A disconnect exists between how defenders perceive the value of their implemented security controls, and the most common attack vectors leveraged by penetration testers acting as potential attackers. Today, we are excited to release Cybersecurity Perceptions Versus Reality, a report that highlights the key results of a two-year long study that aimed at understanding this disparity. The report is also available in French.
Cybersecurity Perceptions Versus Reality
As a cybersecurity company, we have experience with attack techniques: we conduct penetration tests across North America. Yet, to investigate this disconnect, we dug further in the defender’s mind and developed a survey on the perceptions and practices of cybersecurity professionals in collaboration with Serene-Risc, a Canadian knowledge mobilization network in cybersecurity. The survey aimed at understanding how defenders perceive specific security measures and whether these measures were implemented in their respective organizations. The microdata of the survey can be accessed on the Serene-Risc website.

With the survey results and our penetration testing experience, we confronted two perspectives: the defenders’ and the pentesters’, the latter standing as proxies for real attackers. The report is divided in two key sections sprinkled with pro-tips to maximize value for defenders.

First, we confronted defenders and attackers by comparing the perceptions and practices of the 120 survey respondents with our pentesters’ experience, covering security topics like:

  • Multi-factor authentication,
  • Password policies,
  • Specific security measures,
  • Patch management,
  • Products’ features enabled by default,
  • Asset inventories, and
  • Endpoint visibility.

Then, we investigated if a relationship exists between respondents’ perceived maturity security of their organization and the measures mentioned above using a statistical model. We found that the more these security measures were reported as implemented, the higher the perceived security maturity except for these two measures: minimum password requirements and investigating products for features that could represent a risk. These measures did not correlate with respondents’ perceived security maturity.

Then, the top 10 vulnerabilities/missing controls found in 65 penetration testing reports, encompassing 182 findings, are presented in the report. These include findings like weak password requirements, Windows credentials stored in memory, presence of NetBIOS/LLMNR and more.

By cross-referencing the results from the statistical model with the penetration testing findings, we discovered an important information gap: the two security measures not related to perceived security maturity are closely linked to major attack vectors found in penetration testing reports!

 
Conclusion
Overall, this study uncovers potential information gaps and biases in the defenders’ mindset. And through actionable pro tips, it also presents how defenders can overcome these biases by building their security practices to harden their security postures against real adversaries.

Cybersecurity Perceptions Versus Reality will be valuable to both cybersecurity professionals and executives in understanding, delivering, and requiring beneficial and cost-effective cybersecurity measures that might have been under the radar. This blog is the first of a series that will dive deeper into individual findings. Stay tuned!

The French version of the report is available here.

GoSecure Titan® Managed Extended Detection & Response (MXDR)​

GoSecure Titan® Managed Extended Detection & Response (MXDR)​ Foundation

GoSecure Titan® Vulnerability Management as a Service (VMaaS)

GoSecure Titan® Managed Security Information & Event Monitoring (Managed SIEM)

GoSecure Titan® Managed Perimeter Defense​ (MPD)

GoSecure Titan® Inbox Detection and Response (IDR)

GoSecure Titan® Secure Email Gateway (SEG)

GoSecure Titan® Threat Modeler

GoSecure Titan® Identity

GoSecure Titan® Platform

GoSecure Professional Security Services

Incident Response Services

Security Maturity Assessment

Privacy Services

PCI DSS Services

Penetration Testing Services​

Security Operations

MicrosoftLogo

GoSecure MXDR for Microsoft

Comprehensive visibility and response within your Microsoft security environment

USE CASES

Cyber Risks

Risk-Based Security Measures

Sensitive Data Security

Safeguard sensitive information

Private Equity Firms

Make informed decisions

Cybersecurity Compliance

Fulfill regulatory obligations

Cyber Insurance

A valuable risk management strategy

Ransomware

Combat ransomware with innovative security

Zero-Day Attacks

Halt zero-day exploits with advanced protection

Consolidate, Evolve & Thrive

Get ahead and win the race with the GoSecure Titan® Platform

24/7 MXDR FOUNDATION

GoSecure Titan® Endpoint Detection and Response (EDR)

GoSecure Titan® Next Generation Antivirus (NGAV)

GoSecure Titan® Security Information & Event Monitoring (SIEM)

GoSecure Titan® Inbox Detection and Reponse (IDR)

GoSecure Titan® Intelligence

OUR SOC

Proactive Defense, 24/7

ABOUT GOSECURE

GoSecure is a recognized cybersecurity leader and innovator, pioneering the integration of endpoint, network, and email threat detection into a single Managed Extended Detection and Response (MXDR) service. For over 20 years, GoSecure has been helping customers better understand their security gaps and improve their organizational risk and security maturity through MXDR and Professional Services solutions delivered by one of the most trusted and skilled teams in the industry.

EVENT CALENDAR

LATEST PRESS RELEASE

GOSECURE BLOG

SECURITY ADVISORIES

 24/7 Emergency – (888)-287-5858