View as a webpage / Share

Volume 21 — Issue 22 | June 3, 2021

Five-year study now underway to determine COVID-19’s long-term impacts on first responders

As the country moves into its second year of the COVID-19 pandemic, longitudinal data on the impacts to first responders are being studied in many research initiatives.

Last year, researchers at Ohio State’s College of Medicine and the Wexner Medical Center were awarded a five-year, $10 million grant from the National Institutes of Health’s National Cancer Institute, to support a longitudinal study on the impact of COVID-19 on first responders and members of their households. The grant has funded the Center for Serological Testing to Improve Outcomes from Pandemic COVID-19 (STOP-COVID).

The study is now underway through a partnership between the Center to STOP-COVID, the Columbus Police Department and Columbus Division of Fire in Ohio. Researchers are currently enrolling EMS workers from these participating agencies in the clinical trial which will take 5 years to conduct.

First responders are a unique population because of their risk of exposure and re-exposure on the job. First responders were also among the first in line to receive COVID-19 vaccines.

STOP-COVID researchers are embarking on three projects: surveillance, serological sciences (studying blood serum and the response of the immune system to pathogens) and communication about testing and vaccines.

For the surveillance portion of the study, participating first responders are completing short weekly and monthly surveys gathering information on their health and their experiences with COVID-19. This will help researchers investigate how transmission may be occurring in their households and stations, interactions between exposure risks, immune responses, disease severity, and any barriers encountered to testing or vaccination.

For the clinical part of this study, asymptomatic first responders are being regularly tested for the COVID-19 virus and antibodies using state-of-the-art serological and molecular tests, developed at Ohio State. Once this data is collected, the second part of the study will examine factors linked to immune protection.

The STOP-COVID Center will be integrated with the National Cancer Institute’s Serological Sciences Network (SeroNet) and is part of a larger effort consisting of eight national centers and 10 other projects studying different aspects of COVID-19. These centers will develop a framework for sharing data, samples and investigative procedures with each other and, eventually, with outside entities who want to use the work for their own research.

(Source: Ohio State University)

Highlights

Five-year study now underway to determine COVID-19’s long-term impacts on first responders

CISA releases updates to Active Shooter Preparedness Program, encourages preparedness for gun-related violence

Transportation Research Board report offers insights on post-hurricane supply chain resilience from 2017 hurricanes Harvey, Irma and Maria

R2 Network, a nationwide public safety network connecting first responders and tech innovators, launches free learning hub

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

CISA releases updates to Active Shooter Preparedness Program, encourages preparedness for gun-related violence

The Cybersecurity and Infrastructure Security Agency, as the Nation’s risk advisor, encourages the critical infrastructure community to prepare for active shooter incidents, especially given recent increases in gun-related violence.

Seasonal patterns in criminal activity show that violence involving weapons tends to increase in the summer and fall months. More people gathering in public places in warmer weather over longer daylight hours likely contributes to these patterns. The lifting of COVID-19 restrictions across the nation and the heightened threat environment across the United States may exacerbate these trends even further this year.

CISA offers a multitude of online resources, virtual and in-person training opportunities, and direct assistance as part of its comprehensive Active Shooter Preparedness Program to support public safety agencies’ capacity-building efforts to prepare for, mitigate and respond to active shooter incidents. The program includes:

• Active Shooter Preparedness resources targeted to all stakeholders, with an extensive collection targeted to first responders specifically.
• Insider Threat Mitigation resources, since active shooter incidents have sometimes been perpetrated by an insider to the organization.
• Free independent study training, hosted by the Federal Emergency Management Agency’s Emergency Management Institute (EMI), IS-907 Active Shooter: What You Can Do and additional training opportunities for law enforcement.
• Two-hour, instructor-led webinars that inform organizations about the active shooter threat and how to create effective emergency action plans. During the COVID-19 pandemic, these webinars are offered in place of in-person workshops.
• CISA Protective Security Advisors, subject matter experts located across the country, offering direct support in identifying potential vulnerabilities and corresponding protective measures.

Additionally, CISA just released the 2021 edition of a comprehensive resource, Planning and Response to an Active Shooter: An Interagency Security Committee Policy and Best Practices Guide. This document outlines new policy requirements for all nonmilitary federal facilities within in the Executive Branch of the government and provides guidance for all who might be involved, including law enforcement agencies, facility tenants and the public. While not a policy requirement for state, local, tribal, and territorial agencies, these agencies may also benefit from this planning guidance.

For additional information regarding the Active Shooter Preparedness Program and Active Shooter Preparedness Workshops, contact asworkshop@cisa.dhs.gov.  For information regarding an upcoming webinar for your area or to connect with your local Protective Security Advisor, contact central@cisa.dhs.gov.

(Source: CISA)

Transportation Research Board report offers insights on post-hurricane supply chain resilience from 2017 hurricanes Harvey, Irma and Maria

As the country enters the 2021 hurricane season during the ongoing COVID-19 Public Health Emergency, post-hurricane supply chain resilience will be an important focus.

The Federal Emergency Management Agency (FEMA) asked the National Academies of Sciences, Engineering, and Medicine (NASEM), Committee on Building Adaptable and Resilient Supply Chains to analyze the function of supply chain networks and the lessons learned in areas affected by the 2017 hurricanes (Harvey, Irma and Maria).

A Consensus Study Report, originally published by the National Academies Press in 2020, Strengthening Post-Hurricane Supply Chain Resilience Observations from Hurricanes Harvey, Irma, and Maria was the response to FEMA’s request. An article highlighting key takeaways of this report was featured in the January-February 2021 issue of the Transportation Research Board (TRB) Newsletter, TR News. It explores FEMA’s role in supply chain resilience during recovery from the 2017 hurricanes and offers recommendations to help FEMA meet its strategic goals, outlined in its 2018-2022 Strategic Plan which include readying the nation for catastrophic disasters.

The first recommendation in this report is to shift the focus from pushing relief supplies to ensuring that regular supply chains are restored as rapidly as possible. Repairing and rebuilding damaged infrastructure is not seen as FEMA’s direct role, but FEMA could position itself to take an active leadership role in aiding such efforts.

Second, FEMA can help emergency management officials build a system-level understanding of supply chain dynamics as a foundation for effective decision support. This can be done through financial support and training.

Third, FEMA can support mechanisms for coordination, information sharing, and preparedness among supply chain stakeholders. Many state emergency management offices have significant capabilities but lack information access and sharing. Some of these information-sharing networks include the U.S. Department of Homeland Security’s Critical Infrastructure Threat Information Sharing Framework and Homeland Security Information Network (HSIN), the Information Sharing and Analysis Centers (ISACs), the Sector Coordinating Councils (SCCs) and Regional Consortium Coordinating Councils. These information-sharing networks enable government agencies and responders at the local, state and federal levels to interact with industry in responding to emergencies that affect supply chains.

Finally, FEMA can play a role in developing and administering training on supply chain dynamics and best practices for private–public partnerships that enhance supply chain resilience. These training programs would enable participants to analyze factors such as economic drivers within their jurisdiction, data that can inform decisions about priorities for restoration assistance to supply chains, ways that supply chain disruptions can impact economic conditions, and the cost of disaster response or mitigation actions versus the costs of not taking those actions.

(Source: Transportation Research Board)

R2 Network, a nationwide public safety network connecting first responders and tech innovators, launches free learning hub

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore

Public safety agencies who are interested in learning more about how to test, procure and adopt new and innovative technologies to support their public safety missions may want to check out the new R2 Network’s website, which has been steadily expanding capabilities over the past year and just launched a free learning hub.

The U.S. Department of Congress awarded funding last year to establish an interagency program between the Economic Development Administration (EDA), the National Institute of Standards and Technology (NIST) and the First Responder Network Authority (FirstNet Authority) to support the R2 Network Challenge. This goal of this program is to accelerate the speed at which startups and other organizations can bring innovations to the public safety market, create new businesses and jobs, and support community resilience.

The three agencies selected a public-private partnership to establish and operate the R2 Network, consisting of entrepreneurs, early stage investors, local government and public safety stakeholders. The R2 Network is nation-wide in scope, with regional innovation clusters supported by government partners and local agencies to test and pilot resources needed to adopt new technology. The “R2” stands for “Response and Resiliency.”

The R2 Network public-private partnership has since created an R2 website, home to the R2 Portal, which has garnered over 850 innovative companies and more than 1270 public safety agencies from all over the U.S. on its site since its official launch. The R2 website also hosts R2 Connect, a platform for in-person and online engagement for the R2 community to share, learn, and adopt best practices and new public safety technology.

In May 2021, R2 Network officially launched a third component of its website, called R2Learn, a brand new hub for educational content on all things public safety and innovation.

R2 Learn includes multiple content formats including podcasts, videos, articles, with courses and features topics such as EMS, 911 and Emergency Communications, Fire, Response, Resilience, Technology Adoption and more. Users have the ability to customize their educational experience by creating a library of educational content relevant to them, or by adding their own training materials to the site.

Membership in the R2 Network is free, and R2 Learn is free to use with the creation of a use profile.

(Source: R2 Network)

Cyber Information and Incident Assistance Links

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information
Links

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

National Cyber Awareness System Alert (AA21-148A): Sophisticated spearphishing campaign targets government organizations, IGOs, and NGOs

CISA and the Federal Bureau of Investigation (FBI) are engaged in addressing a spearphishing campaign targeting government organizations, intergovernmental organizations (IGOs), and non-governmental organizations (NGOs). A sophisticated cyber threat actor leveraged a compromised end-user account from Constant Contact, a legitimate email marketing software company, to spoof a U.S.-based government organization and distribute links to malicious URLs. CISA and FBI have not determined that any individual accounts have been specifically targeted by this campaign.

CISA and FBI acknowledge open-source reporting attributing the activity discussed in the report to APT29 (also known as Nobelium, The Dukes, and Cozy Bear). However, CISA and FBI are investigating this activity and have not attributed it to any threat actor at this time. CISA and FBI will update this Joint Cybersecurity Advisory as new information becomes available.

Resources:

• Volexity Blog: Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns | Volexity
• Microsoft Blog: New sophisticated email-based attack from NOBELIUM - Microsoft Security
• Microsoft Blog: Another Nobelium Cyberattack

Read a PDF version of the full report.

(Source: CISA, US-CERT)

CISA releases best practices for mapping to MITRE ATT&CK^®

As part of an effort to encourage a common language in threat actor analysis, the Cybersecurity and Infrastructure Security Agency (CISA) has released Best Practices for MITRE ATT&CK^® Mapping. The guide shows analysts—through instructions and examples—how to map adversary behavior to the MITRE ATT&CK framework. CISA created this guide in partnership with the Homeland Security Systems Engineering and Development Institute™ (HSSEDI), a DHS-owned R&D center operated by MITRE, which worked with the MITRE ATT&CK team.

CISA and other organizations in the cybersecurity community use MITRE ATT&CK to identify and analyze threat actor behavior. This analysis enables them to produce a set of mappings to develop adversary profiles; conduct activity trend analyses; and detect, respond to, and mitigate threats. An increase in the number of organizations integrating the ATT&CK framework in their analysis will have a positive impact on the efficiency and efficacy of information sharing within the community.

CISA, HSSEDI, and MITRE ATT&CK encourage users and administrators to review both the guide—as well as the CISA Executive Assistant Director’s blog post on the guide—to strengthen the security posture of their organization and improve information sharing.

(Source: CISA, US-CERT)

US says ransomware attack on meatpacker JBS likely from Russia

The White House said on Tuesday that Brazil's JBS SA has informed the U.S. government that a ransomware attack against the company that has disrupted meat production in North America and Australia originated from a criminal organization likely based in Russia.

JBS is the world's largest meatpacker and the incident caused its Australian operations to shut down on Monday and has stopped livestock slaughter at its plants in several U.S. states.

The disruptions to JBS's operations have already had an impact, analysts said. U.S. meatpackers slaughtered 94,000 cattle on Tuesday, down 22 percent from a week earlier and 18 percent from a year earlier, according to estimates from the U.S. Department of Agriculture. Pork processors slaughtered 390,000 hogs, down 20 percent from a week ago and 7 percent from a year ago.

JBS said it suspended all affected systems and notified authorities. It said its backup servers were not affected. The company, which has its North American operations headquartered in Greeley, Colorado, controls about 20 percent of the slaughtering capacity for U.S. cattle and hogs, according to industry estimates.

(Source: Reuters)

Azusa police computers hit by ransomware attack

Azusa police (in Los Angeles County, California) fell victim to a ransomware attack and the suspect got access to information in the department’s computers, authorities announced Friday, May 28.

On March 9, the department’s computer system had a security incident that led Azusa police to ask help from the FBI and the Los Angeles County Sheriff’s Department. Police also started working with specialists to find the source of the incident and the extent of the systems affected

Police haven’t arrested anyone yet and haven’t determined how many people were affected by the security breach. The department has no evidence of actual or attempted misuse of the information but made the announcement in an abundance of caution.

Police also don’t know the specific information accessed. The investigation is ongoing.

(Source: San Gabriel Valley [California] Tribune)

Buyer Be Aware: Integrating Cybersecurity into the Acquisition Process

A publication was released this April 2021 as a joint release between the National Association of Chief Information Officers (NASCIO), the Center for Internet Security (CIS) and the National Association of State Procurement Officials (NASPO). It addresses steps state governments should take to ensure cybersecurity is an integral part of the acquisition process. The publication also calls for a strong partnership between the CIO office,  Chief Information Security Officer (CISO) office, procurement office, state agencies and the private sector. The publication includes a list of recommendations aimed at assisting state governments in fully integrating cybersecurity into the acquisition process.

Download the full report from NASCIO.

(Source: NASCIO)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites or the information, products or services contained therein. Reference to any specific commercial products, process or service by trade name, trademark, manufacturer or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the EMR-ISAC or the U.S. government.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.