CYBER SECURITY IN 2020 FROM THE PERSPECTIVE OF CZECH INSTITUTIONS, ORGANISATIONS, AND COMPANIES1 1 The data follow from the evaluation of 222 questionnaires; see section About the Document above. incidents: an increase in the severity of targeted phishing and ransomware According to the questionnaire respondents, the most frequent types of attacks in 2020 included spam, phishing, and the scanning of organisations’ external networks2 (Chart 1). On the other hand, in only a few cases did the respondents face sniffing (internal net­ work scann­ing) or illegal cryptocurrency mining. The most serious attacks according to the respondents were ransomware, DoS/DDoS attacks, spear-phishing e-mails, and attempts to exploit vulnerabilities (Chart 2). Although more than half the respondents claimed they had detected at least one cyberattack attempt, such at­ tempts did not lead to cyber security incidents in almost three-quarters of the cases, meaning the confidentiality, integrity or availability of information or services was not breached (Chart 3).3 The largest number of inci­ dents were detected by public sphere institutions and healthcare facilities. Chart 1: Most frequent types of cyberattacks in 2020 (% of respondents) 59% an attack attempt does not mean that no cyber incidents occurred in their networks. The ability to detect attacks targeted at data integrity and confidentiality particu­ larly require capacities based on advanced detection technologies and sufficiently trained staff. On the other hand, detecting attacks such as spam, phishing or scam e-mails is significantly easier. Chart 2: Most serious types of cyberattacks in 2020 (% of respondents) 26% 20 19% 19% 14% 13% 9% 0 RANSOM- DOS/DDOS WARE ATTACKS SPEARATTEMPT PHISHING PHISHING TO EXPLOIT VULNERABILITY OTHER Chart 3: Proportion of incidents with an impact on confidentiality, integrity, or information availability in 2020 (% of respondents) 73% 40 60 20 16% 12% 6% 40 3% 4% SPEAR-PHISHING OTHER 20 However, the fact that such a significant number of institutions did not detect a cyber security incident or 0 0 SPAM 1 2 3 PHISHING SCANNING SCAM E-MAIL 21% 0 1–5 1% 2% 1% 2% 6–10 11–20 21–30 JINÉ The data follow from the evaluation of 222 questionnaires; see the section About the Document above. By scanning external networks, attackers search for vulnerabilities or security flaws they can use to infiltrate the organisation in question. In Europe, the mean lag between compromise and detection of a cyber security incident is 54 days, which signifies a high likelihood that, in many cases, the attacker leaves their victim’s system before being detected by the victim.i Cyber Security in 2020 from the Perspective of Czech Institutions, Organisations, and Companies 9