View as a webpage / Share

Volume 22 — Issue 48 | December 8, 2022

NVFC launches First Responder Helpline, webinar Dec. 14

The National Volunteer Fire Council (NVFC) recently launched a new 24/7 First Responder Helpline to support first responders and their families with immediate assistance in crisis. The Helpline will also assist with confidential counseling, resources and referrals for stress management, family conflict, grief or loss, and more. 

While many companies offer employee assistance programs to deal with work-life issues, such services are usually not available for volunteer firefighters and emergency medical services (EMS) providers. The NVFC First Responder Helpline is intended to fill this service gap. Through a partnership between NVFC and Provident, the Helpline is now available to all NVFC members and their household family members.

While an NVFC membership is required to access the Helpline, the cost of NVFC membership is a small fee which can be waived when needed by completing NVFC’s Complimentary Membership request form. 

NVFC’s announcement of the launch notes that this new Helpline replaces the old Fire/EMS Helpline (1-888-731-FIRE). Departments that are still displaying the old Fire/EMS Helpline information and number should remove those materials as that line has been discontinued.

The new Helpline information can be shared with colleagues using the NVFC First Responder Helpline Brochure.

The NVFC is offering a webinar on Wednesday, Dec. 14 at 2 p.m. EST to provide information about the new First Responder Helpline and answer any questions. Advanced registration is required to attend. If you want to submit questions in advance of the webinar, please do so via the NVFC’s webinar question form.

(Source: NVFC)

Highlights

NVFC launches First Responder Helpline, webinar Dec. 14

FCC proposes rules to strengthen the security of the Emergency Alert System and Wireless Emergency Alerts

Considerations for Establishing Agreements for Next Generation 911

All Hazards Consortium hosts National Resilience Exchange Virtual Summit on Jan. 24-26, 2023

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

FCC proposes rules to strengthen the security of the Emergency Alert System and Wireless Emergency Alerts

The Federal Communications Commission (FCC) has published a Notice of Proposed Rulemaking (NPRM) in the Federal Register on Protecting the Nation’s Communications Systems from Cybersecurity Threats. The proposed rule aims to strengthen the cybersecurity and operational readiness of the nation’s Emergency Alert System (EAS) and Wireless Emergency Alerts (WEAs), two major components of the nation’s public warning system.

In the NPRM, the FCC cites the outcome of the last nationwide test of the EAS in August 2021 as a reason for the need to strengthening the security of the nation’s public warning system communications infrastructure.

According to data collected by the FCC’s Public Safety and Homeland Security Bureau (PSHSB) during the 2021 nationwide EAS test, more than 5,000 EAS Participants were using outdated software or using equipment that no longer supported regular software updates. The test also revealed that a large number of EAS Participants were unable to participate in testing due to equipment failure, despite receiving advanced notice that the test was going to be conducted.

While participation as a provider of emergency alerts is voluntary, the FCC’s proposed rule would impact all EAS Participants and Commercial Mobile Service (CMS) Providers who have chosen to participate. EAS Participants include radio and television broadcasters, cable systems, satellite radio and television providers, and wireline video providers. Wireless Emergency Alerts (WEAs) are broadcast primarily using the nation’s wireless cellular networks. The FCC refers to cell phone carriers and other members of the United States wireless industry who participate in WEAs as “CMS Providers.”

The rule would require all EAS Participants and CMS Providers to:

• Develop a cybersecurity risk management plan and annually certify to having this plan in place.
• Employ sufficient security measures to ensure the confidentiality, integrity, and availability of their alerting systems.

The rule would require all EAS participants to report any incident of unauthorized access of their EAS equipment, communications systems, or services within 72 hours, regardless of whether the compromise resulted in transmission of a false alert. These incidents would be reported in the FCC’s Network Outage Reporting System (NORS). This reporting requirement is significant since it would likely require ongoing monitoring not only of EAS equipment but also any network infrastructure connected to the EAS equipment.

The rule would also require CMS Providers to ensure that alerts are displayed on consumers’ mobile devices only if they come from valid base stations (cell towers). This would prevent spoofing of base stations so that messages cannot be maliciously intercepted or rerouted.

Comments on the proposed rule are due by Dec. 23, 2022, and reply comments are due by Jan. 23, 2023. If you wish to submit comments on this proposed rule, you may do so using the FCC’s Electronic Comment Filing System.

(Sources: FCC, Federal Register)

Considerations for Establishing Agreements for Next Generation 911

Across the nation, Emergency Communications Centers (ECCs) and Public Safety Answering Points (PSAPs) are transitioning their 911 systems to digital or Internet Protocol (IP)-based systems, known as Next Generation 911 (NG911). NG911 systems allow voice and data-rich information to be shared between and among the public, 911, and first responders.

As ECCs and PSAPs transition to NG911, collaboration between agencies is critical. As more agencies upgrade to NG911, they will need to establish agreements with one another to interconnect these new NG911 systems and ensure interoperability.

To assist federal, state, local, tribal, and territorial (FSLTT) agencies with this aspect of the transition to NG911, the Emergency Communications Preparedness Center developed a guidance document: Considerations for Establishing Agreements for NG911.

This document outlines considerations for establishing memorandums of understanding/agreements (MOU/As) between FSLTT agencies for interconnecting NG911 systems. It provides explanations and sample language for components of MOU/As, such as defining roles and responsibilities, resources and services, and technical requirements.

The document is divided into four sections, each addressing areas to consider when establishing an MOU/A:

• Governance. This section establishes the processes for maintaining the agreement.
• Technical System Details. This section covers technical requirements to address when interconnecting NG911 systems, such as geographic information system (GIS) capabilities for location accuracy, call routing, and delivery of 911 calls to ECCs/PSAPs.
• Operational. Operational considerations include equipment redundancy, technology upgrades, and continuity of communications.
• Financial Obligations. There are considerations involving the costs associated with the NG911 migration, such as what resources are reimbursable and how costs for any goods, services, or personnel will be shared among agencies.

The Emergency Communications Preparedness Center (ECPC) is a federal interagency focal point for interoperable and operable communications coordination within the Cybersecurity and Infrastructure Security Agency (CISA). The ECPC is comprised of 14 federal departments and agencies: U.S. Departments of Agriculture, Commerce, Defense, Energy, Health and Human Services, Homeland Security, the Interior, Justice, Labor, State, Transportation, and the Treasury, as well as the Federal Communications Commission and the General Services Administration.

Learn more and access the new guidance document, “Considerations for Establishing Agreements for NG911” on CISA’s website.

(Source: CISA)

All Hazards Consortium hosts National Resilience Exchange Virtual Summit on Jan. 24-26, 2023

The All Hazards Consortium (AHC), a non-profit focused on facilitating government-industry partnerships to support disaster preparedness, response and recovery efforts, will be hosting its third annual Resilience Exchange Virtual Summit, ResilienceEXCH 2023, on Jan. 24-26, 2023. The Summit will be held over Zoom in three half-day sessions, from 12:30 p.m. to 6:00 p.m. EST each day.

The Summit will focus on resilience issues in industry and government and strategies to address them.

During each half-day session, several hundred participants will learn, network, and collaborate with private sector critical infrastructure partners, state and local emergency managers, representatives from the Department of Homeland Security (DHS), the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Emergency Management Agency (FEMA), the Federal Motor Carrier Safety Administration (FMCSA), trade associations, academia, industry, and research groups.

Some highlighted topics on the agenda include:

• Resiliency before, during and after civil unrest.
• Extreme weather: critical infrastructure and synchronous, real-time data-informed decision-making.
• Supply chain and cross-sector interdependencies.
• State operational perspectives on regional resiliency.
• Women in crisis management and consequence management.

The Summit is free to attend for full-time government employees. Visit AHC’s ResilienceEXCH 2023 website for a full agenda, lists of speakers and sponsors, and the online registration form.

(Source: AHC)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

#StopRansomware: Cuba Ransomware

On Dec. 1, the Federal Bureau of Investigation (FBI) and CISA released a joint Cybersecurity Advisory (CSA) #StopRansomware: Cuba Ransomware to provide network defenders tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with Cuba ransomware. FBI investigations identified these TTPs and IOCs as recently as August 2022. This CSA updates the December 2021 FBI Flash: Indicators of Compromise Associated with Cuba Ransomware. FBI and CISA encourage network defenders to review the joint CSA and to apply the included mitigations. See StopRansomware.gov for additional guidance on ransomware protection, detection, and response.

(Source: CISA)

Cyber Safety Review Board to conduct second review on Lapsus$

On Dec. 2, the Department of Homeland Security (DHS) announced that the Cyber Safety Review Board (CSRB) will review the recent attacks associated with Lapsus$, a global extortion-focused hacker group. Lapsus$ has reportedly employed techniques to bypass a range of commonly used security controls and has successfully infiltrated a number of companies across industries and geographic areas. The CSRB will develop actionable recommendations for how organizations can protect themselves, their customers, and their employees in the face of these types of attacks. Once concluded, the report will be transmitted to President Biden through Secretary of Homeland Security Alejandro N. Mayorkas and CISA Director Jen Easterly.

The CSRB’s first review focused on vulnerabilities discovered in late 2021 in the widely used Log4j open-source software library. The CSRB was established as a mandate in the President’s Executive Order, Improving the Nation’s Cybersecurity, to drive a thoughtful approach to learn from cyber incidents. For more information, visit CISA.gov/CSRB. 

(Source: DHS)

HC3 Analyst Note: Royal Ransomware

Royal is a human-operated ransomware that was first observed in 2022 and has increased in appearance. It has demanded ransoms up to millions of dollars. Since its appearance, HC3 is aware of attacks against the Healthcare and Public Healthcare (HPH) sector. Due to the historical nature of ransomware victimizing the healthcare community, Royal should be considered a threat to the HPH sector.

Royal ransomware was first observed in September 2022. Royal is an operation that appears to consist of experienced actors from other groups, as there have been observed elements from previous ransomware operations. While most of the known ransomware operators have performed Ransomware-as-a-Service, Royal appears to be a private group without any affiliates while maintaining financial motivation as their goal. The group does claim to steal data for double-extortion attacks, where they will also exfiltrate sensitive data.

Read the full Analyst Note from the Department of Health and Human Services (HHS) Health Sector Cybersecurity Coordination Center (HC3).

(Source: HHS HC3)

Hackers linked to Chinese government stole millions in Covid benefits, Secret Service says

Hackers linked to the Chinese government stole at least $20 million in U.S. Covid relief benefits, including Small Business Administration loans and unemployment insurance funds in over a dozen states, according to the Secret Service.

The theft of taxpayer funds by the Chengdu-based hacking group known as APT41 is the first instance of pandemic fraud tied to foreign, state-sponsored cybercriminals that the U.S. government has acknowledged publicly.

By the time Covid relief funds appeared as a target of opportunity in 2020, APT41, which emerged more than a decade ago, had already become the “workhorse” of cyberespionage operations that benefit the Chinese government, according to cyber experts and current and former officials from multiple agencies.

The Covid fraud scheme that the Secret Service has publicly linked to APT41 began in mid-2020 and spanned 2,000 accounts associated with more than 40,000 financial transactions. The Secret Service said that as of August it had seized more than $1.4 billion in fraudulently obtained Covid relief funds and helped return about $2.3 billion to state unemployment insurance programs. The agency said it has been able to recover about half of the stolen $20 million in the APT41 case.

(Source: NBC News)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.