. If you don’t know where to start, find an expert that can guide you.


Your people and your business are worth your investment in security.


Pillar Technology Partners is an experienced cybersecurity consulting firm. We focus on simplifying cybersecurity and helping organizations understand and remediate their cyber risks.

21 views0 comments