View as a webpage / Share

Volume 22 — Issue 47 | December 1, 2022

Infection prevention and control for the EMS and 911 workforce

The COVID-19 pandemic has highlighted the importance of infection prevention and control practices within the emergency medical services (EMS) and 911 workforce.

During the COVID-19 pandemic, many 911 call centers were short-staffed and had to adapt quickly to ensure personnel safety and continuity of operations. For instance, some adapted by deploying home-based 911 services, so that 911 telecommunicators could take calls while isolated in their own homes.

EMS providers face even more exposure to infectious diseases than other frontline workers. Recent research has shown that EMS providers have a higher risk of hospitalization or death from SARS-CoV-2 than firefighters whose roles were not primarily related to medical care.

A new report from the Agency for Healthcare Research and Quality (AHRQ), Infection Prevention and Control for the Emergency Medical Services and 911 Workforce, summarizes current evidence on exposures to infectious pathogens in the emergency medical services (EMS) and 911 workforce.

The report makes evidence-based recommendations to address infection prevention and control, such as wearing gloves to prevent needlestick exposures and practicing regular hand hygiene to prevent the spread of methicillin-resistant Staphylococcus aureus (MRSA).

The report also highlights areas where more research is needed. For example, the report notes that research on the field effectiveness of N95 respirators and surgical face masks as personal protective equipment (PPE) is limited, especially in the arena of airborne diseases.

The report makes a call to strengthen research into EMS and 911 infectious disease issues and recommends establishing a national research agenda that includes improving data uniformity, use of appropriate comparison groups, and comparable outcome measures.

This report was developed to support the AHRQ’s Effective Health Care Program by one of the AHRQ’s Evidence-based Practice Centers (EPCs) located at Johns Hopkins University. It is part of a research project that began in 2021 on Emergency Medical Service/911 Workforce Infection Control and Prevention Issues.

This project is supported by the National Highway Traffic Safety Administration’s (NHTSA’s) Office of EMS, which strives to reduce death and disability by providing leadership and coordination to the EMS community in assessing, planning, developing, and promoting comprehensive, evidence-based EMS and 911 systems.

EMS agencies are encouraged to inform their communities about the new report by sharing on social media. The NHTSA’s Office of EMS has compiled customizable social posts [Microsoft Word, 3 MB] that can be used to share this report and highlight the report’s findings.

(Source: AHRQ)

Highlights

Infection prevention and control for the EMS and 911 workforce

New NTAS Bulletin summarizes the continued heightened threat environment across the US

NASEMSO seeks input on a national project on collaboration between EMS, 911, emergency management, and public health

CISA Webinar: Tribal Emergency Communications Program Overview

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

New NTAS Bulletin summarizes the continued heightened threat environment across the US

The Department of Homeland Security (DHS) issued a National Terrorism Advisory System (NTAS) Bulletin on Nov. 30 regarding the continued heightened threat environment across the United States.

This Bulletin replaces the June 7, 2022, NTAS Bulletin that was set to expire on Nov. 30, 2022.

This latest NTAS Bulletin focuses on lone offenders and small groups motivated by a range of ideological beliefs or personal grievances. These individuals and groups pose a persistent and lethal threat to the homeland.

The Bulletin highlights several upcoming events that could be exploited by threat actors to justify or commit acts of violence, including:

• Certifications related to the midterm elections.
• The holiday season and associated large gatherings.
• The marking of two years since the Jan. 6, 2021, attack on the U.S. Capitol.

Targets for attacks could include public gatherings, faith-based institutions, the LGBTQI+ community, schools, racial and religious minorities, government facilities and personnel, U.S. critical infrastructure, the media, and perceived ideological opponents.

The Bulletin references several recent attacks, including the late November shooting at an LGBTQI+ bar in Colorado Springs, Colorado, which remains under investigation, and an early November 2022 incident where an individual was arrested for sharing a manifesto online that threatened attacks on synagogues.

Targeted violence against law enforcement remains a threat. The Bulletin highlights the August 2022 incident at the Cincinnati Field Office of the Federal Bureau of Investigation (FBI), where an individual attempted to forcibly enter the office with a  firearm and a nail gun, after making calls to others in the days preceding the incident to kill federal law enforcement.

In 2011, DHS replaced the color-coded alerts of the Homeland Security Advisory System (HSAS) with the NTAS and now issues two types of advisories: Bulletins and Alerts. While NTAS Alerts are intended to communicate specific, credible information about a terrorist threat against the United States, NTAS Bulletins are intended to communicate current developments or general trends regarding threats of terrorism.

In addition to providing an overview of several recent attacks, plots, and threats of violence, the latest Bulletin outlines the many programs and resources at DHS helping to combat threats from terrorism and violent extremism in the U.S. It encourages everyone to report potential threats to local law enforcement, your local FBI Office, or your local fusion center. DHS’ Nationwide Suspicious Activity Reporting (SAR) Initiative offers free online SAR training for fire and EMS personnel, law enforcement, public health and healthcare partners, emergency managers and public safety telecommunicators.

(Source: DHS)

NASEMSO seeks input on a national project on collaboration between EMS, 911, emergency management, and public health

Response to the COVID-19 pandemic spurred new collaborative processes across four separate disciplines: public health, emergency communications, emergency management and emergency medical services (EMS). The National Association of State EMS Officials (NASEMSO) is leading a project to develop Model Guidelines for adoption within states’ systems which support collaboration between these disciplines.

As a first step in this project, NASEMSO is conducting a survey to gather more information on best practices and ideas for collaboration. NASEMSO is particularly interested in solutions which were:

• Implemented at a statewide level.
• Supported the collaborative work of two or more of the four disciplines.

The project’s Technical Expert Panel identified the following domains relevant to the management of large, enduring events like the COVID-19 pandemic. These domains were identified as being common throughout all states and all four of the disciplines:

• General coordination and communication.
• Planning and preparedness.
• Finance and funding.
• Legal protections and liability.
• Syndromic surveillance.
• Situational infrastructure monitoring and awareness.
• Healthcare support and integration.
• 911 caller triage and communications management.
• Statutes, regulation and policy.
• Equity.
• Workforce.
• Evaluation and lessons learned.

The survey instrument is structured around these 12 domains. For each domain, the survey presents a few thought-provoking examples of challenges experienced during the COVID-19 pandemic and the kinds of solutions that may have been developed to address these challenges. The survey requests information in the form of hyperlinks or files documenting solutions developed by agencies in the four disciplines.

NASEMSO acknowledges that additional domains other than the 12 identified in the survey may exist or that some practices and tactics may not fall precisely within a listed domain. The survey instrument provides an opportunity to provide additional information that does not fit into the 12 domains.

If you are a state, local, tribal, territorial, or private sector agency within a public health, emergency communications, emergency management, or EMS discipline, and you would like to contribute to this project, please complete NASEMSO’s survey.

(Sources: NASEMSO, IAEM)

CISA Webinar: Tribal Emergency Communications Program Overview

Today’s complex communications environment poses many challenges to the public safety community, but especially to tribes who have unique infrastructure needs and requirements. To meet these challenges, the Cybersecurity and Infrastructure Security Agency (CISA) established programs, resources, and tools that are available to assist the public safety community as a whole with assessing, enhancing, and utilizing communications technology.

CISA’s Tribal Emergency Communications Program serves as a clearinghouse to help tribes access the technical expertise, services, resources, and tools that can help them strengthen their communications systems, serve their communities, and maintain tribal sovereignty.

CISA is offering a webinar to brief the Emergency Services Sector (ESS) on its Tribal Emergency Communications Program on Wednesday, Dec. 7, 2022, at 1 p.m. EST.

The target audience for this webinar is homeland security, public safety, emergency management, and emergency response personnel. During this briefing, participants will learn about technical service offerings, programs, and resources available to tribes and how to access them to support and enhance public safety communications.

This webinar is part of CISA’s ESS Resilience Development Webinar Series (ESS-RDWS), a quarterly series facilitated by CISA’s Emergency Services Sector Management Team focusing on topics of interest to ESS stakeholders.

The webinar series supports CISA’s ESS Resilience Development Project (ESS-RDP). The ESS-RDP is a suite of resources and best practices that are specifically tailored to meet the unique resilience needs of the first responder community. The program coordinates a unified effort to assist in critical infrastructure resilience and continuity of operations for the Nation’s first responders so that responders’ ability to plan, mitigate, and respond is greater than locally and regionally calculated risks.

No advanced registration is required to attend this webinar. To participate, mark your calendar for Wednesday, Dec. 7, 2022, at 1 p.m. EST and visit CISA’s HSIN Connect Room for the webinar at the scheduled time using the following link: https://share.dhs.gov/tribalecp/. A HSIN account is not required for access to the HSIN Connect Room; participants may enter the room as a guest.

The event information can be shared with ESS colleagues using the webinar flyer.

For more information or to seek additional help, contact the Emergency Services Sector Management Team at EmergencyServicesSector@cisa.dhs.gov.

(Source: CISA)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA reminds online shoppers to stay vigilant to cyber threats this holiday season

CISA is committed to helping Americans stay safe online this holiday season.

The holiday shopping season is a prime opportunity for bad actors to take advantage of unsuspecting shoppers through fake websites, malicious links, and even fake charities. Their goal is simple: get your personal and financial information to compromise your data, deploy malicious software, steal your identity, and take your money. But with some simple actions, you can stay safe while you shop online.

Visit CISA.gov/shop-safely for more tips on how to have a safe and successful online shopping experience this holiday season.

In addition to this guidance for individuals, CISA and the FBI released guidance last year urging all organizations – especially critical infrastructure partners – to examine their current cybersecurity posture and implement best practices and mitigations to manage the risk posed by cyber threats during the holidays. CISA strongly encourages organizations to review this guidance and ensure they remain vigilant during this holiday season.

(Source: CISA)

CISA, NSA, and ODNI release guidance for customers on securing the software supply chain

On Nov. 17, CISA, the National Security Agency (NSA), and the Office of the Director of National Intelligence (ODNI), published the third of a three-part series on securing the software supply chain: Securing Software Supply Chain Series - Recommended Practices Guide for Customers. This publication follows the August 2022 release of guidance for developers and October 2022 release of guidance for suppliers.

This guidance, along with the accompanying fact sheet, provides recommended practices for software customers to ensure the integrity and security of software during the procuring and deployment phases.

This series complements other U.S. government efforts underway to help the software ecosystem secure the supply chain, such as the software bill of materials (SBOM) community.

CISA encourages all organizations that participate in the software supply chain to review the guidance. See CISA’s Information and Communications Technology (ICT) Supply Chain Risk Management Task Force, ICT Supply Chain Resource Library, and National Risk Management Center (NRMC) webpages for additional guidance.

(Source: CISA)

#StopRansomware: Hive

On Nov. 17, CISA, the FBI, and the Department of Health and Human Services (HHS) released joint Cybersecurity Advisory (CSA) #StopRansomware: Hive Ransomware to provide network defenders tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with Hive ransomware variants. FBI investigations identified these TTPs and IOCs as recently as November 2022.

Hive ransomware has targeted a wide range of businesses and critical infrastructure sectors, including Government Facilities, Communications, Critical Manufacturing, Information Technology, and—especially—Healthcare and Public Health (HPH).

CISA encourages network defenders to review the CSA and to apply the included mitigations. See StopRansomware.gov for additional guidance on ransomware protection, detection, and response.

(Source: CISA)

HC3: Analyst Note - Lorenz Ransomware

Lorenz is human-operated ransomware that has been in operation for approximately two years. In that time, HC3 is aware of the compromise of healthcare and public sector targets. It is used to target larger organizations in what is called “big-game hunting,” and publishes data publicly as part of pressuring victims in the extortion process. Lorenz is known to target organizations globally using customized code and can demand hundreds of thousands of dollars in ransoms.

Lorenz is human-operated ransomware, run by operators known to customize their executable code, tailoring it for their targets. This implies that they may maintain persistent access for reconnaissance purposes for some extended period of time prior to ransomware deployment. They often follow the pattern of initial access, followed by reconnaissance and lateral movement, ultimately seeking a Windows domain controller in search of administrator credentials.

Read the full Analyst Note from the Department of Health and Human Services (HHS) Health Sector Cybersecurity Coordination Center (HC3).

(Source: HHS HC3)

2021 Nationwide Cybersecurity Review: SLTTs struggle with supply chain, risk management

Cyberattacks targeting U.S. state, local, tribal, and territorial (SLTT) government organizations increased significantly in 2022. In a mid-year update to the 2022 SonicWall Cyber Threat Report, for instance, researchers found that ransomware affecting government organizations rose 1,885%, eclipsing the combined growth in attacks against healthcare (755%), education (152%), and retail (21%). It was a similar story with cryptojacking and malware.

These findings highlight the need for SLTTs to better understand their cybersecurity postures so that they can make meaningful improvements going into 2023. To get started, they can reference the findings of the 2021 Nationwide Cybersecurity Review.

The Nationwide Cybersecurity Review (NCSR) is an annual, no-cost, and anonymous self-assessment designed to measure the gaps and capabilities of SLTT governments’ cybersecurity programs. Participants can also use the NCSR to gauge their cybersecurity posture relative to their peers.

(Source: Center for Internet Security)

Defense Department launches zero trust, phasing out perimeter defense strategy

The Defense Department officially launched its zero trust strategy and road map on Nov. 22, part of a larger strategy to overhaul the way federal agencies combat sophisticated threat actors, including those from criminal organizations and rogue nation states.

The DOD will move away from a perimeter-based approach for IT systems defense to a system that essentially assumes the risk of breach during regular interactions and will act accordingly. The plan calls for the Pentagon’s full implementation of the strategy and road map by fiscal 2027.

Zero trust is an environment where a network is secured in a way that any person or device that interacts with those systems are considered a potential threat. They must be properly authenticated and allowed access to the information they need.

(Source: Cybersecurity Dive)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.