TARGETS OF CYBERATTACKS CRITICAL INFRASTRUCTURE: IMPROVED SECURITY AND NO SERIOUS INCIDENT According to the information available to the NÚKIB, no sophisticated and targeted cyberattack compromising critical infrastructure (CI) information systems occurred in the Czech Republic in 2020. Yet critical information infrastructure (CII) entities faced thousands of cyberattack attempts. Attacks on CII that were handled with the participation of the NÚKIB mainly occurred through DDoS attacks or attempts, while the second most frequent type of attack was phishing or spear-phishing e-mails (Chart 21). Again, the fact that no sophisticated attacks were detected by CII entities does not confirm that they are not occurring as their detection strongly depends on the technical, procedural and personal capacities of the responsible entities. Similarly to last year, nearly half the detected cyber security incidents resulted in limitations in service availability which, with CII entities, is one of the essential criteria for ensuring the smooth operation of the State and society. Mainly state administration institutions faced security incidents in relation to CII. 47% organisations even though these do not necessarily mean that the cyber security of the CII entities has objectively improved. Pursuant to the ACS, critical information infrastructure (CII) consists of communication and information systems of critical infrastructure (CI) elements. Pursuant to Act No 240/2004, on crisis management and on amendments to certain other laws (the Crisis Act), CI is defined as an element or system of elements whose compromise would have a serious impact on national security, the provision of the basic living needs of the population, and ensuring the health of people or the economy of the State. Typical CI elements include power plants, dams, airports, and telecommunication networks, as well as strategic financial institutions and State authorities. The elimination of any of these elements can paralyze the provision of critical services (energy, heat, water supplies or pension payments) or, in extreme cases (such as cyber sabotage), cause physical damage. Chart 21: Which attacks on CII in 2020 most often resulted in a cyber security incident? (% of CII respondents) of CII incidents reported to the NÚKIB in 2020 resulted in limited availability of services As in 2019, one-third of the respondents categorised under CII managed to deal with the most serious attack of 2020 within several hours. In 5% of cases, the respondents were still dealing with the consequences a year later. Up to 96% of critical infrastructure organisations believe that their cyber security has improved compared to previous years (Chart 22). The NÚKIB cannot confirm this trend from information available to it. Furthermore, there is a realistic possibility (25% – 50% probability) that the answers to the question were significantly affected by the positive perception of some sub-measures adopted by many of those 33% 25% 22% 20 19% 0 DDOS ATTACKS OR ATTEMPT ADMINISTRATIVE OR TECHNICAL FAULT PHISHING/ SPEARPHISHING Targets of Cyberattacks OTHER 20