axio - kn

Conti Leaks Confirm Ransomware Gang’s Nation State Connection to Russia

In the past two years, the innovative and formidable Conti ransomware gang has wrought havoc across 1000+ US and international organizations, making themselves a mainstream name across the cybersecurity community. The group recently made headlines again with the infamous Conti leaks, which turned the tables back on the ransomware group, revealing thousands of internal messages as well as its “most prized possession of all,” the source code of its ransomware. The leaks are thought to be an act of retaliation against Conti’s pro-Russia stance following its invasion of Ukraine. Given this latest news regarding one of the most ruthless ransomware-as-a-service groups (RaaS), we wanted to look at its history of attacking critical infrastructure organizations across the globe and examine lessons in cybersecurity operations that all businesses, but especially critical infrastructure organizations, can take away.

The Securities and Exchange Commission (SEC) released its final rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure on July 26, 2023. This gives organizations approximately five months to confirm compliance plans before the new disclosure requirements take effect in mid-December. 

In a recent webinar, Axio’s Global Co-founder and President, David White, sat down with American Gas Association’s Managing Director of Security and Operations, Kimberly Denbow, to discuss the latest release (v3) of API-1164, Pipeline Control Systems Cybersecurity, which is a NIST CSF-based community standard for cybersecurity regulation. We encourage you to check out the full webinar for all the enlightening details and discussion, which can be found on Axio’s website. Read on for some highlights…

New York, NY — April 12, 2022: Axio, the global leader in cyber risk management and quantification software, today announced its strongest quarterly performance in company history in Q1 2022, as organizations increasingly adopt cyber risk quantification solutions as a mandatory component of their cybersecurity programs. Highlights from Q1 include sales bookings doubled year-over-year, 31% growth in new logos acquisition, and the addition of several marquee clients such as Major League Soccer.  

New York, NY — April 8, 2022: Axio, a leading SaaS provider of cyber risk management and quantification solutions today announced they are working with Locuz Inc., a security-led digital transformation company, deepening their cyber security approach to help their customers. This relationship enables Locuz to provide customers the benefits of a rapid cyber risk assessment and quantification, measuring risk in dollars so that customers can make critical decisions to reduce the most impactful risks.

Executive Summary 

Federal support for critical infrastructure cybersecurity is more important than ever in these heightened times of the Ukraine-Russia conflict. There is growing concern Russia will engage in cyber-attacks targeting western critical infrastructure assets as retaliation for political interference. The United States private sector relies on the Department of Homeland Security’s Cybersecurity and Infrastructure Agency (CISA) for the latest best practices, intelligence, and collaboration tools. This article serves as an introduction to CISA’s important role in supporting the nation’s critical infrastructure sectors.  

In a recent report, Emerging Technologies: Top Use Cases in Integrated Risk Management, Gartner included Axio in a survey of IRM technology products and service providers. IRM tools have emerged as integral pieces to a modern and successful cybersecurity program. Previously known as Governance, Risk, and Compliance (GRC) tools, IRM tools address a wider range of use cases than the legacy GRC products of the past. They provide a “vertically integrated view of risk,” using your company’s business strategy as a jumping off point. By starting here, IRM tools can be used to address the unique cybersecurity needs of your organizational operations, regardless of size or industry. Unlike GRC tools, IRM products offer a dynamic and comprehensive view of your risk environment across business units, partners, and third-party vendors.   

Shortly after the Colonial hack, the Department of Homeland Security’s (DHS) Transportation Security Administration (TSA) announced a series of security directives aimed at requiring owners and operators of TSA-designated critical liquids and natural gas pipelines to assess their cybersecurity exposure and implement several urgently needed protections against cyber intrusion.

“Cybersecurity is an existential crisis for Governments and Businesses alike.” – Bob Dudley, Former CEO of BP & Chairman of the Board at Axio 

As the face of a company’s cybersecurity program, its CISO is often viewed by the public as the party responsible when a cyber-attack occurs. However, cybersecurity is not just a technical issue but is also a business and fiduciary issue. Ultimately, responsibility for making cyber risk management decisions falls squarely in the hands of the Board of Directors – who can be held personally or criminally liable in the face of a data breach. It is their duty to protect the business and ensure the sustainability of the organization. Yet, many Board members struggle to wrap their arms around cyber risk when faced with making costly decisions around security priorities and technology investments. Cybersecurity planning is challenging and can quickly become unwieldy regardless of your budget, and Boards need to know how a security incident will affect their company’s growth, shareholders’ value, and customer relationships.  

This past weekend, an estimated 112 million tv viewers tuned in to the Super Bowl LVI. Fans watched as Dr. Dre, Snoop Dog, Mary J. Blige, and other performers took the stage for a celebrated halftime show and ultimately witnessed the L.A. Rams triumph over the Cincinnati Bengals. Meanwhile, across the state, NFC runners up to the Rams, the San Francisco 49ers, suffered another crushing loss. While many Americans sat at home watching Super Bowl ad after Super Bowl ad touting cryptocurrency, hackers sought payment via crypto by extorting the 49ers in a ransomware attack.