View as a webpage / Share

Volume 22 — Issue 11 | March 17, 2022

2022 Firefighter Safety Stand Down theme and educational resources now available

The 2022 Firefighter Safety Stand Down will take place the week of June 19-25, and this year’s theme is “Situational Awareness: The Foundation of Good Decision Making.”

Situational awareness during response operations can help firefighters solve problems, prevent bad outcomes, and make better decisions in high stress environments.

During Safety Stand Down week, five daily focus areas will highlight situational awareness during various incident types. The daily focus areas are:

• Monday: Structure fires.
• Tuesday: EMS.
• Wednesday: Wildland incidents.
• Thursday: Roadway response.
• Friday: Acts of violence.

Departments are asked to suspend all non-emergency activities during the week to focus their attention on safety and health education efforts around this year’s theme. A week is provided to ensure that all duty shifts can participate.

Many resources have been posted to the Resources page on SafetyStandDown.org. These can be used to start planning activities within your own department for the week.

In the months leading up to Safety Stand Down, organizations are encouraged to submit their own activities they are planning for the week, safety and health resources, media coverage and success stories. These shared stories, media, and resources will then be featured on SafetyStandDown.org for the benefit of all participants. More information and instructions for departments interested in sharing their own situational awareness-themed resources and success stories are available on the website.

The National Fire Protection Association (NFPA) will host the annual Safety Stand Down Quiz to raise awareness and foster a greater understanding of this year’s theme. Everyone who completes the online quiz will be automatically entered into a sweepstakes. Two hundred randomly selected participants will win a commemorative Safety Stand Down challenge coin.

Safety Stand Down week is a joint initiative of the International Association of Fire Chiefs (IAFC) Safety, Health and Survival Section, the National Volunteer Fire Council (NVFC), the National Fire Protection Association (NFPA), and the Fire Department Safety Officers Association (FDSOA).

Stay tuned and revisit www.safetystanddown.org in the months leading up to the event to access additional videos, presentations, training tools, messages, and the Safety Stand Down quiz.

(Source: SafetyStandDown.org)

Highlights

2022 Firefighter Safety Stand Down theme and educational resources now available

Updated Chemical Companion software provides decision support for hazardous chemical response

NIST releases Ransomware Profile and Quick Start Guide to help organizations manage ransomware risks

Talking TIM webinar: Outreach, tethered drones, and video analytics help ensure safe response to traffic incidents

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

Updated Chemical Companion software provides decision support for hazardous chemical response

When first responders encounter hazardous environments contaminated with chemical agents, they need to quickly identify the hazards of the chemicals involved. This information is used to make critical incident management decisions.

A software application called Emergency Response Decision Support System (ERDSS), also known as Chemical Companion, is used by many first responders for on-scene decision support when any chemical agents are involved.

Version 4.8 of this software has just been released and is now available free of charge to the military, law enforcement, and fire departments.

Features of this software include searchable reference material on thousands of common chemicals and synonyms, PPE, chemical detection equipment, Emergency Response Guidebook (ERG) and emergency medical information; and more. It also includes a robust set of tools for making decisions related to the chemicals involved. The software is available as a standalone application for environments without internet connectivity.

The Version 4.8 update includes new chemical threats and precursors, new chemical detectors, updated detector data, and Australia ERG 2020. New decision support tools have been added for chemical and biological destruction, fire combustion, munitions identification, air management, and several other new modules.

ERDSS is supported by several federal agencies, including the Irregular Warfare Technical Support Directorate (IWTSD), formerly known as the Combating Terrorism Technical Support Office (CTTSO). This federal support makes it possible to offer the software to first responders free of charge.

You can learn more about the capabilities of ERDSS by watching the video demonstration available on ChemicalCompanion.org and YouTube. The website also provides the full list of updated features and supported operating systems for Version 4.8.

Since ERDSS contains sensitive information, its use is restricted only to those with a “need to know.” This includes public safety and defense personnel in the U.S., Australia, and partner countries. These individuals must first request access, receive approval, and then register for an account through ChemicalCompanion.org.

ERDSS was developed by Hazard3. If you or your team are interested in training (web-based, remote delivery, or in-person) on the use of ERDSS, please contact Hazard3 at info@hazard3.com. For support with registration, contact support@chemicalcompanion.org.

(Source: Chemical Companion)

NIST releases Ransomware Profile and Quick Start Guide to help organizations manage ransomware risks

Cyberattacks on critical infrastructure are on the rise. The Emergency Services Sector, like all critical infrastructure sectors, is increasingly at risk.

Public safety leaders should know their agencies’ particular cybersecurity risks. The technology supporting public safety missions should be as secure as possible.

Last month, the National Institute of Standards and Technology (NIST) released Getting Started with Cybersecurity Risk Management: Ransomware, a Quick Start Guide providing guidance on how to use NIST’s new Ransomware Risk Management: A Cybersecurity Framework Profile (Ransomware Profile).

Ransomware is a type of malicious attack where attackers encrypt an organization’s data and demand payment to restore access. Attackers may also steal an organization’s information and demand an additional payment in return for not disclosing the information to authorities, competitors, or the public. Ransomware risk management includes gauging an organization’s level of readiness to counter ransomware threats and its capabilities to deal with the potential consequences of ransomware attacks.

NIST’s Ransomware Profile is intended for any organization with cyber resources that could be subject to ransomware attacks, regardless of sector or size. Organizations can use this document as a guide for profiling the state of their own readiness, determining their current “ransomware risk management profile,” and setting a target profile to identify gaps.

The Ransomware Profile maps security objectives for protecting against ransomware attacks to the five key functions in NIST’s Cybersecurity Framework (Identify, Protect, Detect, Respond, and Recover). It describes activities under each security objective to address cybersecurity challenges.

You can access the new Ransomware Profile and Quick Start Guide on NIST’s website.

(Source: NIST)

Talking TIM webinar: Outreach, tethered drones, and video analytics help ensure safe response to traffic incidents

The National Operational Center of Excellence (NOCoE), supported by the Federal Highway Administration (FHWA), is hosting a webinar on Wednesday, March 23 from 1:30 p.m. to 3:00 p.m. EST as part of its Talking TIM webinar series.

This webinar will discuss several current traffic incident management (TIM) initiatives relevant to responder safety and operations. These include:

• Outreach for responder safety through collaborations with the American Automobile Association (AAA) and the Towing and Recovery Association of America (TRAA).
• North Carolina’s tethered unmanned aircraft systems (UAS) program, which is being piloted as a method to aid emergency traffic management.
• Advanced responder warning through safety vests fueled by video analytics.

All webinars in the Talking TIM series pertain to traffic incident management (TIM), with a focus on successful programs, best practices, and technology that advances the profession of TIM. Topics covered in this series are often relevant to anyone with a role in emergency dispatch or emergency medical response to traffic incidents, emergency traffic management, or those with an interest in ensuring first responder safety on roadways. Webinars are typically held on the fourth Wednesday of each month.

Those interested in attending the free March 23 webinar can find out more and register via NOCoE’s website. You can also view recordings of past webinars in the series and sign up for updates, so you can be alerted when upcoming webinars are scheduled.

(Source: NOCoE)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

Mitigating threats posed by Russian state-sponsored cyber actors’ exploitation of default multifactor authentication protocol and "PrintNightmare" vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a joint cybersecurity advisory on March 15 with technical details, mitigations, and resources regarding previously demonstrated ability of Russian state-sponsored cyber actors to gain network access through exploitation of default multifactor authentication (MFA) protocols and a known vulnerability in Windows Print Spooler, “PrintNightmare.”

As early as May 2021, the Russian state-sponsored cyber actors took advantage of a misconfigured account set to default MFA protocols at a non-governmental organization, allowing them to enroll a new device for MFA and access the victim’s network. The actors then exploited a critical vulnerability “PrintNightmare” (CVE-2021-34527) to run arbitrary code with system privileges, and then were able to access cloud and email accounts for document exfiltration.

This advisory, titled Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and ‘PrintNightmare’ Vulnerability, provides observed tactics, techniques, and procedures (TTPs); indicators of compromise (IOCs); and mitigation recommendations. The FBI and CISA urge all organizations to take immediate action to protect against this malicious activity and apply recommended mitigations.

(Source: CISA)

What cyber incident reporting rules mean for critical infrastructure

Federal officials are beginning work with the private sector to prepare for the historic provision passed on March 10 that requires critical infrastructure providers to notify CISA of malicious cyber intrusions. Critical providers including utilities, banks, energy providers and other sectors will have to alert CISA within 72 hours of a major cyberattack or 24 hours of a ransom payment under new federal regulations.

The legislation gives CISA the authority to subpoena companies that fail to adhere to the reporting requirements and refer them to the Department of Justice if they fail to provide the requested information. The goal of the legislation is to provide legal cover for companies to share threat intelligence with law enforcement and government agencies. The SolarWinds attack showed how federal authorities had little to no insight into the nation's IT infrastructure.

(Source: Cybersecurity Dive)

SLTT perspectives to inform the State and Local Cybersecurity Grant Program

The Center for Internet Security (CIS) conducted a series of webinars among the MS-ISAC membership and the state, local, tribal, and territorial (SLTT) community to capture local, tribal, and state perspectives on the Cybersecurity Grant Program within H.R. 3684, the Infrastructure Investment and Jobs Act, and to identify what the MS-ISAC can do to best support its members’ interests and requirements. Over a two-week period, over 300 different SLTT organizations attended the webinars and provided comments.

This document articulates the perspectives shared.

(Source: Center for Internet Security)

The Kronos effect: Addressing mission-critical processes for healthcare continuity

Early this year, healthcare’s frontline workers began reporting disruptions to their paychecks stemming from a cyberattack and outage on human resources and payroll vendor Kronos. Multiple healthcare chief information security officers (CISOs) urged providers to learn from the mistakes made by the impacted providers to ensure business continuity when the inevitable attack strikes.

For providers, it will mean assessing clinical workflows and determining what processes are imperative to business operations, such as imaging, lab, pharmacy, drug suspension, and the electronic health record. Providers need to be evaluating how to maintain those key processes and partnerships that are business imperatives, especially when some providers are connected to each other. Fortunately for healthcare providers, federal agencies and non-profit organizations have been keenly focused on providing free resources to the sector aimed at these precise assessments and mitigation measures.

The overwhelming consensus is that the 405(d) Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP) is the easiest way to jumpstart the shift into strengthening these vast connections and vendor relationships.

(Source: SC Media)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites or the information, products or services contained therein. Reference to any specific commercial products, process or service by trade name, trademark, manufacturer or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the EMR-ISAC or the U.S. government.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.