The Covid-19 pandemic has pushed companies to the extensive use of digital services, to implement home working and provide online services to people in lockdown. As a consequence, it is interesting to study how this has afected the number, kind and distribution of cybersecurity attacks. This paper gives an empirical evaluation of the cybersecurity attacks at the beginning of the Covid-19 pandemic in Italy, based on data collected from the questionnaires of the annual Digital Attacks Observatory. It shows that the overall number of attacks has not increased, but attacks have afected smaller companies than before. This can be explained with the fact that the Italian industrial scenario is mostly populated by small and medium enterprises, that have been obliged to a quick reconversion of their IT systems and typically lack the necessary cybersecurity culture.
The Covid-19 pandemic and consequent lockdowns have obliged companies to face new
challenges such as smart working, remote work and digitalization, accelerating all previous eforts
in that direction. As reported by Gartner [
The Digital Attacks Observatory (OAD) [
The data collected in the OAD 2020 show, in general, that the respondents have, for the most part, a good perception of the cybersecurity of their IT systems (Fig. 4). This information can be explained from the fact that: • About 30% of respondents are in the ICT sector, therefore their IT systems are managed with some cybersecurity literacy and can properly react to cyberattacks, preventing them or minimizing their efects. • In general, cybercriminals do not waste time and resources to attack small businesses, where they can only obtain a marginal profit and still take the risk of being caught by the police. As confirmed by the trends shown in Fig. 6 and Fig. 7, attackers target the larger companies most, because the illegal gain is more interesting in that case.
The chart in Fig. 5 analyzes the trend of cyberattacks. The figure shows that, from 2007 to 2015, in average, about 40% of the respondents reported cyberattacks (leftmost full red line). Since 2015, the trend increased to 45% of the respondents (rightmost full red line). In 2018, OAD reached the peak of reported attacks and, for the first time, the percent of reported attacks became larger than that percent of companies that did not report any attack. After the peak in 2018, year 2019 has a lower figure and the same occurs in the first quarter of 2020. The trend for full 2020 will be discovered with the currently ongoing OAD survey. This view, over several years, does not show significant changes, not even inside the pandemic period, but shows only a slight increase in cyberattacks in the recent years, not necessarily attributable to the pandemic crisis. One could wonder why the percentages in Fig. 5 are lower than what the reader would have expected, given the numerous cyber attacks occurred in Italy. As already discussed at the beginning of this section, the main reason seems the size of the Italian companies.
The comparison between the whole 2019 and the first quarter of 2020 in Fig. 6 maintains the same logical trend. The only meaningful diference is in the number of attacks reported by the smallest organizations (up to ten employees): they were 0% in 2019 and grow up to 22,2% at the beginning of 2020 (see the red arrow in Fig. 6). Such a strong increase follows from the extensive use of e-banking and e-commerce services, with the related cyberattacks.
Regarding the geographical distribution of attacks, Table. 1 shows that occasional attacks were evenly distributed throughout the territory in 2019, with systematic attacks focused on northern Italy (where the companies with the highest turnover are present). While Table. 2 shows that, already in the first months of 2020, there were several attacks.
The impact of the pandemic on the cybersecurity in Italy is also highlighted by the data provided by the Italian Postal and Telecommunication Police, that shows the situation for the critical infrastructures (Table 3), for the financial cyber-crimes (Table 4) and for the cyberterrorism (Table 5). Fraudulent transactions were blocked in all Italy in 2019 for a total value of e21.3 million and e18 million were recovered; in the first quarter of 2020, fraudulent transactions for e20.2 million were blocked, practically reaching in four months the amount blocked in the full twelve months of 2019, and e8 million have been recovered. This is an indication of the increase in attacks on financial transactions and services due to the very large use of these online services, caused by the mobility reduction measures consequent of the Covid-19 pandemic.
In the pandemic period, between 2019 and the first quarter of 2020, the nature of the attacks and their vectors were quite diversified. The attacks on IAA that aimed at access control systems are widespread, since they amount to 28.2% of the total attacks of 2019 and to 34% of the total attacks in the first quarter of 2020 (Fig. 8).
The other 14 types of attacks follow, decreasing by a few percent points between them,
whose characteristics and impacts are detailed in the related paragraphs of the OAD 2020 report.
Regarding attack vectors and techniques, all the seven attack families considered in the 2020
questionnaire are widely used in the various types of attacks, sometime even simultaneously, as
shown in Fig. 9. The trend in Fig. 9 is also in line with most European reports, such as that of
the European Network and Information Security Agency (ENISA) [
Geographic area Northern Italy Central Italy Southern Italy and islands Throughout Italy Throughout Italy and Europe Throughout Italy and abroad (also outside Europe)
Occasional cyber attacks Frequent and repeated cyber attacks Never detected cyber attacks (few dozen) (hundreds or more) 5,8% 6,3% 87,9% 0,0% 0,0% 100,0% 0,0% 0,0% 100,0% 30,3% 0,0% 69,7% 0,0% 0,0% 100,0% 28,8% 0,0% 71,2% Distribution of digital attacks (detected by the respondents) wrt. geographical area, in 1Q-2020.
Critical structure protection
1 Jan - 30 Apr 1 Jan - 31 Dec 1 Jan - 31 Dec 1 Jan - 31 Dec 1 Jan - 31 Dec
2020
282
• the motivations of the cyberattacks are mainly economic, such as fraud and
blackmailing: the widespread difusion of ransomware in Italy is a clear confirmation of these
As pointed out in Fig. 4, the IT systems considered in the 2020 survey and their cybersecurity
are in the medium to high range and the collected information shows a relevant improvement
in both technical and organizational measures, in comparison to the previous surveys. Few of
the considered Italian IT systems are based on data centers in Italy: most of the respondents’
companies have medium to small IT systems partly on premise and partly outsourced, with
an increasing use of cloud services. The high number of attacks detected in 2018, and the
privacy obligations related to the European General Data Protection Regulation (GDPR), have
certainly contributed to strengthening cybersecurity measures, and a further improvement
comes from the growing use of cloud services, where high standard security measures are in
place, usually. Organizational measures for cybersecurity, historically missing and neglected in
Italy, have improved in terms of definition of roles and separation of duties, of organizational
policies and procedures, and of incident management. These measures often are missing in
small organizations, and in general the cybersecurity awareness and competence are low, and
mainly concentrated at the top level of the public and private organizations. In Italy, there is
still a long way to go in terms of cybersecurity continued training and awareness. A formal and
bureaucratic approach to the organizational procedures is still prevalent. Once defined, such
procedures often do not find concrete application and misses periodic updates and operational
tests. A significant example is the disaster recovery plans, for which, typically, the required
alternative IT resources are neither forecast nor allocated. Periodic exercises and simulations
of the possible disasters are not implemented. Cybersecurity management tools have limited
difusion yet, among the 2020 OAD respondents. This is particularly true for the most advanced
ones, based on artificial intelligence. Although the use of IoT [
The OAD 2020 survey highlights the presence of cyberattacks of various types in Italy, all technically of an high complexity and sophistication, with a slight increase compared to the trend that emerged in the twelve years of the previous OAD surveys, but still below the peak of 2018. Despite the proliferation of cyberattacks related to the Covid-19 pandemic, in the first four months of 2020 the widespread of attacks is at a level similar to that of 2019. This will be better verified with the next OAD 2021. The Italian reality, made up of a very large number of small and tiny organizations, does not make our country very attractive to cybercriminals, but cyber-warfare and massive attacks represent a growing and serious risk, as has already occurred with the widespread of ransomware on computer systems with no or low measures of cybersecurity. The OAD 2020 shows a clear improvement and strengthening of digital security measures, both technical and organizational, even if the most modern prevention, protection and management systems that use artificial intelligence techniques are still in their infancy among the respondents. The defense measures and techniques in use fight the increasingly sophisticated and smart evolution of attacks, but often too late. The high density of vulnerabilities requires diferent approaches, aiming at making all IT systems interconnected to the Internet and safe, by default and by design. However, we are still a long way from this goal. In order to improve the actual fight against continuous attacks and cybercrime, it is currently necessary to increase awareness on cybersecurity and skills at all levels. It is also paramount to support an efective collaboration between police bodies at the international level.