Chart 17: Share of DoS/DDoS attacks in the attacks respon­dents from the individual sectors identified as the most serious in 2020 (% of respondents) 44% 40 33% 25% 19% 20 17% 0 PUBLIC SECTOR FINANCIAL SECTOR ENERGY SECTOR EDUCATION DIGITAL SERVICES SUPPLY CHAIN ATTACKS: A THREAT WITH GLOBAL IMPACTS BUT NEXT TO ZERO OCCURRENCE IN THE CZECH REPUBLIC In 2020, less than 3% of organisations detected a supply chain attack or attempt, whereas half of them considered it the least frequent and least serious threat. This is highly likely (75% – 85% probability) caused by the low occurrence of this type of attack in the Czech Republic or the difficultly for the organisations to detect it. More than half the respondents perceive the threat of cyberattacks through the supply chain as low; moreover, there has been a year on year decrease in the seriousness of this threat as perceived by the respondents (Chart 18). Chart 18: How high was the threat of cyberattacks from a provider of services, software, or hardware in 2019 and 2020 according to the organisations? (% of respondents) 2019 2020 52% 48% 40 33% 33% 19% 15% 20 0 LOW 8 9 10 MEDIUM HIGH In contrast to the increasingly weak perception of the threat of cyberattacks on the supply chain in the Czech Republic, a massive attack on SolarWinds, an American software company, was detected at the end of 2020. Although the total damage is not known yet, the estimates are that there are tens of thousands of compromised8 clients throughout the world.xiii Supply chains enable attackers to extend their attack surface in cyberspace and thus gain access to many times more sensitive data of both organisations and individuals. The SolarWinds supply chain attack was carried out by infecting the Orion platform provided by the company with the Sunburst backdoor,9 which allowed the attack­ ers to penetrate the systems of the target companies. Those included, for example, the cyber security com­ pany FireEye, the United States Departments of Treasury, Defense, and State, as well as Microsoft, Fujitsu, and Lukoil.xiv In light of the seriousness of the situation, the NÚKIB issued a reactive measure, although no case of compromise has been reported from bodies regulated under the ACS so far. REACTIVE MEASURE IN RELATION TO SOLARWINDS ORION PLATFORM APPLICATIONS The last reactive measure of 2020 was focused on the risks associated with software from the American company SolarWinds. System administrators of critical information infrastructures, important information systems, and essential service systems immediately had to perform security updates, check whether their system had been compromised, and perform security audits. The whole wording of the reactive measure is available on the NÚKIB’s website at www.nukib.cz/cs/uredni-deska As many as 72% of the respondents most often manage the risks associated with suppliers at contractual rela­ tionship level, which is just one of the basic measures.10 Almost three-quarters of them only grant their suppliers unrestricted remote access following the consent of the organisation’s responsible person, whereas 8% of them do not grant any remote access at all (Chart 19). These results from the questionnaire survey go against Clients who downloaded the malicious software update without any further consequences. Backdoor denotes a method attackers can abuse to enter a system without the knowledge of the user. Globally, more and more institutions are adopting the Zero Trust Security concept, in which not only the external network but also the internal network is considered untrusted and, before access is granted, all the devices attempting to connect to the organisation’s networks or systems must always be verified. At the same time, users only have authorised access to services that are explicitly assigned to them, and everything else is blocked. The Zero Trust Security concept can be used to mitigate supplier-associated risks as well as to secure connections and networks for remote working. Cyber Threats 18