View as a webpage / Share

Volume 22 — Issue 39 | September 29, 2022

DOJ releases recommendations for law enforcement response to mass protests

The COVID-19 pandemic, protests and rioting after the death of George Floyd, and the January 6 Capitol riots made 2020 and 2021 very challenging years for law enforcement officers and their families. Law enforcement agencies are using lessons learned from recent years to better prepare for future mass protest events.

After reviewing after-action reports and conducting a series of stakeholder meetings and workshops, the Department of Justice’s Office of Community Oriented Policing Services (COPS Office) recently released recommendations for law enforcement response to mass protests and protecting first amendment rights. The publication, 21st Century Protest Response: Promoting Democracy and Advancing Community and Officer Safety, was developed jointly by the COPS Office and the National Policing Institute as a guide for state, local, tribal, and territorial law enforcement agencies to address the challenges of mass demonstrations in the 21st century.

The publication recognizes that law enforcement agencies play a critical role in preserving and protecting First Amendment rights, which include the right to peaceably assemble and petition the government for changes. Law enforcement officers routinely facilitate demonstrators’ safety and security as they exercise their First Amendment rights, and an overwhelming majority of protests are peaceful.

However, law enforcement must also identify when intervention is necessary to maintain safety and public order, and this can be challenging. Law enforcement and government officials are often placed in the difficult position of identifying as early as possible whether the assembling group intends any potential violence. Law enforcement officers must respond appropriately with the goal of protecting the right to protest while safeguarding property as well as preserving officer and community safety.

The 62-page guide makes 102 recommendations centered around seven topics:

• Situational awareness – understanding the protest operating environment.
• Community relationship building and involvement.
• Planning and training.
• Response strategies and tactics.
• Communications.
• Officer safety and wellness.
• After-action review and follow up.

These recommendations can be used by law enforcement agencies as they prepare for future protest events. Access the report in the COPS Office Resource Center.

(Source: COPS Office)

Highlights

DOJ releases recommendations for law enforcement response to mass protests

Input requested from the public safety community to improve emergency communications capabilities

DHS launches first-of-its-kind cybersecurity grant program, applications due Nov. 15

Webinar: New Developments for Public Safety Drones

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

Input requested from the public safety community to improve emergency communications capabilities

Three opportunities are available in October to contribute your input to help advance emergency communications capabilities for public safety.

The National Institute of Standards and Technology (NIST), Public Safety Communications Research Division (PSCR) is conducting research to better understand user experience with, and beliefs about, extended reality (XR) technology. PSCR is soliciting feedback from those whose work includes or addresses public safety via a brief questionnaire. Questions relate to your beliefs about XR technology, your use of XR and other technologies, and your experience with public safety. Participation is completely voluntary and confidential. Access the anonymous questionnaire here. The deadline to participate is Tuesday, Oct. 4, 2022.

The First Responder Network Authority (FirstNet Authority) is the federal agency that oversees FirstNet, the nation’s communications network dedicated to emergency responders and the public safety community. FirstNet Authority is seeking stakeholder input on public safety’s current and future communications challenges and needs. This input will be used to inform the next update to the FirstNet Authority Roadmap, which is designed to guide the evolution of the FirstNet network. The survey is estimated to take about 10 minutes to complete. Access the survey here: FirstNet Authority 2023 Roadmap Update: Survey. Please submit responses by Friday, Oct. 7, 2022.

The Federal Emergency Management Agency (FEMA) is seeking public feedback on the National Incident Management System (NIMS) Information and Communications Technology Functional Guidance. Since the NIMS Incident Command System (ICS) was established in 2004, the complexity of communications resources has expanded significantly. Incident management has increasingly relied on new capabilities, including IT and cybersecurity, to support real-time decisions and situational awareness. The guidance provides instruction on integrating communication, information and cybersecurity into the ICS structure while adhering to the concepts and principles of the NIMS doctrine. To provide comments on the draft document, complete the feedback form located at FEMA.gov and submit the form to FEMA-NIMS@fema.dhs.gov no later than 5 p.m. EDT on Thursday, Oct. 20, 2022.

(Sources: NIST, FirstNet Authority, FEMA)

DHS launches first-of-its-kind cybersecurity grant program, applications due Nov. 15

On Sept. 16, the Department of Homeland Security (DHS) announced a first-of-its-kind cybersecurity grant program specifically for state, local, and territorial (SLT) governments across the country. A separate tribal cybersecurity grant program will be released later in the fall.

This new State and Local Cybersecurity Grant Program (SLCGP) was established by the State and Local Cybersecurity Improvement Act, part of the Bipartisan Infrastructure Law, to help address the unique challenges state, local, and territorial governments face when defending against cyber threats.

The cyber grant program provides $1 billion in funding to SLT partners over four years, with $185 million available for fiscal year 2022.

The program is designed to put the funding where it is needed most: into the hands of local entities. Local governments are eligible sub-recipients through their respective states and territories. State Administrative Agencies must pass-through at least 80% of the funds awarded under the SLCGP to local units of government, including at least 25% of funds to rural entities. The funding can be used for new or existing cybersecurity programs.

The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Emergency Management Agency (FEMA) are jointly managing the SLCGP. While CISA will serve as the subject matter expert in cybersecurity related issues, FEMA will provide grant administration and oversight.

CISA developed overarching goals and objectives for this program in the areas of governance and planning, assessment and evaluation, mitigation, and workforce development. CISA will support these efforts with a suite of available resources, including state cybersecurity coordinators and cybersecurity advisors.

FEMA has posted the Notice of Funding Opportunity (NOFO) for the SLCGP, along with a Fact Sheet, Frequently Asked Questions page and an Information Bulletin for State Administrative Agencies and other points of contact for eligible entities.

DHS has now opened the application process for this grant program, and CISA encourages all eligible entities to apply. The application deadline is 5 p.m. EST on Nov. 15, 2022.

For more information and helpful resources on the State and Local Cybersecurity Grant Program, visit CISA’s webpage and FEMA’s webpage on the SLCGP.

(Sources: DHS, CISA, FEMA)

Webinar: New Developments for Public Safety Drones

The National Volunteer Fire Council (NVFC) is hosting a webinar, New Developments for Public Safety Drones, on Oct. 20, 2022 from 2 to 3 p.m. EDT.

The use of drones has become more prevalent in many industries in recent years, including the fire service. Fire departments and other public safety agencies can utilize drones to increase efficiency and help protect personnel and the public.

In this webinar, the director of DRONERESPONDERS will describe the ways drones can benefit public safety and examine case studies from local agencies. Participants will then take a deep dive into how to implement a public safety drone program.

DRONERESPONDERS is a non-profit program created to unite new aerial first responders, emergency managers, and search and rescue specialists under a unified organization to help learn, train, and test with one another with the ultimate objective of maximizing drone operations for public safety.

This webinar is free but registration is required.

(Source: NVFC)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA and NSA publish joint cybersecurity advisory on control system defense

CISA and the National Security Agency (NSA) have published a joint cybersecurity advisory about control system defense for operational technology (OT) and industrial control systems (ICSs). Control System Defense: Know the Opponent is intended to provide critical infrastructure owners and operators with an understanding of the tactics, techniques, and procedures (TTPs) used by malicious cyber actors. This advisory builds on NSA and CISA 2021 guidance provided to stop malicious ICS activity against connected OT, and 2020 guidance to reduce OT exposure.

For more information on CISA’s resources and efforts to improve ICS cybersecurity, visit CISA’s role in industrial control systems webpage.

(Source: CISA)

MFA Fatigue: Hackers’ new favorite tactic in high-profile breaches

Hackers are more frequently using social engineering attacks to gain access to corporate credentials and breach large networks. One component of these attacks that is becoming more popular with the rise of multi-factor authentication (MFA) is a technique called MFA Fatigue. An MFA Fatigue attack is when a threat actor runs a script that attempts to log in with stolen credentials over and over, causing what feels like an endless stream of MFA push requests to be sent to the account's owner's mobile device. This type of social engineering technique has proven to be very successful by the Lapsus$ and Yanluowang threat actors when breaching large and well-known organizations, such as Microsoft, Cisco, and now Uber.

(Source: Bleeping Computer)

HC3 Threat Brief: APT 41 and Recent Activity

This Threat Brief from the Department of Health and Human Services (HHS) Health Sector Cybersecurity Coordination Center (HC3) reviews Advanced Persistent Threat Actor (APT) 41, a Chinese state-sponsored threat actor that has been actively tracked since 2012. APT 41 is also known as Double Dragon, Barium, Winnti, Wicked Panda, Wicked Spider, TG-2633, Bronze Atlas, and Red Kelpie.

APT 41 has a history of targeting healthcare, high-tech industries, telecommunications, higher education, video games, travel, and news organizations. The group frequently uses spear phishing, water holes, supply chain attacks, and backdoors.

The brief reviews the history of attacks by APT 41 on healthcare; relationship to China’s 14^th Five-Year Plan; recent attacks on healthcare; popular tactics, techniques, and procedures of the group; and reference materials.

(Source: HHS HC3)

CISA launches its Protective DNS Resolver with general availability for federal agencies

CISA announced on Sept. 27 that its Protective Domain Name System (DNS), its latest shared service offering, is available to all federal civilian executive branch (FCEB) agencies.

After successful testing with a limited number of agencies, CISA is now actively onboarding agencies into this service with modernized capabilities to detect and prevent threats in internet traffic and raise our collective cyber defense.

DNS resolves human-readable host names to Internet Protocol (IP) addresses. DNS Infrastructure is a common threat vector for attack campaigns. Protective DNS shields federal users and organizations from reaching known or suspected malicious destinations with a cutting-edge capability that safeguards network connections. It also empowers FCEB agencies with better visibility into their own internet traffic, providing real-time logs, reports and other insights into an ever-evolving cyber threat landscape.

For more information about this and other shared services, FCEB agencies may contact CISA’s Cybersecurity Shared Services Office at CyberSharedServices@cisa.dhs.gov. While CISA’s legal authorities currently limit provision of Protective DNS to FCEB agencies, all other organizations should visit CISA’s Cyber Resource Hub for additional available services.

(Source: CISA)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites or the information, products or services contained therein. Reference to any specific commercial products, process or service by trade name, trademark, manufacturer or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the EMR-ISAC or the U.S. government.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.