View as a webpage / Share

Volume 22 — Issue 27 | July 7, 2022

USFA releases Pandemic Response Listening Sessions report

The United States Fire Administration (USFA) just released a report, Pandemic Response Listening Sessions, providing insights on how emergency response operations were impacted by the COVID-19 pandemic. The report also provides recommendations for actions that could be taken to improve operations and responder safety during future pandemics. Many recommendations could also apply to large-scale disasters or other events of national significance.

This report captures the input of more than 40 national stakeholders during a two-day listening session in October 2021. Stakeholders discussed the challenges and complexity of the pandemic for fire departments, emergency medical services providers, 911 dispatch telecommunicators and other response agencies at federal and state, local, tribal and territorial (SLTT) levels.

In the report, challenges and proposed solutions are organized into four categories: Workforce; Logistics and supply chain; Business operations and continuity; and Agency funding, grants and reimbursement.

While challenges were identified across all levels of government, most solutions offered in the report were captured from attendee comments as the solutions attendees believed could be mitigated by the federal government. Some of the challenges identified are highlighted here:

• Workforce. One of the most prominent workforce issues was lack of available personnel to fully staff shifts for response units and 911 call centers.
• Logistics and supply chain. Supply shortages and distribution of appropriate personal protective equipment (PPE), difficulty accessing testing and vaccines, and acquisition of decontamination equipment and agents were cited among the biggest logistics issues. These issues also made infection control a much bigger challenge, impacting responder health and safety.
• Business operations and continuity. Among the variety of reasons why the pandemic interrupted the response and continuity of operations for emergency response agencies, participants shared that EMS responders were not considered health care providers and not in the same tier as hospitals and other health care providers.
• Agency funding, grants and reimbursement. Decreased tax revenue in cities and fewer opportunities for fundraising led to funding challenges. Additionally, reimbursement for EMS care was not always received or did not adequately cover the actual cost of response and treatment.

Access the report on the USFA’s website to read the full list of challenges and recommended solutions. Agencies at all levels should develop plans to prepare for, respond to, and mitigate future pandemics with these challenges and solutions in mind.

(Source: USFA)

Highlights

USFA releases Pandemic Response Listening Sessions report

DHS S&T releases assessment report on portable radio repeaters for indoor and subterranean environments

NEMSIS data from nearly 49 million EMS activations in 2021 now available for research

CISA’s ChemLock training helps mitigate chemical security risks

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

DHS S&T releases assessment report on portable radio repeaters for indoor and subterranean environments

The National Urban Security Technology Laboratory (NUSTL), a federal laboratory within the Department of Homeland Security (DHS) Science and Technology Directorate (S&T), recently published an Assessment Report on portable radio repeaters for indoor and subterranean environments.

A radio repeater is a device that receives a radio frequency (RF) signal and re-transmits it at a higher power level to extend the effective coverage range. First responders deploy portable radio repeaters in areas with degraded radio coverage (e.g., indoors, underground, or rural areas) to extend the coverage range of their radios.

During the assessment, eight emergency responder evaluators rated four different portable radio repeaters based on a set of evaluation criteria across five areas: capability, usability, deployability, maintainability, and affordability.

The evaluators configured each repeater, hand carried it to an activity site at the assessment venue, activated the repeater and then communicated with each other on push-to-talk (PTT) radios while adjusting parameters on the repeater. Evaluators also participated in a simulated urban search-and-rescue exercise as the final operational assessment scenario.

This assessment was developed under NUSTL’s System Assessment and Validation for Emergency Responders (SAVER) program, in conjunction with the Department of Energy’s Pacific Northwest National Laboratory (PNNL).

Access the Assessment Report and related documents on DHS S&T’s Portable Communications Repeaters project page.

(Source: DHS S&T)

NEMSIS data from nearly 49 million EMS activations in 2021 now available for research

The National Emergency Medical Services Information System (NEMSIS) Technical Assistance Center (TAC) announced the release of the 2021 Public-Release Research Dataset, the largest publicly available dataset of emergency medical services (EMS) activations in the U.S.

The dataset includes information from patient care reports from nearly 49 million emergency EMS activations submitted by almost 14,000 EMS agencies serving communities across the country. Collected at the local level by individual EMS clinicians responding to calls and caring for patients, this data provides EMS agencies, states and the nation with critical insights for quality improvement, resource deployment, public health surveillance and more.

Since the National EMS Database and the NEMSIS data standard were created with support from the National Highway Traffic Safety Administration’s Office of EMS, researchers have used the data to study numerous important clinical and operational issues. This year alone, national EMS data has been used in articles addressing airway management, socioeconomic disparities, cardiac arrest, stroke and overdoses, just to name a few.

To learn more about the NEMSIS 2021 Public-Release Research Dataset, including how to request a copy of the dataset for research, visit nemsis.org, where you’ll find access to tutorials as well as online and pdf forms to request the data.

(Source: NEMSIS TAC)

CISA’s ChemLock training helps mitigate chemical security risks

More than 96% of all manufactured goods depend on chemicals in some way. Chemical facilities and businesses that interact with dangerous chemicals must mitigate the risk that these chemicals could be stolen and used in criminal activities or weaponized by terrorists.

To mitigate this risk, any facility or business that manufactures, stores, sells, or interacts with these chemicals in any way should be aware of the dangers. They should also ensure their facilities are secure and hardened against a potential attack.

The Cybersecurity and Infrastructure Security Agency’s (CISA’s) ChemLock program offers scalable, tailored training and technical assistance for facilities looking to enhance their chemical security posture.

While this training is targeted primarily to chemical facility personnel and retailers who handle dangerous chemicals, it may also benefit hazardous materials responders, emergency planners, or members of Local Emergency Planning Committees (LEPCs). This training can help kickstart chemical security discussions between facility or retail owners and operators and emergency planners in local jurisdictions where dangerous chemicals are sold, manufactured, stored, or transported.

CISA recently announced that it is now offering its online course, ChemLock: Introduction to Chemical Security, on a quarterly basis.

This course runs 1-2 hours in length and introduces the process of identifying, assessing, evaluating, and mitigating chemical security risks. It includes an easy-to-understand overview identifying key components and best practices of chemical security awareness and planning.

The following are upcoming quarterly offerings of ChemLock: Introduction to Chemical Security:

• July 13, 2022, from 9 to 11 a.m. EST.
• October 13, 2022, from 11 a.m. to 1 p.m. EST.
• January 11, 2023, from 3 to 5 p.m. EST.
• April 12, 2023, from 1 to 3 p.m. EST.

Those interested can register for any of these offerings using the registration links above. To learn more, visit CISA’s ChemLock Training page.

(Source: CISA)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA, FBI and Treasury release advisory on North Korean state-sponsored cyber actors use of Maui ransomware

CISA,  the Federal Bureau of Investigation (FBI), and the Department of the Treasury (Treasury) released a joint Cybersecurity Advisory (CSA) on July 6 that provides information on Maui ransomware, which has been used by North Korean state-sponsored cyber actors since at least May 2021 to target Healthcare and Public Health (HPH) Sector organizations.

The CSA titled, North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector, provides technical details and indicators of compromise (IOC) observed during multiple FBI incident response activities over a period of more than a year and obtained from industry analysis of Maui samples.

The HPH Sector, as well as other critical infrastructure organizations, are urged to review this joint CSA and apply the recommended mitigations to reduce the likelihood of compromise from ransomware operations. The FBI, CISA, and Treasury assess that North Korean state-sponsored actors are likely to continue targeting HPH Sector organizations, because of the assumption that these organizations are willing to pay ransoms to avoid disruption of the critical life and health services they provide. For more information on state-sponsored North Korean malicious cyber activity, see CISA’s North Korea Cyber Threat Overview and Advisories webpage.

(Source: CISA)

CISA announces Post-Quantum Cryptography Initiative

On July 6, CISA announced the establishment of a Post-Quantum Cryptography Initiative to unify and drive agency efforts to address threats posed by quantum computing. In March 2021, Secretary of Homeland Security Alejandro N. Mayorkas outlined his vision for cybersecurity resilience and identified the transition to post-quantum encryption as a priority. In coordination with interagency and industry partners, this new initiative will build on existing Department of Homeland Security (DHS) efforts as well as those underway at the Department of Commerce’s National Institute of Standards and Technology (NIST) to support critical infrastructure and government network owners and operators during the transition to post-quantum cryptography.

On July 5, NIST announced that it has chosen the first group of cryptographic algorithms. This is a key milestone toward their post-quantum cryptography standardization project to identify a new standard to replace the current, quantum-vulnerable cryptography.

Although NIST does not expect to publish a standard for use by commercial products until 2024, organizations should start preparing for the transition now by following the DHS and NIST Post-Quantum Cryptography Roadmap.

(Source: CISA)

CISA Alert (AA22-181A) - #StopRansomware: MedusaLocker

The FBI, CISA, Treasury, and the Financial Crimes Enforcement Network (FinCEN) are releasing this CSA to provide information on MedusaLocker ransomware. Observed as recently as May 2022, MedusaLocker actors predominantly rely on vulnerabilities in Remote Desktop Protocol (RDP) to access victims’ networks. Actors also frequently use email phishing and spam email campaigns—directly attaching the ransomware to the email—as initial intrusion vectors.

This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

Download the PDF version of this report.

(Source: CISA)

On-demand webinar: State of GovTech - How the Cloud Supports the Hybrid Government Workforce

More than two years into the hybrid work environment, agencies are still evaluating the best ways to empower their employees to work from anywhere. There’s no doubt that technology is part of the solution, yet those strategies are still taking shape as agencies wrestle with moving from their legacy systems to a hybrid cloud environment.

A webinar was conducted on June 15, entitled State of GovTech - How the Cloud Supports the Hybrid Government Workforce. The webinar was hosted by GovLoop, and co-sponsored by the Center for Internet Security and Red Hat. In this webinar, government and industry experts shared their advice on how SLTT government agencies can balance security and flexibility when transitioning to a hybrid cloud environment.

The webinar is now available on demand and can help state, local, tribal, and territorial government agencies gain insights on the evolution of hybrid cloud models to support their workloads and employees.

(Source: Center for Internet Security)

Cyberattacks against law enforcement are on the rise

Resecurity, a Los Angeles-based cybersecurity company protecting Fortune 500 companies worldwide, has registered an increase in malicious activity targeting law enforcement agencies at the beginning of Q2 2022. Threat actors are hacking email and other accounts which belong to police officers and their internal systems.

The emerging trend consists of threat actors sending fake subpoenas and Emergency Data Requests (EDRs) to their victims from the hacked law enforcement email accounts. Using such capabilities, the threat actors are targeting major technology companies such as Apple, Facebook (Meta), Snapchat, and Discord to collect sensitive information about targets of interest. The replies received by the bad actors contain sensitive details which could be used as leverage for extortion or cyberespionage. Such incidents have become especially notable in cybercriminal group activities such as LAPSUS$ and Recursion Group.

(Source: Security Affairs)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites or the information, products or services contained therein. Reference to any specific commercial products, process or service by trade name, trademark, manufacturer or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the EMR-ISAC or the U.S. government.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.