www.blackhat.com
June 2018

The 2018 Black Hat USA Attendee Survey

Where Cybersecurity Stands
Once seen primarily as a technology question, cybersecurity now involves issues of personalprivacy, politics, business, ethics, and risk. Here’s a look at the concerns, attitudes, and plans ofsome of the industry’s top IT security professionals.

CONTENTS

Where Cybersecurity Stands

3 Executive Summary

Figures

6 Research Synopsis

7 Figure 1: Time Spent

7

8	Figure 2: Impact of European GDPR
Requirements

Cybersecurity’s New Dimensions

9 A Political Struggle
11 The Critical Infrastructure Threat
12 The Threat to the Enterprise
15 Where Security Professionals Stand
18 Conclusion

9	Figure 3: Organization’s Response to
Facebook Usage
10	Figure 4: Personal Approach to Facebook
Usage
11 Figure 5: Today’s Security Issues
12	Figure 6: Greatest Threat to US Critical
Infrastructure
13	Figure 7: Likelihood of a Major Security
Breach in Next Year
14 Figure 8: Sufficient Training
15	Figure 9: Security Professionals’ Greatest
Concerns
16 Figure 10: Failure of IT Security Strategies
17 Figure 11: Weakest Link in IT Defenses
18 Figure 12: Most-Feared Cyber Attacker

19	Figure 13: Effectiveness of Technologies inProtecting Data
20 Figure 14: Sufficient Security Staff
20 Figure 15: Sufficient Security Budget
21	Figure 16: Response to Major Security
Vulnerability
22 Figure 17: Security Activities
23	Figure 18: Plans to Seek an IT Security
Position
24 Figure 19: Political Affiliation
25 Figure 20: Respondent Salary
26 Figure 21: Respondent Job Title
27 Figure 22: Respondent Company Size
28 Figure 23: Respondent Industry
29	Figure 24: Respondent Security Certifications
and Training Certificates
30 Figure 25: Country of Residence

TABLE OFwww.blackhat.com

June 2018 2

Where Cybersecurity Stands

SUMMARY

Table of Contents

EXECUTIVE

www.blackhat.com

In the early days of computers and the Internet, “computer security” was viewed primarily
as a technological question. For decades, it was approached as an arms race between “goodgeeks” and “bad geeks,” where tech-savvy, ethical professionals developed new ways ofdefending critical data, and tech-savvy cybercriminals found ways to break those defenses.
Today, however, information technology has become the underlying platform for humaninteraction — the infrastructure for business, for social community, and for political action,
both cooperative and confrontational. And today’s cybersecurity professionals, once focused
primarily on technology and stereotyped as geeks, now find themselves at the heart of someof the most important social, geopolitical, and commercial issues of the new millennium.
How can humans safely communicate electronically — and still maintain their privacy?
Is it possible to conduct a democratic election without interference from hackers or rival
countries? How can businesses safely and universally exchange money or data? These are justa few of the challenges that today’s IT security leaders are confronting.
To find out where the cybersecurity community stands — its attitudes, its fears, and its plans— Black Hat, the organization that convenes these top IT security leaders together every
year, conducted a survey in May of 2018 to ask about some of the most critical issues of theday. The survey, which has been conducted annually since 2015, interviewed 315 current
and former attendees of the Black Hat USA conference. Among the survey respondents were
chief executives, CISOs, CIOs, chief technology officers, security specialists and researchers
from organizations in more than 20 sectors, ranging from financial services to healthcare togovernment. Nearly two thirds (63%) of the respondents hold the CISSP security certification;
many respondents also hold other certifications, including CEH (35%), CompTIA Security(35%), or MCSE (30%).
June 2018 3

Where Cybersecurity Stands
Table of Contents

The survey asked respondents about their most critical concerns — the things that keepthem awake at night — and about their plans for the future. We also asked them about someof their concerns about critical infrastructure, as well as their opinions on current events
that involve cybersecurity, including privacy, political elections, international relations, andcryptocurrency.
The survey results suggest that the world’s top cybersecurity professionals are becoming
increasingly concerned not only about the safety of their own users and data, but about
the security of increasingly connected systems, the stability of national and international
environments, and the privacy of individuals. In short, the professionals who are most familiar
with today’s cybersecurity environment are in broad agreement that the systems that today
serve as platforms for personal, political, and financial interchange are at significant risk ofcompromise — or even collapse.
The 2018 Black Hat USA Attendee Survey provides a look at cybersecurity professionals’ views
and insights on a wide range of topics, including:• Following recent news of misuse of data, 55% of security professionals are advisinginternal users and customers to rethink the data they are sharing on Facebook; 65% arelimiting their own use of Facebook or avoiding it entirely due to security concerns.
• Following the deadline for the European Union’s new privacy regulation (GDPR, theGeneral Data Protection Regulation), 30% say they don’t know if their organizations arein compliance, or they haven’t started GDPR initiatives and are concerned. Furthermore,
more than a quarter (26%) do not believe they are subject to GDPR.

www.blackhat.com

June 2018 4

Where Cybersecurity Stands
Table of Contents• Most IT security pros (52%) believe that Russian cyber initiatives made a substantial
impact on the 2016 U.S. elections; 71 percent believe that cyber activity from Russia,
China, and North Korea is making U.S. data less secure.
• Nearly seven out of ten respondents (69%) believe that a successful cyberattack on U.S
critical infrastructure will occur in the next two years; only 15% believe that government
and private industry are prepared to respond.
• Only 13% of IT security leaders believe that Congress and the White House understandthe cyber threat; only 16% approve of President Trump’s performance so far.
• Nearly six in 10 of the respondents (59%) believe they will have to respond to a major
security breach in their own organization in the coming year; most do not believe they
have the staffing or budget to defend adequately against current and emerging threats.

www.blackhat.com

June 2018 5

Where Cybersecurity Stands

ABOUT USFor more than 18 years,
Black Hat has provided
attendees with the verylatest in information security
research, development, andtrends. These high-profile
global events and trainings
are driven by the needs of the
security community, striving tobring together the best minds
in the industry.
More information is available
at: http://www.blackhat.com.

www.blackhat.com

SYNOPSIS

Table of Contents

RESEARCH

Survey Name

2018 Black Hat USA Attendee Survey

Survey Date

May 2018

RegionUnited States

Number of Respondents 315 IT and security professionals. The greatest possible marginof error for the total respondent base (N=315) is +/- 5.5%. UBM was responsible for all
programming and data analysis. These procedures were carried out in strict accordance withstandard market research practices.
Purpose To gauge the attitudes and plans of one of the IT security industry’s mostexperienced and highly trained audiences: attendees of the Black Hat USA conference.
Methodology In May 2018, Black Hat and UBM researchers conducted a survey of IT andsecurity professionals who attended the Black Hat USA conference in 2017 and/or wereplanning to do so in 2018. The online survey yielded data from 315 management and staff
security professionals, predominantly at large companies, with 62% working at companies
with 1,000 or more employees. Sixty-three percent of the respondents hold the CISSP security
professional credential, 35% were certified ethical hackers (CEH).

June 2018 6

Where Cybersecurity Stands
Table of Contents

Cybersecurity’s New Dimensions
Since the earliest days of telephony andcomputing, security has generally been seen asa technological problem. When hackers founda way to break into networks or data, security
professionals jumped in with new defenses toprotect them. Technological attacks were met
with technological defenses, and the players
on both sides were the most tech-savvy —the “geeks” of IT.
In recent years, however, security professionals — and cyber attackers — have becomea part of the mainstream. Politics, international
relations, commerce, money, even humanrelations themselves are now affected by thedecisions made — or not made — by security
teams. And security professionals, once seen
as techno-geeks, are now involved in criticalissues such as nationwide elections, global
cryptocurrency, and fundamental personalprivacy.
The 2018 Black Hat Attendee Survey
attempted to provide a snapshot of thissea change by not only asking conference
attendees — some of the most highly qualified security professionals in the world —www.blackhat.com

Figure 1

Time SpentWhich consume the greatest amount of your time during an average day?

 2018  2017

The effort to keep my organization in compliance with industry and regulatory security guidelines

40%

32%

Phishing, social network exploits, or other forms of social engineering

39%

35%

The effort to accurately measure my organization’s security posture and/or risk

36%

35%

Security vulnerabilities introduced by my own application development team

22%

26%

Security vulnerabilities introduced through the purchase of off-the-shelf applications or systems

22%

21%

Accidental data leaks by end users who fail to follow security policy

20%

18%

Internal mistakes or external attacks that cause my organization to lose compliance with industry or regulatory requirements 18%

21%

Sophisticated attacks targeted directly at the organization

14%

16%

Attacks or exploits on cloud services, applications, or storage systems used by my organization

11%

10%

The potential compromise of cloud services providers that my organization relies on

8%

N/A

Attacks or exploits brought into the organization via mobile devices

7%

6%

Attacks on suppliers, contractors, or other partners that are connected to my organization’s network

7%

3%

Polymorphic malware that evades signature-based defenses

7%

9%

Data theft or sabotage by malicious insiders in the organization

7%

5%

Digital attacks on non-computer devices and systems (the Internet of Things)

5%

5%

Ransomware or other forms of extortion perpetrated by outsiders

4%

12%

Espionage or surveillance by foreign governments or competitors

3%

6%

Cryptocurrency mining and its potential impact on my enterprise network

3%

N/A

Data theft, sabotage, or disclosure by “hacktivists” or politically motivated attackers

2%

3%

Surveillance by my own government

0%2%Note: Maximum of three responses allowed
Base: 315 respondents in 2018 and 580 respondents in 2017
Data: UBM survey of security professionals, May 2018

June 2018 7

Where Cybersecurity Stands
Table of Contents

about the state of cybersecurity. In the survey,
315 well-credentialed security leaders —about three quarters (76%) based in the UnitedStates and most (62%) working in enterprisesof 1,000 employees or more — offer insightnot only on the technological challenges facedby the cybersecurity industry, but on the legal,commercial, and political challenges, and on
the security and privacy of the individual in
today’s highly connected world.
While there are many new threats and challenges faced by security pros in the coming
year, perhaps the newest and most important
challenge is that of the individual’s right toprivacy — and the steps that enterprises andgovernment must take to protect that privacy.
From a regulatory perspective, that challenge
is manifested in the European Union’s General
Data Protection Regulation (GDPR), whichbegan enforcement action in May and requires
enterprises to meet specific guidelines on thehandling of personal data — and face enormous fines if they don’t. From a practicalperspective, the privacy issue is manifested inheadlines about social networking giant Facebook, which stands accused of oversharing
personal information with data brokers.

www.blackhat.com

GDPR is very much on the minds — and task
lists — of security professionals this year. The
effort to achieve compliance now has become
the single most time-consuming issue facedby survey respondents, ranking as a top timeconsumer by 40% — more than targeted
attacks and insider data leaks combined(Figure 1). And while 44% of respondents
have already invested in GDPR complianceefforts and feel generally comfortable in theircompliance, another 30% say they don’t know
if their organizations are in compliance, orthey haven’t started GDPR initiatives and areconcerned. Furthermore, more than a quarter(26%) do not believe they are subject to GDPR
— which seems unlikely, since most large
enterprises do at least some business with
European customers (Figure 2).
The issue of data misuse — illuminated by,
but by no means limited to, recent revelations

Figure 2

Impact of European GDPR Requirements
Which statement best describes the impact of European GDPR
requirements on your organization this year?
We are not subject to the GDPR requirements because we don’t maintain any European data26%

We have spent some resources on compliance and we don’t believe we are at risk25%

We have put a lot of resources into meeting the guidelines and we are confident we are in compliance19%

We have barely begun our GDPR initiatives and we are not sure what our risk may be

8%

We are behind in compliance and I am concerned that we may be at risk of serious penalties

4%

Don’t know

18%

Base: 315 respondents in 2018; not asked in 2017
Data: UBM survey of security professionals, May 2018

June 2018 8

Where Cybersecurity Stands
Table of Contents

about Facebook’s privacy practices — hasalso raised the consciousness of IT security
professionals, both at their jobs and at home.
A majority of our survey respondents (55%)
say they plan to advise internal users andcustomers to rethink the data they are sharing
on Facebook as a result of the allegations.
Another 30% of respondents plan to push for
additional security controls around access totheir corporate Facebook accounts; 18% plan
to advise their organizations to radically reduce

the use of Facebook (Figure 3).
The news about Facebook’s alleged misuseof private information has had an even greater
impact on security professionals’ personal
approach to the social network. Forty-fourpercent of those surveyed said they plan tokeep their accounts, but will minimize their
Facebook usage. Seven percent said they aredeleting their accounts; 14 percent said they
didn’t use Facebook in the first place because
of security concerns. Only 25% said they plan

Figure 3

Organization’s Response to Facebook Usage
What will you advise your organization to do about Facebook after
recent revelations about the use of Facebook data?
I will advise internal users and customers to rethink the data they are sharing on Facebook

55%

I will push for additional security controls around access to our corporate Facebook accounts

30%

My organization doesn’t use Facebook and has no plan to do so25%

My organization must maintain a presence on Facebook, so all I can do is maintain the privacy settings

23%

I will advise my organization to radically reduce the use of Facebook

18%

Note: Multiple responses allowed
Base: 315 respondents in 2018; not asked in 2017
Data: UBM survey of security professionals, May 2018www.blackhat.com

to continue to use Facebook regularly, withappropriate privacy settings (Figure 4).
The recent issues with social networks,
combined with never-ending reports of data
breaches and compromise of personal information, has caused many security professionals toconclude that the protection of an individual’s
private information, no matter how carefully
protected, is impossible. In the 2018 Black Hat
Attendee Survey, only 26% of respondents said
they believe it will be possible for individuals
to protect their online identity and privacy inthe future. This is a bleak outlook indeed whencoming from those who understand the threat
best, and in many cases, are professionallytasked with protecting that data (Figure 5).
A Political Struggle
While privacy may be the latest challenge forsecurity professionals, another challenge isalso fresh in their minds: politics. While GDPR
is driving many of our U.S. respondents toconsider how much data they handle from
Europe, many are also contending with cyberthreats from foreign governments — and frustration with their own government at home.
For today’s information security departments,

June 2018 9

Where Cybersecurity Stands
Table of Contents

the threat of nation-state-sponsored attacks
is very real. Seventy-one percent of respondents said that recent activity emanating from
Russia, China, and North Korea has made U.S.
enterprise data less secure. Fifty-two percent
believe that Russian cyber initiatives made asignificant impact on the outcome of the 2016
U.S. presidential election.
In response to an open-ended question about
what global or political issue concerns themmost, many security pros cited nation-state
sponsored threats, ranging from espionage
to steal U.S. business data to all-out cyberwar.
One respondent cited concern over the “lackof understanding by the general public as to
the real result of nation-state hacking: loss ofcritical intellectual property, access to intelligence, and destabilization of both financial
and critical infrastructure.”
Compounding these concerns is a lack ofconfidence in the U.S. federal government’s
ability to manage the cybersecurity problem. In
our survey, only 13% of respondents said they
believe that Congress and the White House
understand the cyber threat and will takeadequate steps to secure critical infrastructurein the future. Only 16% say they approve of U.S.

www.blackhat.com

Figure 4

Personal Approach to Facebook Usage

What is your personal approach to Facebook after recent revelations about theuse of Facebook data?
I will keep my account, but I plan to minimize my usage44%

I plan to use it regularly with appropriate privacy settings

25%

I have never used Facebook because of security concerns

14%

I have never used Facebook because it doesn’t interest me

10%

I am deleting my account7%

Base: 315 respondents in 2018; not asked in 2017
Data: UBM survey of security professionals, May 2018

President Donald Trump’s performance thus
far. Interestingly, however, most information
security professionals do not play party politics: just 12% identified themselves as Republicans, and 16% identified as Democrats. Tenpercent are Libertarian, 26% are independents,and 36% preferred not to answer (Figure 19).
In the open-ended question about thechief global/political issue that worries themmost, many respondents cited issues affecting
the U.S. federal government, including elec-tion fraud, shortage of government cyber
resources, and the recent decision to do awaywith the federal cyber adviser/czar position.
About a dozen of the 179 responses to thisoptional, open-ended question cited President
Trump as the primary concern.
While not a political issue yet, many respondents also registered a great deal of interest
and concern about the emergence of cryptocurrency, which has alternately been hailed asa boon to currency exchange and as a threat

June 2018 10

Where Cybersecurity Stands
Table of Contents

to currency trading. While they are perhaps respondents believe that an attack by a finanamong the most knowledgeable about cryp- cially motivated cybercriminal organization istocurrency, our respondents were mixed in of greater concern than an attack by a polititheir attitudes toward Bitcoin trading: some
Figure 529% said investing in Bitcoin and other cryptocurrencies is a good idea for those who know
Today’s Security Issues
what they’re doing; 43% disagree.

cally motivated terrorist organization (7%) ora rogue nation-state such as North Korea (3%)(Figure 6).

Please rate your level of agreement with the following statements.

The Critical Infrastructure Threat
Whether it comes from a large nation-state,a rogue nation, or a terrorist group, security
professionals are fairly certain that an attack
on U.S. critical infrastructure is coming. In
fact, 69% or our survey respondents expect
a successful cyberattack on U.S. critical infrastructure will take place within the next two
years. This figure rose in this year’s survey
from 60% in 2017. Only 11 percent don’t
think it’s going to happen. In the open-ended
question asking which global/political issue
worried respondents most, more than adozen respondents wrote something related
to cyberwar.
Of the various threats to U.S. critical infrastructure, 43% of security pros believe thatthe greatest is an attack by a large nation-statesuch as Russia or China. Interestingly, more

www.blackhat.com

 Agree (Strongly or Somewhat) Neutral Disagree (Strongly or Somewhat)

It is more important than ever for security researchers to follow the practice of coordinated disclosure when they discover a new vulnerability
87%
9%
4%
Recent activity emanating from Russia, China, and North Korea has made US enterprise data less secure.
71%

20%

9%

I believe that a successful cyberattack on the critical infrastructure of the US will occur in the next two years.
69%
20%
I believe that Russian cyber initiatives made a significant impact on the outcome of the 2016 US presidential election.
52%
29%

11%
19%

The shortage of women and minorities in the information security profession is a concern to me
47%

31%

22%

If you know what you’re doing, investing in Bitcoin and other cryptocurrencies is a good way to make money
29%

28%

43%

I believe that in the future, it will be possible for individuals to protect their online identity and privacy
26%

18%

56%

I approve of President Trump’s performance thus far
16%

31%

53%

I believe that government and private industry are adequately prepared to respond to a major breach of US critical infrastructure.
15%
19%
66%
I believe that Congress and the White House understand the cyber threat and will take adequate steps tosecure critical infrastructure in the future
13%
18%
69%
Base: 315 respondents in 2018; not trendable to 2017
Data: UBM survey of security professionals, May 2018

June 2018 11

Where Cybersecurity Stands
Table of Contents

Figure 6

Greatest Threat to US Critical Infrastructure

What is the greatest threat to the cybersecurity of US critical infrastructure?
A potential attack by large nation-states

43%

A lack of coordination between US government entities and private industry

16%

The worldwide shortage of IT security personnel, skills, and training

12%

A potential attack by financially motivated, organized criminals

11%

A potential attack by a politically motivated organization

7%

A lack of coordination among US government agencies

5%

A potential attack by a single nation

3%

Other

3%

Base: 315 respondents in 2018; not asked in 2017
Data: UBM survey of security professionals, May 2018

While the certainty of knowledgeable,
professional cybersecurity professionals about
the likelihood of a critical infrastructure attack
is a major concern, it is exacerbated by those
professionals’ lack of confidence in the UnitedStates’ ability to respond to such an attack. In
fact, only 15% of respondents said they believethat U.S. government and private industry areadequately prepared to respond to a major

www.blackhat.com

breach of critical infrastructure. When asked toname the greatest threat to critical infrastructure security, 16% cited a lack of coordination
between federal government entities andprivate industry, making this the number two
response. Five percent cited a lack of coordination among U.S. government agencies, whichmeans that 21% of security pros believe thatthe greatest threat to U.S. critical infrastructure

is a lack of preparedness and communication
among the defenders.
“Our United States government has NO clue
about technology, the Internet, and how ourmodern era’s data and information moves,”
commented one respondent. “It’s absolutely
terrifying that these people make laws andguide our nation. They are obsolete.”
The Threat to the Enterprise
While information security professionals
may have added new privacy and politicaldimensions to their scope of concern, they
haven’t taken their eyes off their central role:
protecting enterprise data. Unfortunately,
as in past years, most security pros are still
feeling vulnerable to attack.
When asked whether they believe their organizations will have to respond to a major security breach in the next 12 months, some 69%of respondents said they believe it is at least
somewhat likely. The percentage of respondents who say they have “no doubt” that sucha breach will occur has declined over the past
two years — from 15% in 2016 to 9% in 2018 —but the percentage who say it is “highly likely”
grew slightly, from 18% to 21%, in the last year.

June 2018 12

Where Cybersecurity Stands
Table of Contents

Figure 7

Likelihood of a Major Security Breach in Next YearHow likely do you think it is that your organization will have to
respond to a major security breach in the next 12 months?

 2018  2017

I have no doubt that we will have to respond to a major incident in the next 12 months

9%

13%

It’s highly likely

21%

18%

It’s somewhat likely

29%

36%

It’s somewhat unlikely

22%

18%

It’s highly unlikely

11%

7%

Don’t know

8%

8%

Base: 315 respondents in 2018 and 580 respondents in 2017
Data: UBM survey of security professionals, May 2018

And while the degrees of concern may vary,
the overall numbers have remained consistentover the past four years: more than two-thirdsof security professionals expect to face a major
breach in the coming months (Figure 7).
And, as in past years, the reasons for thisconcern center on a lack of resources. For the
fourth straight year, approximately two-thirdsof survey respondents said they do not haveenough staff (65%) to defend their organiza-

www.blackhat.com

tions against current threats (Figure 14). Fiftythree percent said they do not have enoughbudget — an improvement over the 63% of
2016, but still a majority (Figure 15). Sixtysix percent said they themselves do not haveenough training to handle current threats andperform all of the job functions required ofthem (Figure 8).
This year’s survey also revealed anotherissue in cyber defense: a lack of confidence intechnology. For the first time, we asked security professionals to rate the effectiveness of awide range of technologies available to enterprise security teams, from old-school solutions
such as antivirus to emerging technologies
such as orchestration and deception. In a listof 18 available technologies, however, only
three were rated as “very effective” or “somewhat effective” by a majority of respondents:
encryption, multifactor authentication tools,
and firewalls. The other 15 technologies wererated “effective” by 47% of respondents or
fewer. Passwords, perhaps the most universalof security technologies, were rated “effective”
by only 19% of security pros, and “ineffective”
by 37% (Figure 13).
When it comes to what worries them most,security professionals registered many of thesame top concerns as in past years: sophisticated, targeted attacks ranked at the top of
the list (47%), followed by phishing and social
engineering (40%). However, there were two
new concerns that registered in the top five:potential compromises of cloud services (22%)
and attacks or exploits targeted at cloud applications, storage systems, or services used by
the organization (16%). Asked in an open-

June 2018 13

Where Cybersecurity Stands
Table of Contents

Figure 8

Sufficient Training

Do you personally have enough training and skills to handle current threats andperform all of the security job functions that are required of you?

2018

 34%

Yes, I have all the skills I need to do my job

 33%

 57%

No, I can manage most tasks but
I could still use some training

 61%

 7%

No, I feel ill-prepared for many of
the threats or tasks I face each day

 5%

 2%

What training?

 1%

2017

Base: 315 respondents in 2018 and 580 respondents in 2017
Data: UBM survey of security professionals, May 2018

ended question about what keeps security
pros awake at night, one respondent said “Amajor compromise of cloud resources — e.g.
root account access — allowing control ofhigh-level servers, compromising customer orenterprise-related data” (Figure 9).
Yet, while the shortcomings of current
security technology and potential vulnerabilities in emerging cloud services are new
aspects of security’s current landscape, it isan old nemesis — staffing shortages — that
continues to plague the data centers andwww.blackhat.com

minds of Black Hat Attendee Survey respondents. When asked to name the primary reason
why enterprise security strategies fail, some
34% of respondents cited a shortage of qualified people and skills, making this the number
one answer given. A lack of commitment andsupport from top management (23%) was thenumber two response; the numbers on both
responses were up from a year ago (31% and19%, respectively) (Figure 10).
“Diversity of thought, skill sets, and backgrounds is what is needed in order to buildrisk-based, comprehensive, and effective solutions,” said one respondent to an open-ended
question about what needs to be fixed incybersecurity. “The team needs to be madeup of more than just network engineers or
previous SOC analysts or hackers. You need ateam that understands security, understands
the business, operations, the threat landscape,metrics, organizational behavior, etc. At theend of the day, people make the decisions.”
Yet, while the need for people represents
the greatest hope for some survey respondents, it is human weaknesses that leads to
the greatest concerns of others. Accidental
data leaks ranked third among respondents’concerns in our survey (22%); end users who
violate corporate security policy ranked as theweakest link in today’s enterprise IT defenses(38%) (Figure 11). The attacker that security
professionals fear most, as in past years, is theindividual who has inside knowledge of theorganization (Figure 12).
“Insider threat is my biggest concern,” said
one respondent in answer to the open-ended
question about what keeps security pros
awake at night. “All security systems haveauthorized users who can bypass the security,

June 2018 14

Where Cybersecurity Stands
Table of Contents

Figure 9

Security Professionals’ Greatest Concerns

Of the following threats and challenges, which concern you the most?
Sophisticated attacks targeted directly at the organization

47%

45%

Phishing, social network exploits, or other forms of social engineering

40%

50%

Accidental data leaks by end users who fail to follow security policy

22%

21%

The potential compromise of cloud services providers that my organization relies on

22%

N/A

Attacks or exploits on cloud services, applications, or storage systems used by my organization

16%

15%

Data theft or sabotage by malicious insiders in the organization

16%

16%

Internal mistakes or external attacks that cause my organization to lose compliance with industry or regulatory requirements 15%

12%

Attacks on suppliers, contractors, or other partners that are connected to my organization’s network

15%

7%

Security vulnerabilities introduced by my own application development team

14%

15%

Polymorphic malware that evades signature-based defenses

12%

20%

Ransomware or other forms of extortion perpetrated by outsiders

11%

17%

Attacks or exploits brought into the organization via mobile devices

9%6%

Digital attacks on non-computer devices and systems (the Internet of Things)

9%

12%

Espionage or surveillance by foreign governments or competitors

9%

11%

The effort to keep my organization in compliance with industry and regulatory security guidelines

9%7%

The effort to accurately measure my organization’s security posture and/or risk

9%

14%

Security vulnerabilities introduced through the purchase of off-the-shelf applications or systems

8%

11%

Cryptocurrency mining and its potential impact on my enterprise network

5%

N/A

Data theft, sabotage, or disclosure by “hacktivists” or politically motivated attackers

4%8%Surveillance by my own government2%5%Note: Maximum of three responses allowed
Base: 315 respondents in 2018 and 580 respondents in 2017
Data: UBM survey of security professionals, May 2018www.blackhat.com

 2018  2017and if one of those people becomes a threat,
there is very little that can be done to stopthat person. While solutions exist, such as twoperson controls, they are too expensive andimpractical to implement everywhere.”
Where Security Professionals StandWe’ve discussed what concerns security
professionals on an individual level, on a
global level, and at an enterprise level. But
what about their own personal interests andconcerns? What are their passions and theirgoals? In the 2018 Black Hat Attendee Survey,
we found out about some of those, too.
One issue security pros care about, nearly
universally, is the issue of “coordinated disclosure,” the set of rules that ethical hackers use
when they do security research and test forvulnerabilities. The rules of coordinated disclosure state, for example, that a researcher
should give the affected parties a chance torepair vulnerabilities to remediate a security
flaw before disclosing it to the public. In recent
years, however, many companies, governments, and other organizations have instituted“bug bounty” programs that pay researchersfor vulnerabilities without necessarily requiring

June 2018 15

Where Cybersecurity Stands
Table of Contents

Figure 10

Failure of IT Security Strategies
What is the primary reason current enterprise IT
security strategies and technologies fail?

 2018  2017

A shortage of qualified people and skills

34%

31%

A lack of commitment and support from top management

23%

19%

A lack of integration in security architecture; too many single-purpose solutions

16%

19%

There are too many vulnerabilities in the rapidly evolving enterprise IT environment

12%

11%

The inability of security technology to keep up with attackers’ new exploits

9%8%

A shortage of budget

2%

5%

Other

4%

7%

Base: 315 respondents in 2018 and 580 respondents in 2017
Data: UBM survey of security professionals, May 2018

coordinated disclosure, potentially weakening
the need for traditional rules and obligations.
In our survey, security pros indicated thatthe spirit of coordinated disclosure is alive andwell among the community of ethical hackers.
In fact, some 87% of respondents agreed withthe statement “It is more important than everfor security researchers to follow the practiceof coordinated disclosure when they discoverwww.blackhat.com

a new vulnerability.” Only 4% disagreed. When
asked what they would do if they themselves
discovered a new vulnerability, 82% of security pros said they would follow the practicesof coordinated disclosure; only 12% said theywould sell it to the highest bidder throughforums or bug bounty programs (Figure 16).
These results suggest that there remains astrong need for forums and conferences likethe Black Hat events, which help researchers
speak about new vulnerabilities only after they
have completed the coordinated disclosure
process.
Do security professionals do security
research themselves? More than two-thirds(68%) of Black Hat attendees said they do.
Sixty-four percent said they do penetration
testing. But when it comes to online activities
that aren’t relevant to their day jobs, or thatmight be less ethical, the percentages drop off
significantly. For example, only 12% of respondents said they try to crack targeted systems or
websites just to see if they can get in. Only 13%
of respondents said they browse and communicate with others on the Dark Web; only 2%
said they buy and sell items on the Dark Web(Figure 17).
Interestingly, while the world of cryptocurrency trading and mining seems of greatinterest to today’s security professionals, very
few of them seem to be directly involved.
In our survey, just 15% of respondents said
they do cryptocurrency buying and selling;
only 29% agreed with the statement, “If you
know what you’re doing, investing in Bitcoin
and other currencies is a good way to make

June 2018 16

Where Cybersecurity Stands
Table of Contents

Figure 11

Weakest Link in IT Defenses

What is the weakest link in today’s enterprise IT defenses?

 2018  2017

End users who violate security policy and are too easily fooled by social engineering attacks

38%

38%

A lack of comprehensive security architecture and planning that goes beyond “firefighting”

18%

15%

An overabundance of security information and event data that takes too long to analyze

7%6%Signature-based security products that can’t recognize new and zero-day threats

6%

5%

Cloud services and cloud application vulnerabilities

6%

5%

Single-function security tools and products that don’t talk to each other5%

3%PC, Mac, and endpoint vulnerabilities

5%

6%

Vulnerabilities in internally developed software

5%

5%

Mobile device vulnerabilities

4%

10%

Vulnerabilities in off-the-shelf software

4%5%Web-based threats and the failure of SSL and digital certificates

0%

1%

Other

3%

1%

Base: 315 respondents in 2018 and 580 respondents in 2017
Data: UBM survey of security professionals, May 2018

money.” And while cryptocurrency mining has
been reputed to be a growing trend among
the security-savvy, only 12% of survey respon-www.blackhat.com

dents say they are doing it. Are security pros
worried that cryptocurrency miners might try
to tap their own enterprise systems to gain

additional processing power? Only 5% of
respondents rated this as a top concern.
On a career level, most security professionals seem happy with their positions. When
asked whether they are actively looking for
employment right now, only 11% responded
positively, down a point from 2017. Even thepercentage of respondents who said they are
updating their resumes is down, going from
20% in 2017 to 17% this year. Twenty-eightpercent said, “I really love my job and myemployer, and it would take a LOT to get me
to move” (Figure 18).
One reason why information security pros
are happy is the money they make. According
to our survey, some 30% of respondents make
$150,000 or more annually; 6% make $250,000
or more. Some 69% of security professionals
make a six-figure salary — no small feat in
an economy where wages in other industries
have grown very slowly (Figure 20).
Still, many of today’s security professionals
would like to see their colleagues — particularly women and minorities — finding better
employment opportunities. Recent studies
indicate that women make up less than 15%of the cybersecurity workforce; minorities

June 2018 17

Where Cybersecurity Stands
Table of Contents

account for about 26%. In our survey, 47% of
respondents said that the shortage of womenand minorities in the information security
profession is a concern to them.

Conclusion
The security environment of 2018 is more
complex than the environment described in
the first Black Hat Attendee Survey conductedfour years ago. In addition to dealing with ashortage of internal resources and an increasingly sophisticated level of attacks, today’s
IT security professionals find themselves
wrestling with a growing number of global,

political, personal, and business issues, manyof which they are called upon to manage on
behalf of their organizations. For today’s security leaders, it is becoming critical to not only
pay attention to the threats and issues insidetheir own organizations, but to issues that
affect global commerce and communications— and society as well.

Figure 12

Most-Feared Cyber Attacker

The cyber attacker I fear most is the one who has ...

 2018  2017

Inside knowledge of my organization

40%

39%

Strong backing and financing by organized crime or nation-states

17%

17%

Highly sophisticated attack skills

17%

11%

Knowledge of vulnerabilities that have never been exploited before

14%

20%

A well-organized network of threat actors

10%

11%

Other

2%

2%

Base: 315 respondents in 2018 and 580 respondents in 2017
Data: UBM survey of security professionals, May 2018www.blackhat.com

June 2018 18

Where Cybersecurity Stands
Table of Contents

Figure 13

Effectiveness of Technologies in Protecting Data

APPENDIX

Please rate the effectiveness of the following technologies in protecting enterprise data.

www.blackhat.com

 Effective (Very or Somewhat Effective)
Encryption

 Neutral

 Not Effective (Not at All or Not Very Effective)

79%

19%

2%

20%

2%

Multifactor authentication tools
78%

Firewalls
62%

29%

9%

SIEM
47%

44%

9%

Endpoint security tools
44%

45%

11%

44%

13%

Threat intelligence
43%

Security data analysis tools
43%

48%

9%

Application security tools
39%

51%

10%

Cloud security tools
38%

53%

9%

Endpoint detection and response (EDR) tools
35%

56%

9%

Cloud services providers
34%

53%

13%

Orchestration tools
32%

57%

11%

Managed security service providers
31%

48%

21%

Antivirus
30%

40%

30%

Deception/honeypots
28%

54%

18%

Mobile security tools
26%

53%

21%

Data leak protection
25%

50%

25%

Passwords
19%

44%

37%

Base: 315 respondents in 2018; not asked in 2017
Data: UBM survey of security professionals, May 2018

June 2018 19

Where Cybersecurity Stands
Table of Contents

Figure 14

Sufficient Security Staff

Does your organization have enough security staff todefend itself against current threats?

 2018  2017

Yes

35%

29%

No, we could use a little help

48%

50%

No, we are completely underwater

12%

17%

What staff?

5%

4%

Base: 315 respondents in 2018 and 580 respondents in 2017
Data: UBM survey of security professionals, May 2018

Figure 15

Sufficient Security Budget

Does your organization have enough security budget todefend itself against current threats?

 2018  2017

Yes

47%

42%

No, we are a little under budget

38%

37%

No, we are severely hampered by a lack of funding

10%

17%

Can you spare some change?

5%

4%

Base: 315 respondents in 2018 and 580 respondents in 2017
Data: UBM survey of security professionals, May 2018www.blackhat.com

June 2018 20

Where Cybersecurity Stands
Table of Contents

Figure 16

Response to Major Security Vulnerability

What would you do if you discovered a major security vulnerability today?
Inform the entities that might be affected, and then disclose it publicly after giving them time to remediate

82%

Seek out the most lucrative bug bounty to maximize compensation for my work

11%

Disclose it publicly immediately

2%

Keep it to myself

1%

Offer it broadly in online forums and then sell it to the highest bidder1%

None of the above3%

Base: 315 respondents in 2018; not asked in 2017
Data: UBM survey of security professionals, May 2018www.blackhat.com

June 2018 21

Where Cybersecurity Stands
Table of Contents

Figure 17

Security Activities

In which of these activities do you personally participate?
Vulnerability research

68%

Penetration testing64%

Cryptocurrency buying/selling

15%

Browsing and communicating with others on the Dark Web

13%

Cryptocurrency mining

12%

Cracking targeted systems or websites just to see if I can get in

12%

Buying and selling items on the Dark Web

2%

None of the above

17%

Note: Multiple responses allowed
Base: 315 respondents in 2018; not asked in 2017
Data: UBM survey of security professionals, May 2018www.blackhat.com

June 2018 22

Where Cybersecurity Stands
Table of Contents

Figure 18

Plans to Seek an IT Security Position
Do you have plans to seek an IT security position anytime
in the near future?

 2018  2017

I’m not doing any active job research, but if some other company called me, I would listen

40%

38%

I really love my job and my employer, and it would take a LOT to get me to move

28%

26%

No definite plans, but I am always updating my resume and looking for a better post

17%

20%

Yes, I am actively looking for employment right now

11%

12%

I am an indentured servant and would be beheaded if I tried to escape4%4%

Base: 315 respondents in 2018 and 580 respondents in 2017
Data: UBM survey of security professionals, May 2018www.blackhat.com

June 2018 23

Where Cybersecurity Stands
Table of Contents

Figure 19

Political Affiliation

What political party do you most identify with?
Independent

26%

Democrat

16%

Republican

12%

Libertarian

10%

Would rather not say

36%

Base: 315 respondents in 2018; not asked in 2017
Data: UBM survey of security professionals, May 2018www.blackhat.com

June 2018 24

Where Cybersecurity Stands
Table of Contents

Figure 20

Respondent Salary

What is your current annual salary?
3%
6%
4%
5%

 $250,000 or more
 $200,000–$249,999

9% $150,000–$199,999
19%

15%

 $100,000–$149,999
 $75,000–$99,999
 $50,000–$74,999

39%

 $30,000–$49,999
 Under $30,000

Data: UBM survey of 315 security professionals, May 2018www.blackhat.com

June 2018 25

Where Cybersecurity Stands
Table of Contents

Figure 21

Respondent Job Title

Which of the following best describes your job title?
Information security department staff

31%

Information security department manager or director

22%

Chief security officer

5%

Information technology executive (CIO, CTO)

5%

VP of IT or security

5%

Information technology director/head5%

President/CEO/managing director/other senior-level corporate executive

5%

Network/system administrator

4%

Internal auditor

3%

Director/VP (non- IT)

1%

Other

14%

Data: UBM survey of 315 security professionals, May 2018www.blackhat.com

June 2018 26

Where Cybersecurity Stands
Table of Contents

Figure 22

Respondent Company Size

How many employees are in your company in total?
 10,000 or more14%

 5,000 to 9,999
31%

14%

 2,500 to 4,999
 1,000 to 2,499
 500 to 999

10%

9%
13%

9%

 100 to 499
 Fewer than 100

Data: UBM survey of 315 security professionals, May 2018www.blackhat.com

June 2018 27

Where Cybersecurity Stands
Table of Contents

Figure 23

Respondent Industry

What is your organization’s primary industry?
Computer or technology manufacturer/tech vendor

20%

Banking/financial services/VC/accounting

12%

Consulting/business services

11%

Government

9%

Communications carrier/service provider

5%

Healthcare/pharmaceutical/biotech/biomedical

5%

Manufacturing & process (non-computer)4%

Insurance/HMOs

4%

Education

4%

Wholesale/trade/distribution/retail3%

Aerospace2%

Media/marketing/advertising2%

Transportation/logistics

2%

Travel/hospitality/recreation/entertainment

2%

Legal

2%

Solutions provider/VAR

2%

Other

11%

Data: UBM survey of 315 security professionals, May 2018www.blackhat.com

June 2018 28

Where Cybersecurity Stands
Table of Contents

Figure 24

Respondent Security Certifications andTraining Certificates

What security certifications/training certificates have you held, either now or in the past?
CISSP

63%

CEH

35%

CompTIA Security

35%

MCSE

30%

GIAC Security Essentials (GSEC)

15%

CISM

12%

CISA

10%

CSSP

3%

SSCP

2%

CSSLP

2%

CAP

1%

CSIH

1%

Note: Multiple responses allowed
Data: UBM survey of 315 security professionals, May 2018www.blackhat.com

June 2018 29

Where Cybersecurity Stands
Table of Contents

Figure 25

Country of Residence
In what country do you live?
United States

76%

Japan

2%

Germany2%Israel2%

United Kingdom

2%Australia

2%

Brazil2%

Canada

2%

Other

10%

Base: 315 respondents in 2018; not asked in 2017
Data: UBM survey of security professionals, May 2018www.blackhat.com

June 2018 30