As part of our research on Cybersecurity Perceptions Versus Reality, we developed a survey in collaboration with Serene-risc, a knowledge mobilization network in cybersecurity based in Canada, on the perceptions and practices of cybersecurity professionals.. The survey aimed at understanding how defenders perceive specific security measures and whether these measures were implemented in their respective organizations. We then combined the survey results with our penetration testing experience to confront two perspectives: the defenders’ and the pentesters’, the latter standing as proxies for real attackers. This blog post summarizes the results related to products’ features enabled by default that could represent a security risk.
Product Features
Download the complete Cybersecurity Perceptions Versus Reality report, also available in French.

Defenders: Are You Investigating Products’ Features Enabled by Default?

Many features of products are vulnerable by default and exploiting them makes the life of pentesters much easier! First, survey respondents were asked, based on their experience, how secure proprietary products

(e.g. Windows, Outlook or SAP) used by most organizations are, when kept up to date. A total of 57.3% said secure or extremely secure, while 35.04% said moderately secure, and 7.69% said not at all secure or very limited. Then, we asked whether their organization investigated these products to identify and deactivate specific features that could represent a risk. As shown in Figure 1, 64.1% said they investigated products, while 28.2% said no, and 7.69% did not know.
Product Features - Figure 1

Figure 1 – Investigating Products Default Configuration

Pentesters’ Experience: Currently the Most Common Attack Vector Exploited!

Features vulnerable by default in products represent either a vulnerability (a pentester can leverage the feature to access the systems) or a missing control (an additional feature that helps pentesters in their attack process) that could be mitigated for. Overall, these features are pentesters’ key attack vectors, which they, in their opinion, overuse. Indeed, they estimate that in about 80% of the penetration tests, a system is compromised via these attack vectors. Features that have rarely been seen deactivated during pentesting include NetBIOS and LLMNR –legacy protocols that could allow the capturing of all forms of encoded credentials. Other features include but are not limited to: default passwords, Windows credentials stored in memory, unsecured DNS zones, IPV6 activated by default, and functional ARP spoofing. Pentesters were thus surprised to find that 64% of respondents said that they mitigated that risk. Maybe they have accepted the risks associated with these features. However, and more likely, companies may have investigated the security of a product by asking a penetration test of the product or an audit, such as reviewing the product’s architecture, before deployment. The product may seem very secure in security reports, but its deployment in the company’s environment may be quite different than the environment in which it was first tested. Safe in a vendor’s lab and safe in your environment are likely two very different forms of “safe”.

Pro Tips on Products Configuration

As a reference for readers, below are some pro tips related to investigating products’ features enabled by default that could represent a risk on corporate networks.

  • If your enterprise uses Windows and you have no legacy operating systems (such as Windows NT) in your environment, disabling the NetBIOS and LLMNR protocols is an easy quick win for the security of your internal network.
  • If NetBIOS is needed in the environment, segregate the assets that require it from the main corporate network, implement a WINS server for NetBIOS name resolution, and configure those computers to use the WINS server by pushing the corresponding registry key via GPO. Furthermore, considering the importance of this attack vector for pentesters, a strong emphasis should be put on deactivating features vulnerable by default in products. Unfortunately, an exhaustive list cannot be provided as there are simply too many products to enumerate.
  • In the long term, establish a hardening configuration standard for the different types of systems existing in the organization. The Center for Internet Security (CIS) with its CIS benchmarks, a globally recognized standard, offers extensive configuration guidelines for various technology groups.

Conclusion

These findings are part of the Cybersecurity Perceptions Versus Reality report that highlights the key results of a two-year long study that aimed at understanding a disconnect that exists between how defenders perceive the value of their implemented security controls, and the most common attack vectors leveraged by penetration testers acting as potential attackers. The report is available in French and the microdata of the survey is available online.

GoSecure Titan® Managed Extended Detection & Response (MXDR)​

GoSecure Titan® Managed Extended Detection & Response (MXDR)​ Foundation

GoSecure Titan® Vulnerability Management as a Service (VMaaS)

GoSecure Titan® Managed Security Information & Event Monitoring (Managed SIEM)

GoSecure Titan® Managed Perimeter Defense​ (MPD)

GoSecure Titan® Inbox Detection and Response (IDR)

GoSecure Titan® Secure Email Gateway (SEG)

GoSecure Titan® Threat Modeler

GoSecure Titan® Identity

GoSecure Titan® Platform

GoSecure Professional Security Services

Incident Response Services

Security Maturity Assessment

Privacy Services

PCI DSS Services

Penetration Testing Services​

Security Operations

MicrosoftLogo

GoSecure MXDR for Microsoft

Comprehensive visibility and response within your Microsoft security environment

USE CASES

Cyber Risks

Risk-Based Security Measures

Sensitive Data Security

Safeguard sensitive information

Private Equity Firms

Make informed decisions

Cybersecurity Compliance

Fulfill regulatory obligations

Cyber Insurance

A valuable risk management strategy

Ransomware

Combat ransomware with innovative security

Zero-Day Attacks

Halt zero-day exploits with advanced protection

Consolidate, Evolve & Thrive

Get ahead and win the race with the GoSecure Titan® Platform

24/7 MXDR FOUNDATION

GoSecure Titan® Endpoint Detection and Response (EDR)

GoSecure Titan® Next Generation Antivirus (NGAV)

GoSecure Titan® Security Information & Event Monitoring (SIEM)

GoSecure Titan® Inbox Detection and Reponse (IDR)

GoSecure Titan® Intelligence

OUR SOC

Proactive Defense, 24/7

ABOUT GOSECURE

GoSecure is a recognized cybersecurity leader and innovator, pioneering the integration of endpoint, network, and email threat detection into a single Managed Extended Detection and Response (MXDR) service. For over 20 years, GoSecure has been helping customers better understand their security gaps and improve their organizational risk and security maturity through MXDR and Professional Services solutions delivered by one of the most trusted and skilled teams in the industry.

EVENT CALENDAR

LATEST PRESS RELEASE

GOSECURE BLOG

SECURITY ADVISORIES

 24/7 Emergency – (888)-287-5858