Black Hat USA 2017 kicks off in Las Vegas on July 22, and this show attracts some of the savviest information security professionals in the world. Earlier this month, Black Hat organizers released the results of its third annual attendee survey in its Portrait of an Imminent Cybersecurity Threat report. Below, we highlight some of the key findings in this year's report and compare the results to those revealed by the 2016 survey. 

Black Hat Survey Says…

The 2017 Black Hat Attendee Survey gathered responses from 580 IT security professionals (including management and staff), 66% of whom work for organizations with 1,000 or more employees. This year's survey boasted more than double the respondents of 2016, and also covered new ground, including thoughts about risks to US critical infrastructure, nation-state cybersecurity threats, and risks to average consumers. As the report teases on its front page, "in most cases, defenders are not prepared." 

Heading to Black Hat USA 2017? Stop by and see us in Booth #1660! Beforehand, check out our cybersecurity experts' advice about keeping your data and devices safe while at the show.

Breaches Anticipated; Budgets, Staff, and Skills Still Lacking

Infosec professionals have a relatively grim outlook when it comes to the killer B's (breaches and budgets) and the killer S's (staffing and skills):

• 67% of survey respondents said it was likely they would have to deal with a “major security breach” in the 12 months following the survey, with 13% saying there was “no doubt” they would face the fallout from a major breach. These were both modest reductions from 2016 (72% and 15%, respectively).
• 60% agree that there will be a successful cyberattack on US critical infrastructure within the next two years; only 2% felt strongly that it would not happen. (This question was not asked in 2016.)
• 58% indicated that their departments do not have enough budget to counter current threats (vs. 63% in 2016).
• 20% said they are “severely hampered” by budget restrictions (just slightly below 2016's 21%).
• 71% of respondents feel their organization does not have enough staff to defend itself against current threats (down from 74% in 2016).
• 61% (vs. 57% in 2016) said though they can manage most tasks, they could use more training to handle current threats and perform all of their required job functions.

Alignment of Goals Remains an Issue

Like last year, most of the respondents said that the lack of qualified, skilled people is the biggest reason that enterprise IT strategies and technologies are failing (though the percentage dropped to 31% vs. 37% mark). And it probably comes as no surprise that respondents said susceptible and negligent end users are the “weakest link in today’s IT enterprise defenses.” with the percentage of finger-pointers rising from 28% in 2016 to 38% in this year's survey.

But all the blame can’t be placed on the shoulders of current employees (or the lack thereof). Also of concern are the 19% of respondents who said that “a lack of commitment and support from top management” is the top reason enterprises are unsuccessful in creating a cohesive, successful cybersecurity strategy. Though there are improvements over last year's results, infosec teams are still struggling to achieve organization-wide support:

• 42% of respondents (up from 35% in 2016) said that non-security professionals in their organization understand the IT security threats that face their business.
• 33% say those who understand are supportive of security efforts, an increase from the 25% mark tallied last year.
• 13% of respondents said those outside of their department are mostly “clueless” (down from 17% in 2016).

But what is perhaps the most interesting tale of the tape can be found when evaluating the responses to three different but related questions:

1. Of the following threats and challenges, which are of the greatest concern to you?
2. Which consume the greatest amount of your time during an average day?
3. Which are of greatest concern to your company’s top executives or management?

The charts below present the top eight answers to each of these questions in the 2017 survey, as well as comparison data from 2016. (Note: each question allowed a maximum of three responses.)

As noted in the chart, many of the top concerns remained consistent from 2016 to 2017, but there were some interesting changes to note:

• Phishing and social engineering attacks are now the most time-consuming activity for IT professionals in addition to being the top concern (up from #4 in 2016).
• Unlike 2016, ransomware and other extortion-based attacks are now a top concern for executive and management teams.
• Concerns about nation-state, espionage, and "hacktivist" activities dropped for both IT pros and executives this year. 

What remains troubling is that the top cybersecurity concerns of infosec professionals are not always shared by their management teams, nor are they the focus of day-to-day activities:

• On a daily basis, respondents are unable to spend a significant amount of time addressing four of their top eight security concerns. This is a red flag for ransomware in particular, which is the #5 worry for both IT pros and executives, but is not among the top action items.
• Infosec professionals and their executive management teams are only partially aligned with regard to pressing threats. Just five of the respondents’ top eight concerns are shared by their organizations’ executives (though there was an improvement from 2016, when just four of eight concerns matched up between the two).

There is an increased risk to organizations if infosec teams, managers, and executives continue to work at cross purposes. This disconnect was cited as a "comment theme" among respondents, with the report stating, "As in past years, security pros say they continue to struggle with corporate management that sets priorities differently than they would."

The Average Consumer Is Unaware, Unprotected

This year, the survey asked infosec professionals what they feel are the greatest issues for the average US consumer, a topic not covered in prior years:

• Lack of awareness about phishing and social engineering attacks was flagged as the most significant threat.
• The "constant breach of consumer information at companies entrusted with that data" was the second-most cited IT challenge for consumers.
• Just 14% of respondents feel that the average US consumer's personal data is safer now that it was in 2016.  

So...what does the average consumer's lack of awareness mean within the enterprise? The reality is that, generally speaking, those consumers are also employees. What they don't know can impact their personal security but also your organization's security posture. And their personal habits and lack of knowledge absolutely do transfer to the workplace, as is evidenced by our recently released User Risk Report.

As such, in addition to implementing technical safeguards (like whitelisting, antivirus updates, and vulnerability patches), organizations should prioritize security awareness training and deliver programs designed to raise awareness, educate users, and streamline reporting of and response to potential phishing threats. Our Anti-Phishing Training Suite offers an ideal option for organizations of all sizes as it pairs our ThreatSim® phishing tests, interactive training modules, and PhishAlarm® email reporting products to deliver a comprehensive solution for end-user risk management.