We use cookies to give you the best experience on our website. You can choose which cookies you want to allow below. You can find more details in our privacy policy.
Purpose | So that the user's cookie preferences can be taken into account, these are stored in the cookies. |
Data | Accepted or rejected cookie categories |
Originator | Lywand Software GmbH |
Privacy Policy |
Purpose | This web analytics tool allows us to compile user statistics about your website activity and to best tailor our website to your interests. |
Data | anonymized IP address, pseudonymized user identification, date and time of the request, amount of data transferred incl. message as to whether the request was successful, browser used, operating system used, website from which access was made. |
Originator | Google Ireland Limited |
Privacy Policy |
Purpose | Representation of the company's location using Google's map service. |
Data | Date and time of visit, location information, IP address, URL, usage data, search terms, geographic location. |
Originator | Google Ireland Limited |
Privacy Policy |
Purpose | Convenient appointment scheduling via Calendly directly on the website. |
Data | Appointment information, calendar information, information from third-party software providers, payment information, chatbot data, marketing information, log & device data, cookie data, usage data |
Originator | Calendly LLC |
Privacy Policy |
Purpose | This data processing is performed by YouTube to ensure the functionality of the player. |
Data | Device information, IP address, referrer URL, viewed videos |
Originator | Google Ireland Limited |
Privacy Policy |
The year 2022 was a year full of change and progress for lywand. In this article, we look back on the past year and give a preview of the developments that await us in 2023.
The year 2022 was a year full of change and progress for lywand. We celebrated our second founding anniversary and gained a new distribution partner.
We also extended our security audit platform with an internal audit and moved to a consumption billing model to offer our partners more flexibility and cost efficiency.
In this article, we look back on the past year and give you a preview of the developments that await us in 2023.
On July 20th 2022, we entered into a new distribution partnership with Fokus MSP GmbH. Together with our two distribution partners Fokus MSP & Nuvias, we were able to convince a total of 208 IT service providers of lywand and win them as partners. Compared to last year, we have increased this number almost tenfold. In the meantime, the number of renovated companies has also risen to 368.
A total of 1,728 external security audits were carried out. Compared to the previous year, this number has increased almost sixfold, compared to a total of 308 at the end of 2021.
Since the launch of the internal audit at the end of October, 11,474 internal audits have already been carried out.
Due to the fact that external audits of the IT infrastructure take place monthly as standard, and internal audits are carried out daily on the end device, the amount of internal audits is much higher than that of external audits.
The average duration of an external security audit is 10 hours, compared to the internal audit, which takes only 9 minutes for a complete check.
During the external audit, lywand performs a comprehensive check (e.g. web servers, VPN gateways, mail servers, web applications, etc.) for security vulnerabilities and possible gateways from the perspective of a potential attacker. In addition, there is an examination of whether possibly stolen company data records are in circulation on the dark net.
We have developed our own agent for the internal audit. This agent checks best practice configurations on the basis of known security vulnerabilities (CVE), as well as current patch levels on the end device. To create a foundation as broad as possible, basic security mechanisms such as Windows Firewall, current antivirus software or the use of Office macros are also checked. In addition, there is a separate assessment category of ransomware protection, which shows at a glance the exposure of the IT environment to a ransomware attack.
Our platform distinguishes a total of 138,576 different vulnerabilities, which it checks as part of the security audits. So far, we have been able to detect around 12,113 security vulnerabilities in clients' IT infrastructures.
Among the vulnerabilities we discovered, the following five were the most serious:
Missing patches
This type of vulnerability occurs when systems or applications are not kept up to date. They can be easily exploited by hackers to gain access to systems and data.
SQL Injection
This is where malicious code input is injected into a system to gain access to databases and other systems.
Outdated operating systems
Older operating systems can be more easily exploited by hackers because they are usually no longer patched by manufacturers.
Security gaps in outdated CMS systems
Content management systems (CMS) are important for managing websites and other online resources. If they are outdated, they can be more easily exploited by hackers.
Insecure authentication
Authentication vulnerabilities can enable hackers to gain access to systems and data by pretending to be an authorized user.
Compared to the most serious vulnerabilities in 2021, there are some differences. In 2021, insecure or hacked passwords were the most serious vulnerability, while in 2022 it dropped out of the ranking. Vulnerabilities in outdated CMS systems were the second most serious vulnerability in 2021, while they moved down to 4th place in 2022.
In 2021, insecure file sharing systems and outdated web server software and operating systems were also in the top five most serious vulnerabilities. In 2022, however, they are no longer in the ranking. Instead, missing patches, SQL injection and vulnerabilities in outdated CMS systems have been added in 2022. Insecure authentication rounds out the current ranking of the most serious vulnerabilities.
The comparison shows that the most serious vulnerabilities can change over time. In addition, the internal audit which was launched in autumn has led to new vulnerabilities which have influenced the ranking.
Among the vulnerabilities we discovered in 2022, the following five were the most common:
Lack of patches
As mentioned above, it is important to keep systems and applications up to date to avoid security vulnerabilities.
SSL misconfiguration
Secure Sockets Layer (SSL) is used to ensure the security of data transmissions over the internet. Misconfiguration of these settings can result in data being more easily intercepted by hackers.
Web server misconfiguration
Misconfiguration of the web server can result in data being more easily intercepted by hackers. It is essential that web servers are regularly checked and configured to avoid this type of vulnerability.
Compromised user information
If user information such as passwords and usernames fall into the hands of hackers, they can easily gain access to systems and cause damage. It is essential that users apply strong passwords and regularly change their passwords to avoid this type of vulnerability.
Security vulnerabilities in outdated CMS systems
As already mentioned, CMS systems are critical for managing websites and other online resources. It is indispensable that they are regularly updated to ensure that they cannot be exploited by hackers.
Some of the most serious vulnerabilities, such as lack of patches and security weaknesses in outdated CMS systems, are also found among the most common vulnerabilities. This means that these vulnerabilities are not only common, but also have potentially problematic consequences.
It is therefore essential to take the right measures to address vulnerabilities and take adequate measures to avoid the possibility of future ones.
An eventful year 2022 lies behind us! We are on a very good path with the product development of the internal audit for SMEs, our swing to the consumption billing model and the MSSP-only approach. The current success and the great acceptance of the innovative MSSPs makes us feel highly confident for 2023.
The motivation and atmosphere in our team is extraordinary. Together with our constantly growing partner landscape, we are living our lywand DNA and helping more and more SMEs with their cybersecurity hygiene.
Our roadmap includes two major themes: cloud and network. We are working to expand our security audit platform in these areas to provide even more functionalities to our partners.
We are strongly oriented towards the needs of our partners and adjust our development focus accordingly. In this way, we want to ensure that the requirements of our partners are taken into account in the best possible way.
Guide
System hardening is an essential process for protecting your customers' IT infrastructure. But what exactly is system hardening and why is it so important?
Feature
As part of our security audits, compliance with CIS benchmarks is now also displayed. Read the article to learn more about this new feature and the added value it provides.
Guide
This article highlights the differences between the traditional IT service model and the Managed Service Provider (MSP) approach. It explains the advantages of the MSP approach and how the transition from a traditional IT service provider to an MSP can be successfully managed.