Chart 22: According to the CII respondents, has the level of cyber security in their company improved compared to 2019? (%) Chart 24: Most serious attacks or attempts against respondents from the public sector in 2019 and 2020 (%) 2019 RATHER NO 4% CERTAINLY YES RATHER YES 63% 33% 14% Chart 23: Most frequent attacks or attempts against respondents from the public sector in 2019 and 2020 (%) 2020 60% 52% 40 23% 17% 14% 20 13% 0% 0 SPAM PHISHING SCANNING 5% SCAM E-MAIL 11% 0 The frequency of attacks targeted at public sector institutions increased in 2020. Moreover, the portfolio of attack types with respect to their severity has signifi­ cantly changed. The respondents’ answers show that the increase in the number of attacks targeted at state administration and local and regional authorities corre­ sponds with the data available to the NÚKIB (for details, see the chapter Cyber Incidents from the Perspective of the NÚKIB). Whereas in 2019 public sector employees most frequently encountered spam, phishing, and scam e-mails, in 2020 the institutions recorded an increase in attacks taking the form of scanning of their external networks (Chart 23). As for the severity, one-third of the respondents from the public sector and another four sectors ranked DoS/DDoS attacks highest (Chart 24). This is likely (55% – 70% probability) due to the more frequent detection of this type of attack in comparison with other cyber threats. Ransomware placed second in the assessment of the severity of threats in the public sector, with one-third of the healthcare respondents considering it the most serious threat of 2020. 60 13% 5% PUBLIC SECTOR: TARGET OF DDOS ATTACKS AND PERSONALIZED PHISHING 2019 20 11% 5% OTHER MALICIOUS CODE RANSOMWARE PHISHING SPEAR-PHISHING 17% 17% ATTEMPT AT EXPLOITING VULNERABILITY SPEARPHISHING 2020 33% 25% 20 0 DOS/DDOS ATTACKS RANSOMWARE Similarly to last year, organisations again reported a trend of increasingly sophisticated attacks through phishing, spear-phishing, and scam e-mails using the pandemic or fraudulent information about parcel deliv­ eries or overdue invoices as bait. Attackers continue to demonstrate better knowledge of both the environment and the Czech language, making it more difficult to detect them. With public sector institutions, the noticeable problem with hiring and paying cyber security experts persisted in 2020. Besides this, cyber security budgets decreased in almost half the respondents from the public sector. Nearly 80% of them claimed that salaries are the main reason for the unoccupied cyber security positions (Chart 25). Despite the situation, more than half the respondents are not planning any budget increases for the coming year. The combination of these two factors could have a very negative effect on cyber security in the years to come. Targets of Cyberattacks 21