View as a webpage / Share

Volume 22 — Issue 46 | November 17, 2022

FIRST develops model policies to protect fire-based EMS providers from workplace violence

Violence is the second most frequent cause of nonfatal injuries to emergency medical services (EMS) providers according to 2020 data from National Institute for Occupational Safety and Health (NIOSH). Most of these injuries occur during encounters with patients or with bystanders who are present during patient treatment.

Violence is a persistent workplace hazard that negatively impacts EMS providers’ well-being. The Center for Firefighter Injury Research & Safety Trends (FIRST) at Drexel University has been tackling the issue of workplace violence to EMS providers through objective data collection and analysis in collaboration with fire service practitioners and national partners for more than a decade.

FIRST’s Stress and Violence in Fire-Based EMS Responders (SAVER) program recently released a set of Model Policies to Protect U.S. Fire-Based EMS Responders from Workplace Stress and Violence (SAVER Model Policies).

The SAVER Model Policies are designed to shift the onus of safety and health from that of the individual first responder to the organization by focusing on actions that can be instituted through training, policy, and environmental modifications.

The Model Policies are organized into eight thematic areas and six phases of response, forming a framework to address everything that should be in place for every EMS run. Six “Pause Points” are incorporated at the end of each of phase. These are individual actions that responders take to protect themselves and provide feedback to the system on what is and isn’t working.

The Model Policies were developed through a national stakeholder consensus process which selected policies deemed to be the most feasible to implement with the highest impact on preventing or mitigating workplace violence to EMS providers. The publication provides the results of a SWOT analysis conducted by study participants, which illuminates considerations and barriers that will likely be encountered when implementing the policies, and suggested actions to overcome implementation challenges.

Fire and rescue departments are encouraged to incorporate the SAVER Model Policies into their current policy manuals and to develop their own standard operating procedures and guidelines to support each policy. The Model Policies are a companion to FIRST’s SAVER Systems-level Checklist, published in 2019. While adopting the Model Policies should be the first step, departments may also consult the full SAVER Systems-level Checklist for additional policy considerations.

The Model Policies are the culmination of several years of research and input from a national representation of fire and EMS leadership, first responders, dispatchers, and labor union representatives. They were developed with funding support from the Federal Emergency Management Agency’s Assistance to Firefighters (AFG) Fire Prevention and Safety Research and Development grant program.

Next steps for FIRST’s SAVER program are to evaluate the impact of these policies on violence and on the mental health outcomes of those they were designed to protect.

To learn more about the background, methods, and stakeholders involved in this research, see the SAVER Model Policies and SAVER Systems-level Checklist. For more information on FIRST’s research and its workplace violence portfolio, see FIRST’s SAVER page, its publications, and its Fact Sheet.

(Sources: NIOSH, FIRST)

Highlights

FIRST develops model policies to protect fire-based EMS providers from workplace violence

CISA’s SAFECOM publishes “First 48” cyber incident response guidance for public safety

NVFC, IAFC, and ISFSI release a new operational training guide for firefighters, virtual workshop Dec. 6

Webinar: Drones as first responders – how public safety can leverage drones for any type of incident

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

CISA’s SAFECOM publishes “First 48” guidance on cyber incident response for public safety

Public safety communications are at risk from a multitude of cyber threats and vulnerabilities. Due to the urgent nature of the operations, public safety communications are high-value targets for cyber threat actors. To set expectations of cyber incident response and to develop a culture of cyber readiness, the Cybersecurity and Infrastructure Security Agency’s (CISA’s) SAFECOM has published “First 48”: What to Expect When a Cyber Incident Occurs.

As responses to specific incidents vary greatly, the “First 48” provides foundational guidance on cyber incident response expectations.

Based on a series of conversations with public safety officials who have experienced cyber incidents, the document presents common themes, insights, and best practices in the order in which a cyber incident unfolds: within the first 8 hours, the first day, and two days and beyond. Expectations, indicators of suspicious activities, and examples of essential actions for incident response are presented throughout this 8-page document.

The document appendices link to additional public safety cyber resources as the interviewees stressed the importance of planning for and preparing against cyber incidents and vulnerabilities.

The public safety community is encouraged to holistically review their operational posture to ensure that they remain resilient in instances of other human-caused or natural disruptions.

“First 48” is available to download from SAFECOM’s Technology Resources page. Visit CISA’s Communications and Cyber Resiliency Toolkit for additional public safety communications and cybersecurity resources.

For questions about the “First 48”: What to Expect When a Cyber Incident Occurs, please contact SAFECOMGovernance@cisa.dhs.gov.

(Source: CISA)

NVFC, IAFC, and ISFSI release a new operational training guide for firefighters, virtual workshop Dec. 6

The National Volunteer Fire Council (NVFC), International Association of Fire Chiefs’ (IAFC’s) Volunteer and Combination Officers Section (VCOS), and the International Society of Fire Service Instructors (ISFSI) joined together to release a new operational training guide for firefighters. Training Volunteer Firefighters to Be Combat Ready is designed to help fire departments develop a training program that meets the needs of the community and the individual firefighter with safety and relevancy at the forefront.

Training can be a constant challenge for volunteer and combination departments. It requires planning, commitment, and time to make sure it is done correctly. Recognizing the need for guidance on this topic, the NVFC released a training white paper in 2012. The new guide is an update and expansion of that initial document, incorporating key considerations and specific best practices to form a blueprint for a successful training program.

The new guide contains 10 sections that cover the following topic areas:

• Training delivery and engagement methods.
• Surviving the job.
• Why training is important.
• Roles of the training officer, instructor, and student.
• Planning training.
• Training policies and procedures.
• Assessing firefighters’ capabilities.
• NFPA standards and OSHA regulations.
• Developing and implementing training best practices.
• First due recommended firefighter performance criteria.

In addition to the core subject areas, seven appendices provide additional resources, insights, and sample documents that departments can use when developing or enhancing their training program.

The IAFC will host a virtual workshop on Tuesday, Dec. 6, from 6 – 7:30 p.m. EST to discuss some of the training topics covered in the new publication. The workshop will cover scheduling, personnel assessment, and determining what to train your firefighters on based upon risk.

Learn more and download Training Volunteer Firefighters to Be Combat Ready from the NVFC’s website or IAFC’s website. Register for the webinar on IAFC’s website.

(Sources: NVFC, IAFC, ISFSI)

Webinar: Drones as first responders – how public safety can leverage drones for any type of incident

In public safety, every second counts. Would it be beneficial for a fire department responding to an alarm for a big box store to have size up before arriving, so additional alarms could be called before arriving on the scene? Similarly, would law enforcement benefit from a size up before arrival, to better anticipate the dynamics of a crowded, potentially violent scene?

Drones can be used as “first responders” to help emergency responders gain situational awareness before arriving on scene. Drone as a First Responder (DFR) programs are starting to make their way across the United States. Chula Vista Police Department (CVPD) in Southern California was the first to start one of these programs in 2018. CVPD provides more information and a short video on its DFR program on its website.

The International Public Safety Association (IPSA) is hosting a webinar on Wednesday, Dec. 14, 2022, from 12 – 1 p.m. EST entitled DFR: How public safety can leverage drones for any type of incident.

This webinar will cover the following learning objectives:

• Discuss the number of calls answered using the Drone as a First Responder program.
• Discuss case studies on how these drones are being used and who used them.
• Discuss how other departments can take advantage of the technology.

To attend this webinar, visit IPSA’s registration page. For more free upcoming webinars from IPSA, visit IPSA’s website.

(Source: IPSA)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

United States and Spain announce the development of a new capacity building tool to combat ransomware

CISA, in partnership with the U.S. Department of State and the Spanish Ministry of the Interior, announced a joint project last week to develop a capacity-building tool to help countries utilize public-private partnerships (PPPs) to combat ransomware. This project was developed as part of the Second International Counter Ransomware Initiative (CRI) Summit, which was convened in Washington, D.C. The CRI is a global coalition of 36 partner nations and the European Union dedicated to confronting the scourge of ransomware.

The CRI’s Public-Private Partnership (P3) Working Group, chaired by Spain, has focused on the essential need for close collaboration between governments and the private sector to address the challenges posed by ransomware. This tool will provide much needed guidance to nations around the world seeking to develop or deepen such public-private partnerships.

When completed, the tool will feature a series of case studies of PPPs that have been used in the counter-ransomware fight, including those pioneered by members of the CRI P3 Working Group. The tool will highlight the features that made these efforts successful and will be designed to provide practical guidance to countries looking to implement their own PPPs as part of their national counter-ransomware efforts.

(Source: CISA)

CISA and FBI release advisory on Iranian government-sponsored APT actors compromising federal network

On Nov. 16, CISA and the Federal Bureau of Investigation (FBI) published a joint Cybersecurity Advisory (CSA), Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester. The CSA provides information on an incident at a Federal Civilian Executive Branch (FCEB) organization in which Iranian government-sponsored APT actors exploited a Log4Shell vulnerability in unpatched VMware Horizon server.

The CSA includes a malware analysis report (MAR), MAR-10387061-1-v1 XMRig Cryptocurrency Mining Software, on the mining software that the APT actors used against the compromised FCEB network. The CSA also provides tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) obtained from the incident response as well as recommended mitigations.

For additional information on malicious Iranian government-sponsored cyber activity, see CISA’s Iran Cyber Threat Overview and Advisories webpage and FBI’s Iran Threats webpage.

(Source: CISA)

CISA releases Stakeholder-Specific Vulnerability Categorization methodology to prioritize vulnerabilities

On Nov. 10, CISA published its guide on Stakeholder-Specific Vulnerability Categorization (SSVC), a vulnerability management methodology that assesses vulnerabilities and prioritizes remediation efforts based on exploitation status, impacts to safety, and prevalence of the affected product in a singular system. As stated in CISA’s Executive Assistant Director’s recent blog, Transforming the Vulnerability Management Landscape, implementing a methodology such as SSVC is a critical step to advancing the vulnerability management ecosystem. CISA encourages organizations to use the resources on the SSVC webpage to strengthen their vulnerability management processes.

(Source: CISA)

Man charged for participation in LockBit global ransomware campaign

A criminal complaint filed in the District of New Jersey was unsealed on Nov. 10, charging a dual Russian and Canadian national for his alleged participation in the LockBit global ransomware campaign.

LockBit is a ransomware variant that first appeared in or around January 2020. It has become one of the most active and destructive ransomware variants in the world. Since first appearing, LockBit has been deployed against at least as many as 1,000 victims in the United States and around the world. LockBit members have made at least $100 million in ransom demands and have extracted tens of millions of dollars in actual ransom payments from their victims. The FBI has been investigating the LockBit conspiracy since in or around March 2020.

The case is being investigated by the FBI Newark Field Office, Newark Cyber Crimes Task Force, with assistance from the FBI Atlanta Field Office, the FBI Pittsburgh Field Office, the FBI Miami Field Office, the FBI’s Legal Attaché-Ottawa, the Jersey City Police Department, the New Jersey State Police, and the New Jersey Office of Homeland Security and Preparedness. The Justice Department’s Office of International Affairs has also provided valuable assistance.

The charges and allegations contained in the complaint are merely accusations, and the defendant is presumed innocent unless and until proven guilty.

(Source: Department of Justice)

Report: K-12 organizations concerned about security budget, threats

The Multi-State Information Sharing and Analysis Center (MS-ISAC) is uniquely positioned to view both the cybersecurity preparedness and the cybersecurity threats facing U.S. state, local, tribal, and territorial (SLTT) government organizations. MS-ISAC is an official partner of the Nationwide Cybersecurity Review (NCSR), which provides a broad picture of cybersecurity maturity across various SLTT communities. MS-ISAC also maintains the largest threat database specific to SLTT government organizations. It consists of more than 200 sources of threat intelligence, including real-time threat indicators provided by MS-ISAC’s no-cost cybersecurity services.

MS-ISAC decided to take a closer look at the K-12 sector as a whole and published its findings in the MS-ISAC K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year.

Read MS-ISAC’s blog for an overview of the report’s findings.

(Source: Center for Internet Security)

States must work closer with locals on cyber threats, survey finds

State chief information security officers should focus on building relationships with local governments and other institutions to bolster cybersecurity and ward off threats, according to a new report.

By doing so, the biennial report from the National Association of State Chief Information Officers and Deloitte says, states can fortify resilience more broadly, especially as local governments are a major threat vector. It also argues for greater collaboration with academic institutions at all levels.

(Source: Route Fifty)

Note: The InfoGram will not be published on Thursday, Nov. 24 due to the federal holiday. The next issue will be on Thursday, Dec. 1.

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.