Chart 25: Were salaries the crucial factor discouraging cyber security job applicants in the public sector in 2020? (%) Public sector Average of all sectors YES 68% 79% NO 21% 0 20 32% 40 60 REGULATION OF THE USE OF CLOUD COMPUTING The amendment to the Act on Public Administration Information Systems effective from August 2020 introducing new rules for the authentication of cloud computing providers and services used by public authorities represents an important advance in cyber security in the public sector. During 2021, the amendment will be further amended and completed with security rules through implementing legislation the NÚKIB is preparing in the form of decrees. FINANCIAL SECTOR: THE HIGHEST BUDGETS AND THE ABSENCE OF SERIOUS ATTACKS Three-quarters of the respondents from the financial sector faced cyberattack attempts in 2020. The attacks resulted in cyber incidents in only less than one-third of the cases. Although financial institutions identified targeted phishing, DDoS attacks and ransomware as the most serious cyber incidents, similarly to the year before there was an absence of more severe incidents so the Czech financial sector can be described as relatively well secured. Banks and insurance companies try not to underestimate cyber security as any compromis­ ing of their information systems could have far-reaching financial and reputational consequences. Financial institutions invest the highest percentage of their budgets in cyber security of all sectors (Chart 26) and were the only ones to state that salaries were not a fundamental factor discouraging cyber security job applicants. More than half the respondents from 11 the financial sector did not decrease their budgets on cyber security in comparison with 2019. On the contrary, more than a quarter of them increased their budgets. Apart from cyber security experts, all financial institu­ tions also invest in employee training. Some organisa­ tions stated that, besides using standard methods of testing, they also planned to implement an internal Red Team.11 Clients of financial institutions faced vishing (a portmanteau of voice and phishing) attacks in 2020 by which attackers tried to steal money from them. Some of the affected banks issued warnings about these vishing campaigns in which they described how such attacks are carried out.xv Most often, the attackers called clients by phone, saying that their account had been attacked and recommending transferring their funds to another specific account to secure them. In some cases, they directly requested access details, including the login codes received via SMS. Vishing campaigns are also increasing in number abroad. In 2020, American security services issued a warning about the higher frequency of this method in relation to the COVID-19 pandemic.xvi Chart 26: What percentage of the total budgets of financial sector organisations was allocated to cyber security in 2020? (%) Financial sector Average of all sectors 57% 46% 40 25% 20 22% 17% 12% 9% 12% 0 0–2% 2–5% 5–10% OTHER A Red Team is a team of ethical hackers who simulate attacks using the same sophisticated means as real attackers. Targets of Cyberattacks 22