[{"data":1,"prerenderedAt":1970},["ShallowReactive",2],{"threats-nav-data-en":3,"content-page-en-\u002Fprivacy":830,"content-counterpart-en-\u002Fprivacy":1418},[4,321,563],{"id":5,"title":6,"alias":7,"body":8,"category":302,"description":303,"extension":304,"gameScenarioLink":305,"gameScenarioTitle":306,"icon":307,"meta":308,"navigation":309,"path":310,"seo":311,"severity":312,"sitemap":313,"slug":314,"stem":315,"vector":316,"__hash__":320},"threats_en\u002Fthreats\u002F01.phishing.md","Phishing (Credential Harvesting & Scams)","Email Phishing, Smishing & Deceptive Portals",{"type":9,"value":10,"toc":290},"minimark",[11,34,39,45,52,56,106,110,138,144,148,218,222,252,256],[12,13,14,19,28],"scan-trap",{},[15,16,18],"h3",{"id":17},"security-alert-you-scanned-an-untrusted-qr-code","⚠ Security Alert: You Scanned an Untrusted QR Code!",[20,21,22,23,27],"p",{},"You just triggered a simulated ",[24,25,26],"strong",{},"Quishing (QR Phishing)"," training trap! In a real incident, scanning untrusted physical\nor digital QR codes can covertly exfiltrate credentials, hijack sessions, or execute malicious payloads.",[20,29,30,33],{},[24,31,32],{},"Security Reminder:"," Always inspect destination URLs and never scan unsolicited or publicly posted QR codes without\nverification.",[35,36,38],"h2",{"id":37},"what-is-phishing","What is Phishing?",[20,40,41,44],{},[24,42,43],{},"Phishing"," remains one of the most widespread and damaging cyber attack vectors worldwide. Attackers send fraudulent\ncommunications disguised as trusted organizations—such as Microsoft 365, Google Workspace, postal couriers (DHL, FedEx,\nCzech Post), tax authorities, or popular streaming platforms.",[20,46,47,48,51],{},"The primary objective is almost always to direct the victim to a ",[24,49,50],{},"pixel-perfect fake login page"," where entered\ncredentials (and often active 2FA session tokens via Adversary-in-the-Middle proxies) are harvested by the threat actor.",[35,53,55],{"id":54},"the-phishing-attack-sequence","The Phishing Attack Sequence",[57,58,59],"attack-flow",{},[60,61,62,69,88,94,100],"ol",{},[63,64,65,68],"li",{},[24,66,67],{},"Bait Crafting",": Attackers replicate corporate branding, logos, and email templates (e.g. \"Password expiring in 24\nhours\" or \"Package delivery suspended due to unpaid customs fee\").",[63,70,71,74,75,79,80,83,84,87],{},[24,72,73],{},"Domain Spoofing & Lookalikes",": Scammers register lookalike domains (",[76,77,78],"code",{},"rnicrosoft.com"," ,",[76,81,82],{},"micros0ft-login.com",",",[76,85,86],{},"post-package-tracking.net",") or abuse compromised legitimate domains.",[63,89,90,93],{},[24,91,92],{},"Mass or Targeted Dispatch",": Automated mailers deliver thousands of messages, bypassing basic spam filters with\nhomoglyphs, encoded links, or QR codes (Quishing).",[63,95,96,99],{},[24,97,98],{},"Credential Harvesting",": The victim lands on a fake authentication portal. As soon as user inputs username,\npassword, or SMS OTP, it is relayed directly to the attacker.",[63,101,102,105],{},[24,103,104],{},"Account Takeover (ATO)",": Attackers log into the victim's genuine account, establish mailbox forwarding rules, and\npivot deeper into the corporate network.",[35,107,109],{"id":108},"real-world-simulation","Real-World Simulation",[111,112,116,124,127,130,135],"threat-example",{"channel":113,"icon":114,"sender":115},"Email","i-lucide-mail","IT Helpdesk Notifications \u003Calerts@corplog1n-verify.com>",[20,117,118,119,123],{},"\"Subject: ",[120,121,122],"span",{},"URGENT"," Security Alert: Your Microsoft 365 Session Has Expired",[20,125,126],{},"Dear Employee,",[20,128,129],{},"Our security monitoring detected suspicious sign-in attempts against your account from an unrecognized IP in Warsaw.\nYour access will be locked in 30 minutes unless you verify your identity.",[20,131,132],{},[120,133,134],{},"Click here to confirm your credentials and update password",[20,136,137],{},"Failure to comply will result in an immediate IT security suspension.\"",[20,139,140,141,143],{},"Pay attention to the urgency of the email (",[76,142,122],{}," etc.). Hackers use it to put time\npressure on you, so you will not spot the suspicious details and mistakes in the email.",[35,145,147],{"id":146},"defense-checklist","Defense Checklist",[149,150,152],"defense-tips",{"title":151},"Phishing Prevention Rules",[153,154,155,194,200,206,212],"ul",{},[63,156,157,160,161,164,165,168,169,171,172,175,176,179,180,187,188,193],{},[24,158,159],{},"Inspect the actual sender address, not just display name",": Check the domain after the ",[76,162,163],{},"@"," symbol carefully. Look ",[166,167],"br",{}," --- Unknown node: hardBreak --- ",[166,170],{}," for misspellings, substitute characters (",[76,173,174],{},"rn"," vs ",[76,177,178],{},"m"," - @",[181,182,186],"a",{"href":183,"rel":184},"http:\u002F\u002Fmicrosoft.com",[185],"nofollow","microsoft.com"," vs @",[181,189,192],{"href":190,"rel":191},"http:\u002F\u002Frnicrosoft.com",[185],"rnicrosoft.com,"," etc.), or strange top-level domains.",[63,195,196,199],{},[24,197,198],{},"Hover before clicking",": Hover your cursor over hyperlinks to inspect the destination URL before clicking. If on\nmobile, long-press to view preview.",[63,201,202,205],{},[24,203,204],{},"Never authenticate via links sent in unsolicited emails",": Navigate directly to known services by typing their\naddress into your browser or using verified bookmarks.",[63,207,208,211],{},[24,209,210],{},"Use FIDO2 \u002F Passkey Hardware Authentication",": Phishing-resistant multi-factor authentication (like YubiKeys or\nWindows Hello \u002F Passkeys) prevents credential harvesting even if you land on a spoofed portal.",[63,213,214,217],{},[24,215,216],{},"Beware of QR code emails (Quishing)",": Never scan QR codes embedded in security notifications or password reset\nemails.",[35,219,221],{"id":220},"immediate-actions-if-phished","Immediate Actions If Phished",[223,224,226],"emergency-action",{"title":225},"Clicked a Suspicious Link or Entered Credentials?",[153,227,228,234,240,246],{},[63,229,230,233],{},[24,231,232],{},"Immediately change passwords on legitimate portals",": Do not use the link from the email. Open a new browser window,\nlog into the official service, and change your credentials.",[63,235,236,239],{},[24,237,238],{},"Revoke all active sessions and app passwords",": In Microsoft 365 or Google, trigger a \"Sign out of all devices\"\ncommand.",[63,241,242,245],{},[24,243,244],{},"Inspect email inbox forwarding rules",": Attackers routinely create hidden rules to silently forward incoming emails\nor delete notifications from security teams.",[63,247,248,251],{},[24,249,250],{},"Notify IT Security (SOC)",": Prompt reporting allows defenders to blacklist the phishing domain across the entire\nenterprise gateway and reset impacted tokens.",[35,253,255],{"id":254},"resources-references","Resources & References",[153,257,258,266,274,282],{},[63,259,260,265],{},[181,261,264],{"href":262,"rel":263},"https:\u002F\u002Fwww.kb.cz\u002Fcs\u002Fpodpora\u002Fbezpecnost\u002Ftypy-utoku",[185],"Komerční banka – Bezpečnost a typy útoků"," – Guide on email scams,\nfake e-banking portals, and smishing defense.",[63,267,268,273],{},[181,269,272],{"href":270,"rel":271},"https:\u002F\u002Fwww.cisa.gov\u002Fsecure-our-world\u002Fteach-employees-avoid-phishing",[185],"CISA – Recognizing and Reporting Phishing"," –\nCybersecurity and Infrastructure Security Agency best practices.",[63,275,276,281],{},[181,277,280],{"href":278,"rel":279},"https:\u002F\u002Fwww.nukib.gov.cz\u002F",[185],"NÚKIB – Doporučení k ochraně před phishingem"," – National Cyber and Information Security\nAgency advisory.",[63,283,284,289],{},[181,285,288],{"href":286,"rel":287},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F",[185],"MITRE ATT&CK – Technique T1566: Phishing"," – Comprehensive adversary\ntactics and techniques index.",{"title":291,"searchDepth":292,"depth":292,"links":293},"",2,[294,296,297,298,299,300,301],{"id":17,"depth":295,"text":18},3,{"id":37,"depth":292,"text":38},{"id":54,"depth":292,"text":55},{"id":108,"depth":292,"text":109},{"id":146,"depth":292,"text":147},{"id":220,"depth":292,"text":221},{"id":254,"depth":292,"text":255},"social-engineering","Deceptive emails, text messages, or direct communications designed to trick users into revealing confidential credentials, banking details, or downloading malware via lookalike websites.","md","https:\u002F\u002Fplay.cyber-framework.net?scenario=phishing","The Phishing Labyrinth","i-lucide-mail-warning",{},true,"\u002Fthreats\u002Fphishing",{"title":6,"description":303},null,{"loc":310},"phishing","threats\u002F01.phishing",[113,317,318,319],"SMS \u002F Smishing","Lookalike Domains (Typosquatting)","Fake Login Portals","vQ4E3-SjHlVYfPDRgOROyamltaASWpsC0HbXldxZS-A",{"id":322,"title":323,"alias":324,"body":325,"category":302,"description":546,"extension":304,"gameScenarioLink":547,"gameScenarioTitle":548,"icon":549,"meta":550,"navigation":309,"path":551,"seo":552,"severity":312,"sitemap":553,"slug":556,"stem":557,"vector":558,"__hash__":562},"threats_en\u002Fthreats\u002F02.vishing.md","Vishing (Voice Phishing)","Voice Phishing & Phone Spoofing",{"type":9,"value":326,"toc":538},[327,331,346,353,357,360,404,406,409,420,424,431,466,470,473,502,504],[35,328,330],{"id":329},"what-is-vishing","What is Vishing?",[20,332,333,336,337,341,342,345],{},[24,334,335],{},"Vishing"," (short for ",[338,339,340],"em",{},"voice phishing",") is a social engineering attack conducted over telephone networks. Unlike\ntraditional email phishing where you can inspect suspicious links and headers at your own pace, vishing exploits\n",[24,343,344],{},"real-time psychological pressure",", authority impersonation, and panic.",[20,347,348,349,352],{},"Attackers frequently spoof legitimate caller IDs so your phone screen displays the actual name or number of your bank's\nfraud department, local police, or corporate IT helpdesk. Advanced threat actors also deploy ",[24,350,351],{},"AI voice cloning (\ndeepfakes)"," replicating the tone and cadence of executives or loved ones.",[35,354,356],{"id":355},"how-attackers-operate","How Attackers Operate",[20,358,359],{},"Attackers rely on emotional manipulation—typically fear, urgency, or helpfulness—to override rational critical thinking.",[57,361,362],{},[60,363,364,380,386,392,398],{},[63,365,366,379],{},[24,367,368,369,378],{},"Target Intelligence (",[24,370,371],{},[24,372,373],{},[181,374,377],{"href":375,"rel":376},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FOpen-source_intelligence",[185],"OSINT",")",": The caller acquires basic personal details from data leaks, LinkedIn, or social\nmedia (your full name, employer, banking institution, or phone provider).",[63,381,382,385],{},[24,383,384],{},"Caller ID Spoofing",": Attackers configure VoIP software to display a legitimate number—such as your bank's\npublished 24\u002F7 client hotline or police department.",[63,387,388,391],{},[24,389,390],{},"Manufactured Crisis",": The scammer reports that your bank account is \"under active attack\", unauthorized loans are\nbeing approved, or your computer has malware.",[63,393,394,397],{},[24,395,396],{},"The \"Safe Account\" or Remote Access Trap",": The victim is instructed to immediately transfer all funds to a \"secure\nreserve vault\" or install remote support software (AnyDesk, TeamViewer) to \"clean the machine\".",[63,399,400,403],{},[24,401,402],{},"Fund Extraction & Disappearance",": Once transferred or logged in, the funds are instantly laundered through\ncryptocurrency exchanges or offshore mule networks.",[35,405,109],{"id":108},[20,407,408],{},"Here is what a typical high-pressure banking vishing dialogue sounds like:",[111,410,414,417],{"channel":411,"icon":412,"sender":413},"Phone Call","i-lucide-phone-incoming","\"Bank Security Department\" (Spoofed)",[20,415,416],{},"\"Good morning Mr. Anderson. This is Marcus from the Cybersecurity Operations Center at your bank. We are detecting an\nunauthorized wire transfer of $8,400 to an offshore account in Vienna right now.",[20,418,419],{},"To prevent this transaction from settling, I need you to confirm the 6-digit one-time code we just dispatched to your\nmobile phone. Do not hang up—if you disconnect, the funds will irreversibly leave your account.\"",[35,421,423],{"id":422},"how-to-defend-yourself","How to Defend Yourself",[20,425,426,427,430],{},"The golden rule of incoming phone security is simple: ",[24,428,429],{},"never verify a caller using the inbound call itself",".",[149,432,434],{"title":433},"Vishing Defense Checklist",[153,435,436,442,448,454,460],{},[63,437,438,441],{},[24,439,440],{},"Hang up and verify independently",": Never continue a high-stakes call initiated by someone else. Hang up, wait 30\nseconds (or restart the line), and dial the official phone number printed on the back of your payment card or official\ncompany directory.",[63,443,444,447],{},[24,445,446],{},"Banks never ask for full credentials or 2FA codes",": Legitimate bank employees will never ask for your login\npasswords, card PIN, CVC\u002FCVV security code, or push authorization approvals over the phone.",[63,449,450,453],{},[24,451,452],{},"Beware of \"Safe Deposit Accounts\"",": Banks never instruct clients to transfer money into an alternative or temporary\n\"reserve vault\" account to protect it.",[63,455,456,459],{},[24,457,458],{},"Never install remote control software on request",": If a caller asks you to install AnyDesk, TeamViewer, RustDesk,\nor QuickSupport, hang up immediately.",[63,461,462,465],{},[24,463,464],{},"Establish internal verification protocols",": For corporate calls asking for financial transactions or credentials,\nrequire dual-channel out-of-band verification.",[35,467,469],{"id":468},"immediate-actions-if-targeted","Immediate Actions If Targeted",[20,471,472],{},"If you suspect you have disclosed financial data or authorized a fraudulent transaction during a phone call:",[223,474,476],{"title":475},"Compromised via Vishing? Take These Steps Now",[153,477,478,484,490,496],{},[63,479,480,483],{},[24,481,482],{},"Immediately contact your bank's official fraud line",": Request immediate card blocking, internet banking session\ntermination, and transaction recalls. Every minute matters for wire recall requests.",[63,485,486,489],{},[24,487,488],{},"Change all passwords from an uninfected device",": If you installed software or entered passwords on suggested links,\nassume your workstation is compromised. Change passwords and revoke active sessions.",[63,491,492,495],{},[24,493,494],{},"File a report with law enforcement (Police)",": Document the attacker's phone number, time of call, claimed identity,\nand transaction identifiers.",[63,497,498,501],{},[24,499,500],{},"Notify your company's IT \u002F Security Operations (CISO)",": If corporate credentials or workstations were involved,\nreport the incident immediately so credentials can be rotated and endpoints isolated.",[35,503,255],{"id":254},[153,505,506,514,522,530],{},[63,507,508,513],{},[181,509,512],{"href":510,"rel":511},"https:\u002F\u002Fwww.kb.cz\u002Fcs\u002Fpodpora\u002Fbezpecnost\u002Ftypy-utoku\u002Fvishing",[185],"Komerční banka – Podvodné telefonáty (Vishing)"," – Guide on\nspoofed bank calls and caller verification.",[63,515,516,521],{},[181,517,520],{"href":518,"rel":519},"https:\u002F\u002Fcbaczech.cz\u002F",[185],"Czech Banking Association – #NePINdej! Campaign"," – Educational nationwide campaign on banking\nfraud and social engineering.",[63,523,524,529],{},[181,525,528],{"href":526,"rel":527},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fnews\u002Favoiding-social-engineering-and-phishing-attacks",[185],"CISA – Avoiding Social Engineering and Phishing Attacks"," –\nVoice phishing and imposter call defense.",[63,531,532,537],{},[181,533,536],{"href":534,"rel":535},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F004\u002F",[185],"MITRE ATT&CK – Technique T1566.004: Spearphishing Voice"," – Adversary\nmethodology for vishing operations.",{"title":291,"searchDepth":292,"depth":292,"links":539},[540,541,542,543,544,545],{"id":329,"depth":292,"text":330},{"id":355,"depth":292,"text":356},{"id":108,"depth":292,"text":109},{"id":422,"depth":292,"text":423},{"id":468,"depth":292,"text":469},{"id":254,"depth":292,"text":255},"Fraudulent phone calls where attackers impersonate bank officers, police, or IT support using psychological pressure and caller ID spoofing to steal money or credentials.","https:\u002F\u002Fplay.cyber-framework.net?scenario=day-one","First Day","i-lucide-phone-call",{},"\u002Fthreats\u002Fvishing",{"title":323,"description":546},{"loc":551,"videos":554,"images":555},[],[],"vishing","threats\u002F02.vishing",[559,384,560,561],"Phone (Voice)","Audio Deepfakes","Social Engineering","E3QIMt3RJ-53_ay8LTgTwoCBoOawNRczk2aaKQW7pOc",{"id":564,"title":565,"alias":566,"body":567,"category":812,"description":813,"extension":304,"gameScenarioLink":291,"gameScenarioTitle":291,"icon":814,"meta":815,"navigation":309,"path":816,"seo":817,"severity":312,"sitemap":819,"slug":822,"stem":823,"vector":824,"__hash__":829},"threats_en\u002Fthreats\u002F03.ransomware.md","Ransomware & Malicious Attachments","Extortion Ware, Crypto-Lockers & Malicious Payloads",{"type":9,"value":568,"toc":804},[569,573,579,586,597,601,651,655,664,700,702,737,741,770,772],[35,570,572],{"id":571},"what-is-ransomware","What is Ransomware?",[20,574,575,578],{},[24,576,577],{},"Ransomware"," is a devastating class of malware that covertly infiltrates network infrastructure, maps connected shares\nand cloud backups, and deploys military-grade encryption (e.g. AES-256 and RSA-4096) across entire file repositories.",[20,580,581,582,585],{},"Modern ransomware groups practice ",[24,583,584],{},"Double and Triple Extortion",":",[60,587,588,591,594],{},[63,589,590],{},"Encrypting systems to halt daily operations.",[63,592,593],{},"Exfiltrating sensitive customer and intellectual property records to threaten public leaks.",[63,595,596],{},"Conducting distributed denial-of-service (DDoS) attacks or contacting company customers directly to accelerate\npayment.",[35,598,600],{"id":599},"infection-spread-lifecycle","Infection & Spread Lifecycle",[57,602,603],{},[60,604,605,623,633,639,645],{},[63,606,607,610,611,614,615,618,619,622],{},[24,608,609],{},"Initial Access Vector",": An employee opens a macro-enabled invoice (",[76,612,613],{},"Invoice_9042.docm","), a deceptive ZIP archive\ncontaining a disguised ",[76,616,617],{},".vbs"," or ",[76,620,621],{},".exe",", or attackers exploit exposed VPN\u002FRDP portals.",[63,624,625,628,629,632],{},[24,626,627],{},"Persistence & Defense Evasion",": The malware disables endpoint protection, clears Windows Volume Shadow Copies\n(",[76,630,631],{},"vssadmin delete shadows","), and establishes persistence.",[63,634,635,638],{},[24,636,637],{},"Lateral Movement & Domain Escalation",": Attackers harvest local credentials (using tools like Mimikatz), escalate\nto Active Directory Domain Admin, and locate all network storage (NAS\u002FSAN).",[63,640,641,644],{},[24,642,643],{},"Data Exfiltration",": Confidential databases, financial spreadsheets, and emails are compressed and quietly uploaded\nto anonymous cloud storage.",[63,646,647,650],{},[24,648,649],{},"Mass Encryption & Ransom Note",": Encryption scripts trigger simultaneously across domain servers and workstations,\nreplacing desktop wallpapers with ransom instructions.",[35,652,654],{"id":653},"simulated-ransom-note","Simulated Ransom Note",[20,656,657],{},[658,659],"img",{"alt":660,"className":661,"src":663,"title":660},"Ransomware screen example",[662],"w-full","\u002Fthreats\u002Fransomware-screen.webp",[111,665,669,672,675,678,697],{"channel":666,"icon":667,"sender":668},"Ransom Screen Notice","i-lucide-skull","BlackLock Ransomware Group",[20,670,671],{},"\"=== ATTENTION: ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED ===",[20,673,674],{},"All your corporate databases, documents, customer PII, and backups are locked with military-grade encryption algorithms.",[20,676,677],{},"To restore your systems:",[60,679,680,687,694],{},[63,681,682,683],{},"Download the Tor Browser from ",[181,684,685],{"href":685,"rel":686},"https:\u002F\u002Fwww.torproject.org",[185],[63,688,689,690],{},"Open our private portal: ",[181,691,692],{"href":692,"rel":693},"http:\u002F\u002Fblacklock5x9...onion",[185],[63,695,696],{},"Enter your Unique Client ID: 894F-29BC-EE01",[20,698,699],{},"PRICE: 4.5 BTC (Bitcoin). You have 72 hours before the decryption key is permanently deleted and all private files are\nreleased on the public darknet.\"",[35,701,147],{"id":146},[149,703,705],{"title":704},"Ransomware Resilience Rules",[153,706,707,713,719,725,731],{},[63,708,709,712],{},[24,710,711],{},"Maintain Immutable, Offline Backups (3-2-1-1-0 Rule)",": Ensure at least one full backup is physically disconnected\n(air-gapped) or stored in an immutable, write-once-read-many (WORM) cloud repository.",[63,714,715,718],{},[24,716,717],{},"Never enable macros or execute unexpected script attachments",": Office documents asking you to \"Enable Content\" or\n\"Enable Editing\" to view content are almost always weaponized droppers.",[63,720,721,724],{},[24,722,723],{},"Enforce the Principle of Least Privilege",": Standard employee accounts must not have local administrative rights on\ntheir machines.",[63,726,727,730],{},[24,728,729],{},"Isolate and patch remote access interfaces",": Never expose Remote Desktop Protocol (RDP) directly to the open\ninternet; mandate VPN with strict multi-factor authentication.",[63,732,733,736],{},[24,734,735],{},"Deploy Endpoint Detection & Response (EDR)",": Modern behavioral EDR tools can detect mass file modification and\nisolate the infected host automatically.",[35,738,740],{"id":739},"immediate-incident-containment","Immediate Incident Containment",[223,742,744],{"title":743},"Ransomware Detected? Take Instant Containment Actions",[153,745,746,752,758,764],{},[63,747,748,751],{},[24,749,750],{},"Disconnect immediately from physical networks",": Unplug ethernet cables and turn off Wi-Fi and Bluetooth on all\naffected devices immediately. DO NOT turn off the power (RAM holds crucial decryption keys and malware artifacts).",[63,753,754,757],{},[24,755,756],{},"Do not pay the ransom",": Cybersecurity authorities and law enforcement strongly advise against paying ransoms.\nPayment fuels criminal syndicates, does not guarantee data recovery, and marks your company as an easy repeat target.",[63,759,760,763],{},[24,761,762],{},"Isolate network segments and storage arrays",": Take offline network-attached storage and shared drives to stop\nencryption traversal.",[63,765,766,769],{},[24,767,768],{},"Contact certified forensic responders & law enforcement",": Engage certified incident response teams to secure\nforensic evidence and guide secure recovery from immutable backups.",[35,771,255],{"id":254},[153,773,774,782,789,796],{},[63,775,776,781],{},[181,777,780],{"href":778,"rel":779},"https:\u002F\u002Fwww.cisa.gov\u002Fstopransomware",[185],"CISA #StopRansomware"," – Official U.S. government guidance, threat alerts, and\nransomware playbooks.",[63,783,784,788],{},[181,785,787],{"href":262,"rel":786},[185],"Komerční banka – Škodlivý software a ochrana dat"," – Banking\nclient advisory on malware infections and prevention.",[63,790,791,795],{},[181,792,794],{"href":278,"rel":793},[185],"NÚKIB – Reakce na ransomware incidenty"," – National Cyber and Information Security Agency\nransomware defense guide.",[63,797,798,803],{},[181,799,802],{"href":800,"rel":801},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1486\u002F",[185],"MITRE ATT&CK – Technique T1486: Data Encrypted for Impact"," – Tactical\nbreakdown of ransomware encryption behaviors.",{"title":291,"searchDepth":292,"depth":292,"links":805},[806,807,808,809,810,811],{"id":571,"depth":292,"text":572},{"id":599,"depth":292,"text":600},{"id":653,"depth":292,"text":654},{"id":146,"depth":292,"text":147},{"id":739,"depth":292,"text":740},{"id":254,"depth":292,"text":255},"malware","Malicious software that encrypts vital business files, databases, and backup systems, demanding enourmous cryptocurrency ransoms under threat of permanent data destruction or public leaks.","i-lucide-lock-keyhole",{},"\u002Fthreats\u002Fransomware",{"title":565,"description":818},"Malicious software that encrypts vital business files, databases, and backup systems, demanding exorbitant cryptocurrency ransoms under threat of permanent data destruction or public leaks.",{"loc":816,"videos":820,"images":821},[],[],"ransomware","threats\u002F03.ransomware",[825,826,827,828],"Weaponized Attachments (PDF, Office macros, ZIP\u002FISO)","Drive-by Downloads","Compromised Remote Desktop (RDP)","Unpatched Software Vulnerabilities","7PQfpCikml7DgKVB8SCpY_YutgGtoDUW9hxpn2xPpzE",{"id":831,"title":832,"body":833,"counterpart":1408,"description":1409,"extension":304,"icon":1410,"meta":1411,"navigation":309,"path":1413,"seo":1414,"sitemap":1415,"slug":1416,"stem":1416,"toc":309,"__hash__":1417},"pages_en\u002Fprivacy.md","Privacy Policy",{"type":9,"value":834,"toc":1388},[835,841,852,859,863,866,880,888,892,914,917,921,925,979,985,991,1001,1007,1015,1025,1031,1035,1049,1069,1073,1088,1100,1104,1111,1123,1127,1136,1140,1146,1192,1203,1207,1216,1220,1223,1227,1230,1260,1263,1267,1281,1285,1288,1344,1350,1359,1365,1368,1372,1375,1379,1382],[836,837],"u-page-header",{"className":838,"description":840,"title":832},[839],"not-prose","How we process personal data on cyber-framework.net and in the game at play.cyber-framework.net.",[20,842,843,846,847],{},[24,844,845],{},"Version 1.1 · Effective from"," ",[120,848,849],{},[24,850,851],{},"date",[20,853,854,855,858],{},"We built Cyber Framework to collect as little data as possible. The game has no accounts, we never ask for your real\nname or contact details, and we designed the gameplay data we collect so that we cannot tell who you are. This policy\nexplains what we do process, why, and what rights you have under the General Data Protection Regulation (EU) 2016\u002F679 (\"",[24,856,857],{},"GDPR","\") and Czech Act No. 110\u002F2019 Coll., on personal data processing.",[35,860,862],{"id":861},"_1-who-is-the-controller","1. Who is the controller",[20,864,865],{},"The controller of your personal data is:",[20,867,868,871,872,875,876,879],{},[24,869,870],{},"Václav Bílý (xprees)",", sole trader, ID No. (IČO): 22056475, with registered address at E. Košťála 1009, Pardubice\n530 12, Czech Republic (\"",[24,873,874],{},"we","\", \"",[24,877,878],{},"us","\").",[20,881,882,883,887],{},"Contact for all privacy matters: ",[181,884,886],{"href":885},"mailto:info@cyber-framework.net?subject=Privacy","info@cyber-framework.net",". We have\nnot appointed a Data Protection Officer because we are not required to.",[35,889,891],{"id":890},"_2-what-this-policy-covers","2. What this policy covers",[153,893,894,905],{},[63,895,896,897,900,901,904],{},"the website ",[24,898,899],{},"cyber-framework.net"," (the \"",[24,902,903],{},"Website","\"), and",[63,906,907,908,900,911,879],{},"the browser game at ",[24,909,910],{},"play.cyber-framework.net",[24,912,913],{},"Game",[20,915,916],{},"When a school, company, or other organization uses the Game under a separate written contract, the processing of its\nplayers' data may be governed by that contract and a data processing agreement (Art. 28 GDPR). In that case the\norganization may be the controller, and we may act as its processor.",[35,918,920],{"id":919},"_3-what-data-we-process-and-why","3. What data we process and why",[15,922,924],{"id":923},"_31-playing-the-game","3.1 Playing the Game",[926,927,928,947],"table",{},[929,930,931],"thead",{},[932,933,934,938,941,944],"tr",{},[935,936,937],"th",{},"Data",[935,939,940],{},"Purpose",[935,942,943],{},"Legal basis",[935,945,946],{},"Retention",[948,949,950,965],"tbody",{},[932,951,952,956,959,962],{},[953,954,955],"td",{},"Random session identifier, newly generated each time you start the Game and kept only in memory while you play (never saved to your browser storage)",[953,957,958],{},"Linking events within a single game session",[953,960,961],{},"Legitimate interest in operating and improving the Game (Art. 6(1)(f) GDPR)",[953,963,964],{},"24 months from collection",[932,966,967,970,973,976],{},[953,968,969],{},"In-game events: actions (e.g. \"email opened\", \"link clicked\"), choices, scores, reaction times, movement and viewing direction within the game world, and time since the session started",[953,971,972],{},"Running the Game, showing aggregated statistics, improving scenarios, and statistical and research evaluation of training effectiveness",[953,974,975],{},"Legitimate interest (Art. 6(1)(f) GDPR); research with safeguards under Art. 89 GDPR",[953,977,978],{},"Detailed movement data: 6 months, then converted into aggregated heatmaps. Other events: 24 months from collection, then irreversibly anonymised or aggregated",[20,980,981,984],{},[24,982,983],{},"What we do not collect."," Your nickname stays in your browser and is never sent to our server. We never record what\nyou type into simulated forms in the Game, such as fake login pages, only that you submitted them. We do not store your\nIP address or device data with gameplay data. We do not use your device's webcam or microphone: \"viewing direction\"\nmeans where you look inside the game world.",[20,986,987,990],{},[24,988,989],{},"Why we rely on legitimate interest."," Our legitimate interest is understanding how people respond to simulated cyber\nthreats, so that we can improve the training and evaluate whether it works. Because the data cannot be linked to you\nand you can switch it off at any time, we consider the impact on you to be minimal.",[20,992,993,996,997,1000],{},[24,994,995],{},"Safeguards for research."," We analyse gameplay data, including with process mining software, only in pseudonymised\nform. Before data leaves our servers for analysis, we remove anything that could link it back to a session stored with\nus. We never try to identify players or recognise them by their gameplay patterns. In the Game, we show only aggregated\nstatistics, and only once at least 10 players have answered. We may publish results in academic work, including a\nthesis at ",[120,998,999],{},"University",". Publications contain only aggregated or anonymised results.",[20,1002,1003,1006],{},[24,1004,1005],{},"We still treat this data as personal data."," We designed it so that we cannot tell who you are, but within a single\nsession the events are linked by the session identifier. We therefore treat it as pseudonymous personal data and\nprotect it under GDPR.",[1008,1009],"u-alert",{"color":1010,"description":1011,"icon":1012,"title":1013,"variant":1014},"warning","Some scenarios include fake login pages. Always make up any password, email address, or nickname you type in the Game.","i-lucide-triangle-alert","Never type real passwords or personal details","subtle",[20,1016,1017,1020,1021,1024],{},[24,1018,1019],{},"Opting out:"," when you first start the Game, the ",[24,1022,1023],{},"Privacy & data (GDPR)"," panel tells you about data sharing and\nyou can turn it off straight away. You can turn off usage analytics and crash reports separately, and you can change\nyour choice at any time in the Game's settings. If you turn off usage analytics during a session, we also delete the\ndata from that session.",[20,1026,1027,1030],{},[24,1028,1029],{},"Do you have to give us data?"," No. If you turn off data sharing, you can still play the whole Game. We do not make\ndecisions about you based solely on automated processing, including profiling, that have legal or similarly\nsignificant effects (Art. 22 GDPR).",[15,1032,1034],{"id":1033},"_32-error-monitoring-website-and-game","3.2 Error monitoring (Website and Game)",[20,1036,1037,1038,1041,1042,1045,1046,1048],{},"When the Website or the Game crashes or throws an error, we send an error report to our ",[24,1039,1040],{},"self-hosted GlitchTip","\ninstance. A report may contain your ",[24,1043,1044],{},"IP address",", browser and operating system type (user agent), the page address,\nand technical details of the error. It does not contain your nickname, gameplay data, or anything you type. In the\nGame, you can turn off crash reports in the ",[24,1047,1023],{}," settings.",[153,1050,1051,1057,1063],{},[63,1052,1053,1056],{},[24,1054,1055],{},"Purpose:"," finding and fixing bugs, and protecting the security of the service.",[63,1058,1059,1062],{},[24,1060,1061],{},"Legal basis:"," legitimate interest in a functional and secure service (Art. 6 (1)(f) GDPR).",[63,1064,1065,1068],{},[24,1066,1067],{},"Retention:"," 90 days.",[15,1070,1072],{"id":1071},"_33-analytics-website-and-game","3.3 Analytics (Website and Game)",[20,1074,1075,1076,1079,1080,1083,1084,1087],{},"We measure visits and engagement with ",[24,1077,1078],{},"self-hosted Plausible Analytics",". Plausible uses ",[24,1081,1082],{},"no cookies"," and does ",[24,1085,1086],{},"not store your IP address or any identifier",". It uses your IP address and user agent only briefly, to compute a\ndaily-rotating anonymous hash that is never stored together with the IP address. We see only aggregated statistics,\nsuch as the number of visits, pages viewed, referring sites, country, and device type.",[153,1089,1090,1095],{},[63,1091,1092,1094],{},[24,1093,1061],{}," legitimate interest in understanding how the Website and the Game are used (Art. 6 (1)(f) GDPR).",[63,1096,1097,1099],{},[24,1098,1067],{}," we keep only aggregated statistics, for as long as we operate the Website and the Game.",[15,1101,1103],{"id":1102},"_34-contacting-us","3.4 Contacting us",[20,1105,1106,1107,1110],{},"If you email us at ",[181,1108,886],{"href":1109},"mailto:info@cyber-framework.net"," or contact us another way, we process your email address, name (if you\ngive it), and the content of your message, so that we can reply.",[153,1112,1113,1118],{},[63,1114,1115,1117],{},[24,1116,1061],{}," legitimate interest in communicating with you (Art. 6 (1)(f) GDPR), or steps taken at your request\nbefore entering into a contract (Art. 6 (1)(b) GDPR).",[63,1119,1120,1122],{},[24,1121,1067],{}," as long as needed to deal with your request, normally no longer than 3 years after the conversation\nends (the general limitation period under Czech law).",[15,1124,1126],{"id":1125},"_35-server-logs","3.5 Server logs",[20,1128,1129,1130,1132,1133,1135],{},"When you access the Website or the Game, our web server automatically processes technical data such as your IP\naddress, the time of the request, and the requested address. We need this to deliver the content and to protect the\nservice against attacks. We do not store IP addresses together with gameplay data. ",[24,1131,1061],{}," legitimate\ninterest (Art. 6 (1)(f) GDPR). ",[24,1134,1067],{}," no longer than 90 days.",[35,1137,1139],{"id":1138},"_4-cookies-and-browser-storage","4. Cookies and browser storage",[20,1141,1142,1145],{},[24,1143,1144],{},"We set no cookies of our own",", neither on the Website nor in the Game. The Game keeps the following data in your\nbrowser:",[926,1147,1148,1162],{},[929,1149,1150],{},[932,1151,1152,1154,1157,1159],{},[935,1153,937],{},[935,1155,1156],{},"Type",[935,1158,940],{},[935,1160,1161],{},"Duration",[948,1163,1164,1178],{},[932,1165,1166,1169,1172,1175],{},[953,1167,1168],{},"Nickname, game progress, privacy settings, and whether you have seen the privacy panel",[953,1170,1171],{},"localStorage (Game)",[953,1173,1174],{},"Lets the Game work and remember your progress and choices",[953,1176,1177],{},"Until you clear your browser data",[932,1179,1180,1183,1186,1189],{},[953,1181,1182],{},"Session identifier",[953,1184,1185],{},"Memory only",[953,1187,1188],{},"Links events within one game session",[953,1190,1191],{},"Deleted when you close the Game",[20,1193,1194,1195,1198,1199,1202],{},"This storage is ",[24,1196,1197],{},"technically necessary"," for the Game to work, so it does not require consent under Section 89 (3) of\nCzech Act No. 127\u002F2005 Coll., on electronic communications. We use ",[24,1200,1201],{},"no advertising or tracking cookies",". You can\ndelete the stored data at any time in your browser settings.",[15,1204,1206],{"id":1205},"embedded-youtube-videos","Embedded YouTube videos",[20,1208,1209,1210,1215],{},"Some pages contain YouTube videos (Google Ireland Limited). We host the video preview images on our own servers. The\nYouTube player loads from youtube-nocookie.com only after you click \"Play video\". Until then, nothing is sent to\nGoogle. By clicking, you consent to YouTube receiving your IP address and possibly storing cookies on your device (Art. 6 (1)(a) GDPR; Section 89 (3) of Act No. 127\u002F2005 Coll.). You can withdraw your consent at any time by deleting\nYouTube cookies in your browser. We are joint controllers with Google for loading the player (Art. 26 GDPR). Google\nis responsible for any further processing under the ",[181,1211,1214],{"href":1212,"rel":1213},"https:\u002F\u002Fpolicies.google.com\u002Fprivacy",[185],"Google Privacy Policy",".\nGoogle may transfer data outside the EU on the basis of the EU–US Data Privacy Framework.",[15,1217,1219],{"id":1218},"links-to-other-services","Links to other services",[20,1221,1222],{},"The Website links to Discord, LinkedIn, Instagram, and GitHub. Nothing is sent to these services until you click a\nlink. Once you do, their own privacy policies apply.",[35,1224,1226],{"id":1225},"_5-recipients-and-processors","5. Recipients and processors",[20,1228,1229],{},"We do not sell your data and we do not share it for marketing. Your data may be accessed by:",[153,1231,1232,1242,1251,1257],{},[63,1233,1234,1237,1238,1241],{},[24,1235,1236],{},"Hetzner Online GmbH"," (Germany), our hosting provider. The Website, the Game backend, Plausible, and GlitchTip all\nrun on servers we operate in Hetzner's data centres ",[24,1239,1240],{},"within the EU",". Hetzner acts as our processor under a data\nprocessing agreement.",[63,1243,1244,1247,1248,1250],{},[24,1245,1246],{},"Cloudflare, Inc."," (USA), which provides our DNS and forwards emails sent to ",[181,1249,886],{"href":1109},". Cloudflare\nacts as our processor under a data processing agreement.",[63,1252,1253,1256],{},[24,1254,1255],{},"Google"," (EU), which hosts our mailbox, as our processor.",[63,1258,1259],{},"public authorities, where the law requires it.",[20,1261,1262],{},"Cloudflare and Google (YouTube, see Section 4) are based in the USA. Transfers to them rely on the EU–US Data Privacy\nFramework and the European Commission's Standard Contractual Clauses. We do not transfer personal data outside the\nEuropean Economic Area in any other case.",[35,1264,1266],{"id":1265},"_6-children","6. Children",[20,1268,1269,1270,1273,1274,1277,1278,1280],{},"The Game is designed for players aged ",[24,1271,1272],{},"15 and over",". Because children merit specific protection (Recital 38 GDPR),\nchildren ",[24,1275,1276],{},"under 15"," should play only with the knowledge and supervision of a parent, legal guardian, or teacher. We\ncannot verify age, because we do not collect names or contact details. That is also why we designed the gameplay data\nso that no one can be identified from it. Teachers using the Game in class should remind pupils to make up any\nnickname, password, or email address they type in the Game. They can also turn off data sharing in the ",[24,1279,1023],{}," settings on each device.",[35,1282,1284],{"id":1283},"_7-your-rights","7. Your rights",[20,1286,1287],{},"Under GDPR you have the right to:",[153,1289,1290,1296,1302,1308,1314,1323,1329],{},[63,1291,1292,1295],{},[24,1293,1294],{},"access"," your personal data (Art. 15),",[63,1297,1298,1301],{},[24,1299,1300],{},"rectification"," of inaccurate data (Art. 16),",[63,1303,1304,1307],{},[24,1305,1306],{},"erasure"," (Art. 17),",[63,1309,1310,1313],{},[24,1311,1312],{},"restriction"," of processing (Art. 18),",[63,1315,1316,1319,1320,1322],{},[24,1317,1318],{},"object"," to processing based on legitimate interest (Art. 21). You can also do this in the Game's ",[24,1321,1023],{}," settings,",[63,1324,1325,1328],{},[24,1326,1327],{},"data portability",", where it applies (Art. 20). It does not apply to gameplay data, which we process on the basis\nof legitimate interest, and",[63,1330,1331,1334,1335,1338,1339,430],{},[24,1332,1333],{},"lodge a complaint"," with the supervisory authority, the ",[24,1336,1337],{},"Office for Personal Data Protection"," (Úřad pro ochranu\nosobních údajů), Pplk. Sochora 27, 170 00 Prague 7, ",[181,1340,1343],{"href":1341,"rel":1342},"https:\u002F\u002Fwww.uoou.gov.cz",[185],"www.uoou.gov.cz",[20,1345,1346,1347,430],{},"To exercise your rights, email ",[181,1348,886],{"href":1349},"mailto:info@cyber-framework.net?subject=GDPR%20request",[20,1351,1352,1355,1356,1358],{},[24,1353,1354],{},"Gameplay data:"," the session identifier changes every time you play and we do not store your nickname, so once a\nsession ends we cannot tell which records are yours. The ",[24,1357,1023],{}," panel shows your current session\nidentifier. If you copy it and send it to us, we will delete the data from that session. Without it, we cannot act on\naccess, erasure, or similar requests for gameplay data (Art. 11 GDPR). The quickest way to stop further processing is\nto turn off usage analytics in the Game.",[20,1360,1361,1364],{},[24,1362,1363],{},"Other data"," (for example, emails you sent us): we will handle your request in the usual way.",[20,1366,1367],{},"We will reply within one month.",[35,1369,1371],{"id":1370},"_8-security","8. Security",[20,1373,1374],{},"All traffic is encrypted (HTTPS). Data is stored on servers we operate within the EU, and only the operator has access\nto it. Gameplay data is stored separately from IP addresses, and data exported for analysis is stripped of anything\nthat could link it back to our servers.",[35,1376,1378],{"id":1377},"_9-changes-to-this-policy","9. Changes to this policy",[20,1380,1381],{},"We may update this policy, for example when we add new features or B2B services. We will publish the current version\non this page with a new effective date. If the change is significant, the Game will show you the privacy panel again\nand we will also announce the change on the Website.",[20,1383,1384,1385],{},"This policy is published in Czech and English. ",[24,1386,1387],{},"If the two versions differ, the Czech version prevails.",{"title":291,"searchDepth":292,"depth":292,"links":1389},[1390,1391,1392,1399,1403,1404,1405,1406,1407],{"id":861,"depth":292,"text":862},{"id":890,"depth":292,"text":891},{"id":919,"depth":292,"text":920,"children":1393},[1394,1395,1396,1397,1398],{"id":923,"depth":295,"text":924},{"id":1033,"depth":295,"text":1034},{"id":1071,"depth":295,"text":1072},{"id":1102,"depth":295,"text":1103},{"id":1125,"depth":295,"text":1126},{"id":1138,"depth":292,"text":1139,"children":1400},[1401,1402],{"id":1205,"depth":295,"text":1206},{"id":1218,"depth":295,"text":1219},{"id":1225,"depth":292,"text":1226},{"id":1265,"depth":292,"text":1266},{"id":1283,"depth":292,"text":1284},{"id":1370,"depth":292,"text":1371},{"id":1377,"depth":292,"text":1378},"gdpr","How Cyber Framework processes personal data on cyber-framework.net and in the game at play.cyber-framework.net.","i-lucide-lock",{"locale":1412},"en","\u002Fprivacy",{"title":832,"description":1409},{"loc":1413},"privacy","4AumDkOqCOHX-1X5sWeKyTyojHhMR0tY7Ilw_bniXJ4",{"id":1419,"title":1420,"body":1421,"counterpart":1416,"description":1961,"extension":304,"icon":1410,"meta":1962,"navigation":309,"path":1964,"seo":1965,"sitemap":1966,"slug":1408,"stem":1968,"toc":309,"__hash__":1969},"pages_cs\u002Fcs\u002Fprivacy.md","Zásady ochrany osobních údajů",{"type":9,"value":1422,"toc":1941},[1423,1427,1432,1438,1442,1445,1454,1461,1465,1485,1488,1492,1496,1544,1550,1556,1562,1568,1572,1582,1588,1592,1605,1625,1629,1644,1656,1660,1666,1678,1682,1692,1696,1702,1749,1760,1764,1773,1777,1780,1784,1787,1814,1817,1821,1835,1839,1842,1897,1903,1912,1918,1921,1925,1928,1932,1935],[836,1424],{"className":1425,"description":1426,"title":1420},[839],"Jak zpracováváme osobní údaje na webu cyber-framework.net a ve hře na play.cyber-framework.net.",[20,1428,1429],{},[24,1430,1431],{},"Verze 1.1 · Účinná od 13.10.2026",[20,1433,1434,1435,1437],{},"Cyber Framework jsme navrhli tak, aby sbíral co nejméně údajů. Hra nemá uživatelské účty, nikdy po vás nechceme\nskutečné jméno ani kontaktní údaje a herní data, která sbíráme, jsme navrhli tak, abychom nevěděli, kdo jste. Tyto\nzásady vysvětlují, co zpracováváme, proč, a jaká máte práva podle obecného nařízení o ochraně osobních údajů (EU)\n2016\u002F679 („ ",[24,1436,857],{},"“) a zákona č. 110\u002F2019 Sb., o zpracování osobních údajů.",[35,1439,1441],{"id":1440},"_1-kdo-je-správce","1. Kdo je správce",[20,1443,1444],{},"Správcem vašich osobních údajů je:",[20,1446,1447,1449,1450,1453],{},[24,1448,870],{},", fyzická osoba podnikající, IČO: 22056475, se sídlem E. Košťála 1009, Pardubice 530 12, Česká\nrepublika („ ",[24,1451,1452],{},"my","“).",[20,1455,1456,1457,1460],{},"Kontakt ve všech věcech ochrany osobních údajů:\n",[181,1458,886],{"href":1459},"mailto:info@cyber-framework.net?subject=Ochrana%20osobn%C3%ADch%20%C3%BAdaj%C5%AF",".\nPověřence pro ochranu osobních údajů jsme nejmenovali, protože nám tato povinnost nevzniká.",[35,1462,1464],{"id":1463},"_2-na-co-se-zásady-vztahují","2. Na co se zásady vztahují",[153,1466,1467,1477],{},[63,1468,1469,1470,1472,1473,1476],{},"na web ",[24,1471,899],{}," („ ",[24,1474,1475],{},"Web","“) a",[63,1478,1479,1480,1472,1482,1453],{},"na prohlížečovou hru na ",[24,1481,910],{},[24,1483,1484],{},"Hra",[20,1486,1487],{},"Pokud Hru používá škola, firma nebo jiná organizace na základě samostatné písemné smlouvy, může se zpracování údajů\njejích hráčů řídit touto smlouvou a smlouvou o zpracování osobních údajů (čl. 28 GDPR). Organizace pak může být\nsprávcem a my jejím zpracovatelem.",[35,1489,1491],{"id":1490},"_3-jaké-údaje-zpracováváme-a-proč","3. Jaké údaje zpracováváme a proč",[15,1493,1495],{"id":1494},"_31-hraní-hry","3.1 Hraní Hry",[926,1497,1498,1514],{},[929,1499,1500],{},[932,1501,1502,1505,1508,1511],{},[935,1503,1504],{},"Údaj",[935,1506,1507],{},"Účel",[935,1509,1510],{},"Právní základ",[935,1512,1513],{},"Doba uchování",[948,1515,1516,1530],{},[932,1517,1518,1521,1524,1527],{},[953,1519,1520],{},"Náhodný identifikátor relace, který se při každém spuštění Hry vygeneruje znovu a během hraní se uchovává jen v paměti (nikdy se neukládá do úložiště prohlížeče)",[953,1522,1523],{},"Propojení událostí v rámci jedné herní relace",[953,1525,1526],{},"Oprávněný zájem na provozu a zlepšování Hry (čl. 6 odst. 1 písm. f) GDPR)",[953,1528,1529],{},"24 měsíců od pořízení",[932,1531,1532,1535,1538,1541],{},[953,1533,1534],{},"Herní události: akce (např. otevření e-mailu, kliknutí na odkaz), volby, skóre, reakční doby, pohyb a směr pohledu v herním světě a čas od začátku relace",[953,1536,1537],{},"Provoz Hry, zobrazení souhrnných statistik, zlepšování scénářů a statistické a výzkumné vyhodnocení účinnosti školení",[953,1539,1540],{},"Oprávněný zájem (čl. 6 odst. 1 písm. f) GDPR); výzkum s ochrannými opatřeními podle čl. 89 GDPR",[953,1542,1543],{},"Podrobné údaje o pohybu: 6 měsíců, poté je převedeme na souhrnné tepelné mapy. Ostatní události: 24 měsíců od pořízení, poté je nevratně anonymizujeme nebo agregujeme",[20,1545,1546,1549],{},[24,1547,1548],{},"Co nesbíráme."," Vaše přezdívka (herní jméno) zůstává jen ve vašem prohlížeči a na náš server se nikdy neodesílá. Nikdy\nnezaznamenáváme, co napíšete do simulovaných formulářů ve Hře (např. falešných přihlašovacích stránek), ale jen to, že\njste formulář odeslali. K herním datům neukládáme vaši IP adresu ani údaje o zařízení. Nepoužíváme webovou kameru ani\nmikrofon vašeho zařízení. Směrem pohledu rozumíme to, kam se dívá vaše postava v herním světě.",[20,1551,1552,1555],{},[24,1553,1554],{},"Proč se opíráme o oprávněný zájem."," Naším oprávněným zájmem je porozumět tomu, jak lidé reagují na simulované\nkybernetické hrozby, abychom mohli školení zlepšovat a ověřit, zda funguje. Protože údaje s vámi nelze spojit a\nsdílení můžete kdykoli vypnout, považujeme dopad na vás za minimální.",[20,1557,1558,1561],{},[24,1559,1560],{},"Ochranná opatření pro výzkum."," Herní data analyzujeme, mimo jiné pomocí nástrojů pro process mining, pouze\nv pseudonymizované podobě. Než data opustí naše servery kvůli analýze, odstraníme z nich vše, co by je mohlo spojit\ns relací uloženou u nás. Nikdy se nepokoušíme hráče identifikovat ani je rozpoznat podle herního chování. Ve Hře\nzobrazujeme jen souhrnné statistiky, a to až když odpoví alespoň 10 hráčů. Výsledky můžeme zveřejnit v odborných\npracích, včetně závěrečné práce na Masarykově Univerzitě. Publikace obsahují jen souhrnné nebo anonymizované výsledky.",[20,1563,1564,1567],{},[24,1565,1566],{},"I tak s nimi zacházíme jako s osobními údaji."," Údaje jsme navrhli tak, abychom nevěděli, kdo jste. V rámci jedné\nrelace jsou ale události propojeny identifikátorem relace. Proto s nimi zacházíme jako s pseudonymními osobními údaji\na chráníme je podle GDPR.",[1008,1569],{"color":1010,"description":1570,"icon":1012,"title":1571,"variant":1014},"Některé scénáře obsahují falešné přihlašovací stránky. Heslo, e-mail i přezdívku, které ve Hře zadáváte, si vždy vymyslete.","Nikdy nezadávejte skutečná hesla ani osobní údaje",[20,1573,1574,1577,1578,1581],{},[24,1575,1576],{},"Vypnutí:"," Při prvním spuštění Hry vás panel ",[24,1579,1580],{},"Soukromí a data (GDPR)"," informuje o sdílení dat a můžete ho rovnou\nvypnout. Analytiku používání a hlášení o pádech můžete vypnout zvlášť a svou volbu můžete kdykoli změnit v nastavení\nHry. Pokud analytiku používání vypnete během relace, smažeme i data z této relace.",[20,1583,1584,1587],{},[24,1585,1586],{},"Musíte nám údaje poskytnout?"," Ne. Pokud vypnete sdílení dat, můžete celou Hru hrát dál. Nerozhodujeme o vás\nvýhradně automatizovaně, včetně profilování, s právními či obdobně závažnými účinky (čl. 22 GDPR).",[15,1589,1591],{"id":1590},"_32-sledování-chyb-web-i-hra","3.2 Sledování chyb (Web i Hra)",[20,1593,1594,1595,1598,1599,1602,1603,430],{},"Když Web nebo Hra spadne nebo nastane chyba, odešleme chybové hlášení do naší ",[24,1596,1597],{},"vlastní instance GlitchTip",". Hlášení\nmůže obsahovat vaši ",[24,1600,1601],{},"IP adresu",", typ prohlížeče a operačního systému (user agent), adresu stránky a technické\npodrobnosti o chybě. Neobsahuje vaši přezdívku, herní data ani nic, co napíšete. Ve Hře můžete hlášení o pádech vypnout\nv nastavení ",[24,1604,1580],{},[153,1606,1607,1613,1619],{},[63,1608,1609,1612],{},[24,1610,1611],{},"Účel:"," hledání a oprava chyb a ochrana bezpečnosti služby.",[63,1614,1615,1618],{},[24,1616,1617],{},"Právní základ:"," oprávněný zájem na funkční a bezpečné službě (čl. 6 odst. 1 písm. f) GDPR).",[63,1620,1621,1624],{},[24,1622,1623],{},"Doba uchování:"," 90 dní.",[15,1626,1628],{"id":1627},"_33-analytika-web-i-hra","3.3 Analytika (Web i Hra)",[20,1630,1631,1632,1635,1636,1639,1640,1643],{},"Návštěvnost a zapojení měříme pomocí ",[24,1633,1634],{},"vlastní instance Plausible Analytics",". Plausible ",[24,1637,1638],{},"nepoužívá cookies"," a ",[24,1641,1642],{},"neukládá vaši IP adresu ani žádný identifikátor",". Vaši IP adresu a user agent použije jen krátce, aby z nich\nvypočítal anonymní otisk, který se každý den mění a nikdy se neukládá společně s IP adresou. Vidíme jen souhrnné\nstatistiky, například počet návštěv, zobrazené stránky, odkazující weby, zemi a typ zařízení.",[153,1645,1646,1651],{},[63,1647,1648,1650],{},[24,1649,1617],{}," oprávněný zájem na tom, abychom věděli, jak se Web a Hra používají (čl. 6 odst. 1 písm. f) GDPR).",[63,1652,1653,1655],{},[24,1654,1623],{}," uchováváme jen souhrnné statistiky, a to po dobu provozu Webu a Hry.",[15,1657,1659],{"id":1658},"_34-když-nás-kontaktujete","3.4 Když nás kontaktujete",[20,1661,1662,1663,1665],{},"Pokud nám napíšete na ",[181,1664,886],{"href":1109}," nebo nás kontaktujete jinak, zpracujeme vaši e-mailovou adresu, jméno\n(pokud ho uvedete) a obsah zprávy, abychom vám mohli odpovědět.",[153,1667,1668,1673],{},[63,1669,1670,1672],{},[24,1671,1617],{}," oprávněný zájem na komunikaci s vámi (čl. 6 odst. 1 písm. f) GDPR), případně jednání o smlouvě na\nvaši žádost (čl. 6 odst. 1 písm. b) GDPR).",[63,1674,1675,1677],{},[24,1676,1623],{}," po dobu potřebnou k vyřízení vaší žádosti, zpravidla nejdéle 3 roky od skončení komunikace (obecná promlčecí lhůta podle českého práva).",[15,1679,1681],{"id":1680},"_35-serverové-logy","3.5 Serverové logy",[20,1683,1684,1685,1687,1688,1691],{},"Když otevřete Web nebo Hru, náš webový server automaticky zpracuje technické údaje, jako je vaše IP adresa, čas\npožadavku a požadovaná adresa. Potřebujeme je, abychom vám mohli obsah doručit a chránit službu před útoky. IP adresy\nneukládáme společně s herními daty. ",[24,1686,1617],{}," oprávněný zájem (čl. 6 odst. 1 písm. f) GDPR). ",[24,1689,1690],{},"Doba\nuchování:"," nejdéle 90 dní.",[35,1693,1695],{"id":1694},"_4-cookies-a-úložiště-prohlížeče","4. Cookies a úložiště prohlížeče",[20,1697,1698,1701],{},[24,1699,1700],{},"Žádné vlastní cookies nenastavujeme",", a to na Webu ani ve Hře. Hra ve vašem prohlížeči uchovává tato data:",[926,1703,1704,1719],{},[929,1705,1706],{},[932,1707,1708,1711,1714,1716],{},[935,1709,1710],{},"Údaje",[935,1712,1713],{},"Typ",[935,1715,1507],{},[935,1717,1718],{},"Doba",[948,1720,1721,1735],{},[932,1722,1723,1726,1729,1732],{},[953,1724,1725],{},"Přezdívka, postup ve Hře, nastavení soukromí a informace, zda jste viděli panel soukromí",[953,1727,1728],{},"localStorage (Hra)",[953,1730,1731],{},"Umožňuje Hře fungovat a pamatovat si váš postup a volby",[953,1733,1734],{},"Dokud nevymažete data prohlížeče",[932,1736,1737,1740,1743,1746],{},[953,1738,1739],{},"Identifikátor relace",[953,1741,1742],{},"Jen v paměti",[953,1744,1745],{},"Propojuje události v rámci jedné herní relace",[953,1747,1748],{},"Smaže se, když Hru zavřete",[20,1750,1751,1752,1755,1756,1759],{},"Toto úložiště je ",[24,1753,1754],{},"technicky nezbytné"," pro fungování Hry, a proto k němu podle § 89 odst. 3 zákona č. 127\u002F2005 Sb.,\no elektronických komunikacích, nepotřebujeme souhlas. ",[24,1757,1758],{},"Reklamní ani sledovací cookies nepoužíváme."," Uložená data\nmůžete kdykoli smazat v nastavení prohlížeče.",[15,1761,1763],{"id":1762},"vložená-videa-z-youtube","Vložená videa z YouTube",[20,1765,1766,1767,1772],{},"Některé stránky obsahují videa ze služby YouTube (Google Ireland Limited). Náhledové obrázky videí hostujeme na\nvlastních serverech. Přehrávač YouTube se načte z domény youtube-nocookie.com až poté, co kliknete na „Přehrát video“.\nDo té doby se Googlu nic neodesílá. Kliknutím souhlasíte s tím, že YouTube získá vaši IP adresu a může do vašeho\nzařízení ukládat cookies (čl. 6 odst. 1 písm. a) GDPR, § 89 odst. 3 zákona č. 127\u002F2005 Sb.). Souhlas můžete kdykoli\nodvolat smazáním cookies YouTube v prohlížeči. Za načtení přehrávače odpovídáme společně s Googlem (čl. 26 GDPR). Za\ndalší zpracování odpovídá Google podle svých ",[181,1768,1771],{"href":1769,"rel":1770},"https:\u002F\u002Fpolicies.google.com\u002Fprivacy?hl=cs",[185],"zásad ochrany soukromí",".\nGoogle může předávat údaje mimo EU na základě rámce pro ochranu osobních údajů mezi EU a USA (EU–US Data Privacy\nFramework).",[15,1774,1776],{"id":1775},"odkazy-na-jiné-služby","Odkazy na jiné služby",[20,1778,1779],{},"Web obsahuje odkazy na Discord, LinkedIn, Instagram a GitHub. Dokud na odkaz nekliknete, nic se těmto službám\nneodesílá. Po kliknutí se řídíte jejich vlastními zásadami ochrany soukromí.",[35,1781,1783],{"id":1782},"_5-příjemci-a-zpracovatelé","5. Příjemci a zpracovatelé",[20,1785,1786],{},"Vaše údaje neprodáváme ani je nesdílíme pro marketing. Přístup k nim mohou mít:",[153,1788,1789,1798,1806,1811],{},[63,1790,1791,1793,1794,1797],{},[24,1792,1236],{}," (Německo), náš poskytovatel hostingu. Web, backend Hry, Plausible i GlitchTip běží na\nserverech, které provozujeme v datových centrech společnosti Hetzner ",[24,1795,1796],{},"v rámci EU",". Hetzner je naším zpracovatelem\nna základě smlouvy o zpracování osobních údajů.",[63,1799,1800,1802,1803,1805],{},[24,1801,1246],{}," (USA), který zajišťuje naše DNS a přeposílá e-maily zaslané na ",[181,1804,886],{"href":1109},".\nCloudflare je naším zpracovatelem na základě smlouvy o zpracování osobních údajů.",[63,1807,1808,1810],{},[24,1809,1255],{}," (EU), který provozuje naši e-mailovou schránku, jako náš zpracovatel.",[63,1812,1813],{},"orgány veřejné moci, pokud to vyžaduje zákon.",[20,1815,1816],{},"Společnosti Cloudflare a Google (YouTube, viz článek 4) sídlí v USA. Předávání údajů těmto společnostem se opírá\no rámec pro ochranu osobních údajů mezi EU a USA a o standardní smluvní doložky Evropské komise. V jiných případech\nosobní údaje mimo Evropský hospodářský prostor nepředáváme.",[35,1818,1820],{"id":1819},"_6-děti","6. Děti",[20,1822,1823,1824,1827,1828,1831,1832,1834],{},"Hra je určena hráčům ",[24,1825,1826],{},"od 15 let",". Protože děti zasluhují zvláštní ochranu (recitál 38 GDPR), měly by děti ",[24,1829,1830],{},"mladší 15 let"," hrát jen s vědomím a pod dohledem rodiče, zákonného zástupce nebo učitele. Věk ověřit nemůžeme,\nprotože od hráčů nesbíráme jména ani kontaktní údaje. I proto jsme herní data navrhli tak, aby z nich nebylo možné\nnikoho identifikovat. Učitelé, kteří Hru používají ve výuce, by měli žákům připomenout, že přezdívku, heslo i e-mail\nve Hře si mají vždy vymyslet. Sdílení dat mohou vypnout v nastavení ",[24,1833,1580],{}," na každém zařízení.",[35,1836,1838],{"id":1837},"_7-vaše-práva","7. Vaše práva",[20,1840,1841],{},"Podle GDPR máte právo:",[153,1843,1844,1851,1857,1863,1869,1878,1884],{},[63,1845,1846,1847,1850],{},"na ",[24,1848,1849],{},"přístup"," ke svým osobním údajům (čl. 15),",[63,1852,1846,1853,1856],{},[24,1854,1855],{},"opravu"," nepřesných údajů (čl. 16),",[63,1858,1846,1859,1862],{},[24,1860,1861],{},"výmaz"," (čl. 17),",[63,1864,1846,1865,1868],{},[24,1866,1867],{},"omezení"," zpracování (čl. 18),",[63,1870,1871,1874,1875,1877],{},[24,1872,1873],{},"vznést námitku"," proti zpracování na základě oprávněného zájmu (čl. 21). Můžete tak učinit i v nastavení ",[24,1876,1580],{}," ve Hře,",[63,1879,1846,1880,1883],{},[24,1881,1882],{},"přenositelnost"," údajů, pokud se uplatní (čl. 20). Na herní data se nevztahuje, protože je zpracováváme na\nzákladě oprávněného zájmu, a",[63,1885,1886,1889,1890,1893,1894,430],{},[24,1887,1888],{},"podat stížnost"," u dozorového úřadu, kterým je ",[24,1891,1892],{},"Úřad pro ochranu osobních údajů",", Pplk. Sochora 27, 170 00\nPraha 7, ",[181,1895,1343],{"href":1341,"rel":1896},[185],[20,1898,1899,1900,430],{},"Svá práva uplatníte e-mailem na\n",[181,1901,886],{"href":1902},"mailto:info@cyber-framework.net?subject=GDPR%20%C5%BE%C3%A1dost",[20,1904,1905,1908,1909,1911],{},[24,1906,1907],{},"Herní data:"," Identifikátor relace se při každém hraní mění a vaši přezdívku neukládáme, proto po skončení relace\nnedokážeme určit, které záznamy jsou vaše. Panel ",[24,1910,1580],{}," zobrazuje identifikátor vaší aktuální\nrelace. Pokud si ho zkopírujete a pošlete nám ho, data z této relace smažeme. Bez něj nemůžeme u herních dat vyhovět\nžádosti o přístup, výmaz a podobně (čl. 11 GDPR). Nejrychleji zastavíte další zpracování tak, že ve Hře vypnete\nanalytiku používání.",[20,1913,1914,1917],{},[24,1915,1916],{},"Ostatní údaje"," (například e-maily, které jste nám poslali): vaši žádost vyřídíme běžným způsobem.",[20,1919,1920],{},"Odpovíme vám do jednoho měsíce.",[35,1922,1924],{"id":1923},"_8-zabezpečení","8. Zabezpečení",[20,1926,1927],{},"Veškerá komunikace je šifrovaná (HTTPS). Údaje ukládáme na serverech, které sami provozujeme v rámci EU, a přístup\nk nim má jen provozovatel. Herní data ukládáme odděleně od IP adres a z dat exportovaných k analýze odstraňujeme vše,\nco by je mohlo spojit s našimi servery.",[35,1929,1931],{"id":1930},"_9-změny-těchto-zásad","9. Změny těchto zásad",[20,1933,1934],{},"Tyto zásady můžeme aktualizovat, například když přidáme nové funkce nebo služby pro firmy. Aktuální verzi zveřejníme na\ntéto stránce s novým datem účinnosti. Při podstatných změnách vám Hra znovu zobrazí panel soukromí a změnu oznámíme\ntaké na Webu.",[20,1936,1937,1938],{},"Tyto zásady jsou zveřejněny v češtině a angličtině. ",[24,1939,1940],{},"Pokud se obě verze liší, rozhoduje česká verze.",{"title":291,"searchDepth":292,"depth":292,"links":1942},[1943,1944,1945,1952,1956,1957,1958,1959,1960],{"id":1440,"depth":292,"text":1441},{"id":1463,"depth":292,"text":1464},{"id":1490,"depth":292,"text":1491,"children":1946},[1947,1948,1949,1950,1951],{"id":1494,"depth":295,"text":1495},{"id":1590,"depth":295,"text":1591},{"id":1627,"depth":295,"text":1628},{"id":1658,"depth":295,"text":1659},{"id":1680,"depth":295,"text":1681},{"id":1694,"depth":292,"text":1695,"children":1953},[1954,1955],{"id":1762,"depth":295,"text":1763},{"id":1775,"depth":295,"text":1776},{"id":1782,"depth":292,"text":1783},{"id":1819,"depth":292,"text":1820},{"id":1837,"depth":292,"text":1838},{"id":1923,"depth":292,"text":1924},{"id":1930,"depth":292,"text":1931},"Jak Cyber Framework zpracovává osobní údaje na webu cyber-framework.net a ve hře na play.cyber-framework.net.",{"locale":1963},"cs","\u002Fcs\u002Fprivacy",{"title":1420,"description":1961},{"loc":1967},"\u002Fcs\u002Fgdpr","cs\u002Fprivacy","wNRLsmcPPAth_oH_GNaMdXn-xqRGFOcqb0a9TCpQ_g0",1792020361877]