View as a webpage / Share

Volume 22 — Issue 20 | May 19, 2022

May is Mental Health Awareness Month: New resources for first responders

First responders face a unique set of stressors in their jobs that can create mental health challenges for them and their families. To meet these challenges, first responders need to know how to take care of their own mental health, and equally as important, they need a support network tailored to their unique needs.

May is Mental Health Awareness Month, and this year, several new resources and opportunities are available to support mental health for first responders. This article highlights new resources from three agencies’ programs, as well as tips on how first responders can support their own mental health.

The First Responders Children’s Foundation (FRCF) just launched a new resiliency program for children of first responders.  The program will provide expert therapy to children of first responders—at no cost to families—to help children manage, process and deal with a range of emotional challenges specific to their unique needs. This program started accepting applications on May 16, 2022. It will initially provide support in five states, including California, Florida, New York, Tennessee and Texas, with plans to expand its reach as the program grows.

The National Volunteer Fire Council (NVFC) is offering several courses on mental health in the fire and emergency services, free for a limited time. These include Addressing Substance Abuse, PTSD, and Other Concerns in the Fire Service, Creating a Psychologically Healthy Fire Department, and For Those Who Love a First Responder. The NVFC also held a webinar this month, now available on demand: Traumatic Events: Building Resiliency and Support Systems in the Emergency Services. Many additional NVFC resources for fire and EMS providers’ mental health, including videos, guides, courses, on-demand webinars, and the tools provided in its Share the Load program, are accessible here on the NVFC website.

The National Association of Emergency Medical Technicians (NAEMT), with support from FirstNet®, Built with AT&T, released a course earlier this year called the Mental Health Resilience Officer (MHRO) course. The role of the MRHO is to engage with peers to develop an understanding of mental health issues and resilience; identify peers who are experiencing mental health stressors and crises; navigate peers in need to the right services for help; and support the development of a culture of mental health resilience and emotional wellness within their agency. This course is eligible for 6 hours of Continuing Education credits through the Commission on Accreditation for Prehospital Continuing Education (CAPCE).

Finally, FireRescue1 recently published a list of 10 ways firefighters can support their own mental health. These practical self-care activities, such as ensuring you are getting enough quality sleep, exercise and keeping your social connections strong, are easy enough to remember, but can be quite challenging for first responders to put into practice due to the stressors imposed by their jobs. This article serves as a great reminder to help first responders prioritize these essential habits for maintaining mental health.

(Sources: FRCF, NVFC, NAEMT, FireRescue1)

Highlights

May is Mental Health Awareness Month: New resources for first responders

NIST competition aims to improve unmanned aircraft in indoor search and rescue scenarios

Summary and interactive map of 911 legislation enacted by states in 2021 now available

CISA’s 2022 Hurricane Season Preparedness webinar will be held June 1

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

NIST competition aims to improve unmanned aircraft in indoor search and rescue scenarios

The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) is launching a new prize competition series to advance the use of unmanned aircraft systems (UAS) by first responders for indoor search and rescue operations.

In the First Responder UAS Indoor Challenge, competitors will design, build and fly a cost-effective, easily flyable drone solution to help search and rescue teams gain better situational awareness prior to entering a building. Competitors will tackle difficulties in operating UAS indoors where GPS is unavailable, lighting is limited, or structural integrity is compromised.

The competition began accepting entries on April 27, 2022, with final concept papers and other required documentation due by July 15, 2022. Contestants will participate in multiple stages running through June 2023.

The First Responder UAS Indoor Challenge is encouraging all drone enthusiasts to bring their ideas to this competition. To learn about eligibility requirements, visit challenge.gov. For additional information about the challenge and to register, visit firstresponderuaschallenge.org.

Those interested can also learn more about last year’s competition, the 2021 First Responder UAS Triple Challenge, at uastriplechallenge.com. The live demonstration by last year’s contestant winners is scheduled for June 20-24, 2022 in Starkville, Miss. Nearby first responders interested in attending can email psprizes@nist.gov.

(Source: NIST)

Summary and interactive map of 911 legislation enacted by states in 2021 now available

Every year, states consider or enact legislation aimed at improving and supporting the efficiency of 911 emergency communication services.

Since 2012, the National Conference of State Legislatures (NCSL) has been working in cooperation with the National Highway Traffic Safety Administration’s (NHTSA’s) National 911 Program on the 911 National Legislation Tracking project. As part of this project, the NCSL maintains a searchable 911 Legislation Tracking Database with up-to-date information about 911 legislation that has been introduced in the 50 states and the District of Columbia.

The NCSL and the National 911 Program recently published a summary and interactive state-by-state map of key legislation introduced in 2021, based on the information that was captured in the database last year.

In 2021, thirty-seven states enacted 84 bills to support and improve the operation of public emergency communications services. Highlights include:

• New laws requiring training for telecommunicators in telephone cardiopulmonary resuscitation (T-CPR) were enacted in four states.
• New laws creating or increasing fees for 911 services were enacted in two states.
• New laws related to mental health crisis hotlines were enacted in five states. All of these laws aimed to redirect individuals who called 911 and were experiencing mental health crises to a crisis team or health provider specifically equipped to deal with mental health or behavioral problems.

The 911 Legislation Tracking Database serves as a resource for states seeking to improve their emergency communications operations. States can learn about neighboring legislative efforts in this field by using the database to compare recently enacted or modified 911 legislation.

The database captures information related to 911 administration, fees and funding, privacy and confidentiality, E911 and NG911. It is searchable by state, topic, keyword, year, status or primary sponsor with information dating back to 2011. New measures are added as they are introduced or identified by NCSL staff, and the database is updated bi-weekly.

Access the complete summary of 2021 911 legislation, summaries of enacted legislation from past years, and the 911 Legislation Tracking Database on the NCSL’s website.

(Sources: NCSL, NHTSA)

CISA’s 2022 Hurricane Season Preparedness webinar will be held June 1

Of all recorded weather disasters in U.S. history, hurricanes have caused the most deaths and destruction. According to National Oceanic and Atmospheric Administration (NOAA) statistics, hurricanes cause the costliest damage to property and infrastructure. They are also the most lethal, with 6,697 deaths between 1980 and 2021. Preparedness and effective response to these formidable weather events is essential to mitigating loss.

The Cybersecurity and Infrastructure Security Agency (CISA) will conduct its 2022 Hurricane Season Preparedness Webinar on Wednesday, June 1, from 10:00 a.m. to 11:30 a.m. EST.

Federal, State, local, tribal, territorial, and private sector stakeholders and decision makers who are interested in better understanding the risks involved with critical infrastructure systems and interdependencies are invited to attend.

This annual event will address current events, disaster preparedness and recovery, and what you can do to keep yourself, others, and our critical infrastructure safe and secure. The webinar will discuss how CISA staff and partners will execute improved preparedness and response activities during the approaching hurricane season, with a focus on CISA’s role and resources available for hurricane preparedness and response activities associated with systems that make landfall on the continental U.S. or U.S. territories.

Representatives from CISA’s National Risk Management Center, National Coordinating Center for Communications (ESF#2), and Cross Sector Business and Infrastructure (ESF#14) will join the Federal Emergency Management Agency’s National Business Emergency Operations Center (NBEOC) and NOAA to highlight capabilities and plans for this coming hurricane season.

To learn more about this event and to share this information with colleagues who may be interested in attending, see CISA’s downloadable webinar flyer. Advanced registration is required to attend.

(Source: CISA)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA issues Emergency Directive and releases advisory related to VMware vulnerabilities

CISA has issued Emergency Directive (ED) 22-03 and released a Cybersecurity Advisory (CSA) in response to active and expected exploitation of multiple vulnerabilities in the following VMware products: VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM), VMware vRealize Automation (vRA), VMware Cloud Foundation, vRealize Suite Lifecycle Manager.

The CSA, AA22-138B: Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control, provides indicators of compromise and detection signatures from CISA as well as trusted third parties to assist administrators with detecting and responding to active exploitation of CVE-2022-22954 and CVE-2022-22960.  Malicious cyber actors were able to reverse engineer the vendor updates to develop an exploit within 48 hours and quickly began exploiting these disclosed vulnerabilities in unpatched devices. Based on this activity, CISA expects malicious cyber actors to quickly develop a capability to exploit CVE-2022-22972 and CVE-2022-22973, which were disclosed by VMware on May 18, 2022.

CISA strongly encourages all organizations to deploy updates provided in VMware Security Advisory VMSA-2022-0014 or remove those instances from networks. CISA also encourages organizations with affected VMware products that are accessible from the internet to assume compromise and initiate threat hunting activities using the detection methods provided in the CSA. If potential compromise is detected, administrators should apply the incident response recommendations included in the CSA.

(Source: CISA)

Threat actors exploiting F5 BIG IP CVE-2022-1388

CISA and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have released the joint Cybersecurity Advisory Threat Actors Exploiting F5 BIG-IP CVE-2022-1388 in response to active exploitation of CVE-2022-1388, which affects F5 Networks BIG-IP devices. The vulnerability allows an unauthenticated actor to gain control of affected systems via the management port or self-IP addresses.

CISA encourages users and administrators to review the joint advisory for detection methods and mitigations, which include updating F5 BIG-IP software, or, if unable to immediately update, applying temporary workarounds. 

(Source: CISA)

Weak security controls and practices routinely exploited for initial access

The cybersecurity authorities of the United States, Canada, New Zealand, the Netherlands, and the United Kingdom have issued a joint Cybersecurity Advisory (CSA) on 10 routinely exploited weak security controls, poor configurations, and bad practices that allow malicious actors to compromise networks. While these poor practices may be common, organizations can apply basic practices to help protect their systems. CISA encourages organizations to review Weak Security Controls and Practices Routinely Exploited for Initial Access and apply the recommended mitigations.

(Source: CISA)

CISA releases analysis of FY21 Risk and Vulnerability Assessments

CISA has released an analysis and infographic detailing the findings from the 112 Risk and Vulnerability Assessments (RVAs) conducted across multiple sectors in Fiscal Year 2021 (FY21).

The analysis details a sample attack path comprising 11 successive tactics, or steps, a cyber threat actor could take to compromise an organization with weaknesses that are representative of those CISA observed in FY21 RVAs. The infographic highlights the three most successful techniques for each tactic that the RVAs documented. Both the analysis and the infographic map threat actor behavior to the MITRE ATT&CK® framework.

CISA encourages network defenders to review the analysis and infographic and apply the recommended mitigations to protect against the observed tactics and techniques. For information on CISA RVAs and additional services, visit the CISA Cyber Resource Hub.  

(Source: CISA)

Cyber actors scrape credit card data from US business’ online checkout page and maintain persistence by injecting malicious PHP code

As of January 2022, unidentified cyber actors unlawfully scraped credit card data from a U.S. business by injecting malicious PHP Hypertext Preprocessor (PHP) code into the business’ online checkout page and sending the scraped data to an actor-controlled server that spoofed a legitimate card processing server. The unidentified cyber actors also established backdoor access to the victim’s system by modifying two files within the checkout page. The Federal Bureau of Investigation (FBI) has identified and is sharing new indicators of compromise (IOCs), which may assist in network defense.

Read the full Industry Alert from the FBI’s Internet Crime Complaint Center (IC3).

(Source: FBI IC3)

Guidance on the Democratic People’s Republic of Korea information technology workers

The U.S. Department of State, the U.S. Department of the Treasury, and the Federal Bureau of Investigation issued a joint advisory to alert the international community, the private sector, and the public to attempts by the Democratic People’s Republic of Korea (DPRK) and remote DPRK information technology (IT) workers to obtain employment while posing as non-DPRK nationals.

The advisory is intended to provide freelance recruitment and digital payment platforms, along with private sector companies that may intentionally or inadvertently recruit, hire, or facilitate the hiring of DPRK IT workers, with information and tools to counter the risks associated with these activities.

(Source: U.S. Department of State)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites or the information, products or services contained therein. Reference to any specific commercial products, process or service by trade name, trademark, manufacturer or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the EMR-ISAC or the U.S. government.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.