Research on Perceptions vs Reality in Cybersecurity

As a cybersecurity company, we have experience with attack techniques: we conduct penetration tests across North America. Yet, to investigate this disconnect, we dug further in the defender’s mind and developed a survey on the perceptions and practices of cybersecurity professionals in collaboration with Serene-Risc, a Canadian knowledge mobilization network in cybersecurity. The survey aimed at understanding how defenders perceive specific security measures and whether these measures were implemented in their respective organizations. The microdata of the survey can be accessed on the Serene-Risc website.

With the survey results and our penetration testing experience, we confronted two perspectives: the defenders’ and the pentesters’, the latter standing as proxies for real attackers. The report is divided in two key sections sprinkled with pro-tips to maximize value for defenders.

First, we confronted defenders and attackers by comparing the perceptions and practices of the 120 survey respondents with our pentesters’ experience, covering security topics like:

• Multi-factor authentication,
• Password policies,
• Specific security measures,
• Patch management,
• Products’ features enabled by default,
• Asset inventories, and
• Endpoint visibility.

Then, we investigated if a relationship exists between respondents’ perceived maturity security of their organization and the measures mentioned above using a statistical model. We found that the more these security measures were reported as implemented, the higher the perceived security maturity except for these two measures: minimum password requirements and investigating products for features that could represent a risk. These measures did not correlate with respondents’ perceived security maturity.

Then, the top 10 vulnerabilities/missing controls found in 65 penetration testing reports, encompassing 182 findings, are presented in the report. These include findings like weak password requirements, Windows credentials stored in memory, presence of NetBIOS/LLMNR and more.

By cross-referencing the results from the statistical model with the penetration testing findings, we discovered an important information gap: the two security measures not related to perceived security maturity are closely linked to major attack vectors found in penetration testing reports!

 
Conclusion
Overall, this study uncovers potential information gaps and biases in the defenders’ mindset. And through actionable pro tips, it also presents how defenders can overcome these biases by building their security practices to harden their security postures against real adversaries.

Cybersecurity Perceptions Versus Reality will be valuable to both cybersecurity professionals and executives in understanding, delivering, and requiring beneficial and cost-effective cybersecurity measures that might have been under the radar. This blog is the first of a series that will dive deeper into individual findings. Stay tuned!

The French version of the report is available here.