View as a webpage / Share

Volume 22 — Issue 35 | September 1, 2022

NIOSH publishes recommendations for reducing needlesticks and other sharps injuries to law enforcement officers

Police officers are routinely exposed to the risk of puncture wounds from needlesticks and other sharp objects, particularly when conducting searches as part of traffic stops, investigations, or arresting a subject.

The National Institute for Occupational Safety and Health (NIOSH) investigated needlestick injuries in a police department in Ohio and published the results in a 2017 case study. The case study found that most needlestick injuries occurred during pat-down searches and searches of a suspect’s property or vehicle.

The risk of exposure to bloodborne pathogens via needlestick injury is high. Research has shown that approximately 60% to 80% of persons who inject drugs have hepatitis C virus (HCV), and 9% of new human immunodeficiency virus (HIV) cases are a result of syringe sharing.

The cost of post-exposure prophylaxis (PEP) for exposed officers is also high. Officers with needlestick injuries may have to endure harsh and expensive treatments over several weeks to reduce the chance of infection and further transmission of bloodborne pathogens.

To address this significant workplace safety issue for law enforcement officers, NIOSH released a bulletin last month, Reducing Work-Related Needlestick and Other Sharps Injuries Among Law Enforcement Officers, with recommended steps for employers and employees to reduce these risks.

The bulletin’s recommendations are based on a “hierarchy of controls”, which groups actions by their likely effectiveness at reducing or removing hazards.

Recommendations for employers include administrative controls, such as ensuring a bloodborne pathogen exposure control plan is in place that complies with the Occupational Safety and Health Administration’s regulations on bloodborne pathogens. For employees, the recommendations cover training and safety measures, such as the use of tactical search mirrors or flashlights when conducting searches in areas of low visibility.

The recommendations emphasize the importance of reporting needlestick and other sharps injuries immediately after they occur, so officers can receive PEP to reduce the chance of transmission and infection. Reporting can also help identify patterns of injuries and inform prevention measures.

Many additional recommendations are provided for preventing or reducing exposure, safe handling, and disposal. The bulletin provides a references section for more information on this safety issue.

You can access this “Workplace Solutions” bulletin on NIOSH’s website.

(Source: NIOSH)

Highlights

NIOSH publishes recommendations for reducing needlesticks and other sharps injuries to law enforcement officers

First responders test emerging technologies during DHS S&T’s 2022 Urban OpEx event

Checklist for Communications Technology in Training and Exercises from NCSWIC

NIST hosts virtual 2022 Disaster Resilience Symposium on Sept. 14-15

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

First responders test emerging technologies during DHS S&T’s 2022 Urban OpEx event

The Department of Homeland Security (DHS) Science and Technology Directorate (S&T) recently held its Urban Operational Experimentation (OpEx) event in New York City. The event was hosted by S&T’s National Urban Security Technology Laboratory (NUSTL), which is based in Manhattan.

Urban OpEx put seven new and emerging technologies into the hands of first responders so they could explore each one’s features, functions, and capabilities, then give end-user feedback to the developers behind these tools.

The lineup of technologies for the week featured unmanned aircraft systems (UAS), deployable robotics, handheld sensors, AI-enabled gun detection, incident management and situational awareness platforms, and deployable communications. The OpEx planning team selected participating technologies by validating them against specific criteria identified by first responders as high priority capability gaps.

First responders evaluated the viability of these technology solutions in a wide variety of emergency services scenarios in urban environments. Some of the testing scenarios included chemical detection at large events, perimeter surveillance, transportation of blood and other medical supplies, urban search and rescue missions, post-disaster assessments, and several other real-world scenarios.

More than 150 participants attended the event, representing public safety and cybersecurity at federal, state, and local levels. The industry partners who developed these technologies participated under Cooperative Research and Development Agreements with S&T.

Information and feedback collected during Urban OpEx 2022 will be published in a series of technology reports on S&T’s website and will be searchable in DHS’s publications library. Federal, state, local, tribal, and territorial first responders will be able to access the reports to inform their decision-making and guide future technology investments.

See DHS S&T’s Fact Sheet and Feature Article to learn more about this event and the technologies that were evaluated by first responders. Watch DHS S&T’s short video on Urban OpEx to learn more about the program.

(Source: DHS S&T)

Checklist for Communications Technology in Training and Exercises from NCSWIC

The National Council of Statewide Interoperability Coordinators’ (NCSWIC’s) Planning, Training, and Exercise (PTE) Committee has developed a Checklist for Communications Technology in Training and Exercises.

Training and exercises can be the perfect place to introduce new and emerging technologies and to demonstrate how they can be useful in responding to an incident.

The purpose of this 2-page Checklist is to provide planning and evaluation considerations for Statewide Interoperability Coordinators (SWICs) and other emergency preparedness personnel when incorporating new communications technology into a training or exercise.

The Checklist includes considerations for how to build the new technologies into an exercise based on the exercise parameters; what evaluation criteria could be used to assess the technologies; the kinds of partners and stakeholders who should be consulted or involved; and other tips to make the use and evaluation of the technology successful.

This Checklist was developed directly from emergency communications professionals’ experiences. It is easily printed, but also has interactive features within the electronic version.

Access the Checklist for Communications Technology in Training and Exercises along with many other resources for ensuring communications interoperability through training and exercises on CISA’s SAFECOM website. Email NCSWICgovernance@cisa.dhs.gov with questions.

(Source: CISA)

NIST hosts virtual 2022 Disaster Resilience Symposium on Sept. 14-15

The Engineering Laboratory at the National Institute of Standards and Technology (NIST) will host its 5^th annual 2022 Disaster Resilience Symposium on Sept. 14-15, 2022.

This virtual event will feature keynote speakers who will discuss the resilience of United States infrastructure against natural disasters, especially the resilience of lifelines such as electric, power, and water supply. Speakers will also discuss how structural engineering and building codes can help to mitigate the impact of natural hazards on communities.

These keynote topics are supported by presentations on the research being done through NIST’s Disaster Resilience Grant Program. Each grant recipient will present their work and then answer questions about their research and related topics.

The Disaster Resilience Grant Research Program awardees support several research areas and programs at NIST, including:

• Disaster and Failure Studies. This research area explores building and infrastructure performance as well as emergency response and evacuation procedures. By understanding the technical causes leading to structural or response failures and then making that information public, NIST engineers and researchers strive to prevent similar failures in the future.
• National Earthquake Hazards Reduction Program (NEHRP). The four agencies of the NEHRP work together to manage earthquake risks through a broad range of activities, including: seismic hazard assessments; research in structural, geotechnical, and applied earthquake engineering; the translation of research into design guidance and model building codes; implementation of improved earthquake-resistant design guidance for new and existing structures; earthquake monitoring and notification; and more.
• Windstorm Impact Reduction. Research projects in this area aim to achieve major measurable reductions in the losses of life and property from windstorms through better understanding of windstorm impacts and the implementation of cost-effective mitigation measures to reduce those impacts.
• Reduced Ignition of Building Components in Wildland-Urban Interface (WUI) Fires Project. This project aims to advance wildland urban interface (WUI) fire science by exploring how structural ignition occurs through firebrands. Experiments using full-scale and reduced-scale firebrand generator facilities in Japan will help to validate and improve WUI fire models, translate into better testing methodologies for future WUI fire science research, and support improved building codes that better address WUI fire hazards.

NIST’s 2022 Disaster Resilience Symposium is virtual and free to attend but advanced registration is required.

(Source: NIST)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

NSA and CISA share tips to secure the software supply chain

The U.S. National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) released tips on Thursday, Sept. 1, on securing the software supply chain.

This guidance is designed by the Enduring Security Framework (ESF)—a public-private partnership that works to address threats to U.S. critical infrastructure and national security systems—to serve as a collection of suggested practices for software developers.

The ESF will release two more advisories coinciding with the software supply chain lifecycle, with the other two parts in this series focusing on software suppliers and customers.

You can find detailed information on how to develop secure code, verify third-party components, harden build environments, and deliver code securely in today's advisory, Securing the Software Supply Chain: Recommended Practices Guide for Developers.

(Source: Bleeping Computer)

Microsoft: Nation-state Iranian hackers exploit Log4Shell against Israel

Iranian hacker group MuddyWater, allegedly linked to the country’s state intelligence service, continues to exploit the Log4j vulnerability to gain access to corporate networks in Israel amid an ongoing proxy war between the two countries, according to new research.

The threat actor, which is also known as Mercury, has targeted vulnerabilities in SysAid, a popular IT management software used by many Israeli organizations, according to a report published by Microsoft on Thursday. U.S. Cyber Command said earlier this year that the group is affiliated with the Iranian Ministry of Intelligence and Security.

(Source: The Record)

HC3 Threat Profile: Evil Corp

Evil Corp (AKA UNC2165) is a one of the most capable cybercriminal syndicates in the world. They are based out of Russia and have been operational since 2009. They are responsible for the development and operations of several of the most powerful malware and ransomware variants, and maintain strong relationships not just with other powerful cybercriminal gangs, but also the Russian government. The U.S. federal government has indicted members of their gang and has an active bounty offered for information on their leadership. Evil Corp has been observed modifying their activities to circumvent U.S. federal government actions to stop them.

Evil Corp should be considered a significant threat to the U.S. health sector based on several factors. Read the full Evil Corp Threat Profile from the Department of Health and Human Services (HHS) Health Sector Cybersecurity Coordination Center (HC3).

(Source: HHS HC3)

Mitigating Cybersecurity Risk in Telehealth Smart Home Integration: Cybersecurity for the Healthcare Sector

The National Cybersecurity Center of Excellence (NCCoE), a part of the National Institute of Standards and Technology (NIST), published a final project description on Mitigating Cybersecurity Risk in Telehealth Smart Home Integration.

This 26-page document describes how consumer-owned Internet of Things (IoT) devices may be used as part of a telehealth solution. Patients may obtain smart home devices that are endpoints that are not managed by a healthcare delivery organization (HDO). Smart home devices have internet access provided and managed by the consumer. Vulnerabilities or threats targeting the smart home device or patient network may affect a telehealth ecosystem when not appropriately managed. NCCoE cybersecurity experts will address this challenge through collaboration with members of the healthcare sector and vendors of cybersecurity solutions. The resulting reference design will detail an approach that can be used by HDOs.

(Source: NIST)

White House to give aviation executives classified cyberthreat briefing, latest in series of industry meetings

The White House has been conducting classified cybersecurity briefings with executives from select critical infrastructure sectors as part of an ongoing effort to compel industry leaders to invest more in their digital defenses.

The next meeting, scheduled for September, will be with executives from across the aviation industry. The upcoming meeting with aviation officials follows years of documented hacker attempts to breach aviation entities. In February, the cybersecurity firm Proofpoint published research showing a “consistent, active cybercrime threat” to the aviation sector since at least 2017.

(Source: CyberScoop)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites or the information, products or services contained therein. Reference to any specific commercial products, process or service by trade name, trademark, manufacturer or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the EMR-ISAC or the U.S. government.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.