View as a webpage / Share

Volume 23 — Issue 7 | February 16, 2023

DHS S&T releases Technology Report on handheld standoff Raman spectrometer

The Department of Homeland Security (DHS) Science and Technology Directorate (S&T) recently published a Technology Report capturing the results of first responders’ operational assessments of the Pendar X10 Handheld Standoff Raman Spectrometer.

Handheld Raman spectrometers are used to provide direct sampling of loose solid or liquid material or to conduct sampling on a containerized sample. These devices are rugged, field-portable units that are designed to provide responders with the ability to analyze unknown powders and liquids without destroying the sample.

The spectrometer evaluated in this Technology Report has the capability to identify military, industrial, and homemade explosives; drugs; chemical warfare agents; toxic chemicals, related precursors and byproducts; and other organic or inorganic materials that might be encountered in a wide range of law enforcement and emergency response applications.

The assessment of Pendar X10 took place at DHS S&T’s 2022 Urban Operational Experimentation event (Urban OpEx 2022), which is administered by DHS S&T’s National Urban Security Technology Laboratory (NUSTL). During Urban OpEx 2022, first responder evaluators used X10 in an operational scenario to provide feedback on its features and functionality for urban first responder organizations. Evaluators experimented with X10 through a series of single and multiple chemical identifications.

Some key takeaways from the first responder evaluators’ assessments of this technology include:

• The X10's ability to scan unknown substances up to six feet away without causing an unintentional ignition was impressive.
• The X10 currently requires the end user to focus the X10 laser on an unidentified substance. One ease of use limitation for this type of technology is the need to auto-focus the laser to correctly identify certain chemicals, a process that currently has some challenges in executing rapidly and reliably.
• A more even weight distribution within the device would support responders’ ability to use the auto-focus feature and increase their maneuverability with the X10 when operating in HAZMAT personal protective equipment.

Read the full report on DHS S&T’s website to learn more about this kind of technology and how it meets responders’ capability needs, the experimental design used for this assessment, and the full set of findings from the first responder evaluators.

(Source: DHS S&T)

Highlights

DHS S&T releases Technology Report on handheld standoff Raman spectrometer

Wildland fire science learning opportunities with the U.S. Forest Service’s SCIENCEx Fire Week and Fire Lab Seminar Series

DHS releases FY 2023 Targeted Violence and Terrorism Prevention Grant Program application guidance

CISA webinar: 1993 bombing of the World Trade Center commemoration presentation

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

Wildland fire science learning opportunities with the U.S. Forest Service’s SCIENCEx Fire Week and Fire Lab Seminar Series

The U.S. Forest Service is offering several upcoming opportunities for learning and engagement about wildland fire management and various wildland fire science-related topics.

The U.S. Forest Service’s SCIENCEx webinar series brings together scientists and land management experts from across U.S. Forest Service research stations and beyond to explore the latest science and best practices for addressing large natural resource challenges across the country. An upcoming SCIENCEx Fire Week is scheduled for 2-3 p.m. EST each day for five consecutive days, running from Feb. 27 through March 3, 2023.

While the SCIENCEx webinar series covers a broad range of topics related to land and natural resource management, SCIENCEx Fire Week will focus exclusively on wildland fire topics, including fire history and fire ecology; fire weather and smoke; wildland fire behavior; fire modeling risks and trade-offs; and the outlook for future wildland fire behavior and risks across the United States. These webinars are recorded and archived for viewing on-demand. Visit the Forest Service’s SCIENCEx webinar page to learn more and register for these upcoming webinars.

The U.S. Forest Service’s Missoula Fire Sciences Laboratory hosts a Fire Lab Seminar Series. These are hour-long seminars presented by Fire Lab employees and other researchers from throughout the world with opportunities to ask questions at the end of every webinar. The series covers topics in management and research about the natural world from a broad range of disciplines, but most seminars have a wildland fire theme.

These seminars are offered every Thursday from 1-2 p.m. ET (11 a.m. – 12 p.m. MT) from October through May. Upcoming seminars in this series in February and March will cover:

• Transforming data into useful information for wildfire decision-making.
• Community-focused programs, datasets, and planning resources for wildfire risk mitigation.
• How an evidence-based approach to community-focused wildfire education programs can put people at the center of wildfire solutions.
• Slack and scarcity in wildfire management.

These webinars are recorded and posted for viewing on-demand. See the U.S. Forest Service’s Missoula Fire Sciences Laboratory Fire Lab Seminar Series page to learn more, register for any of these upcoming webinars, or view past webinars.

(Sources: U.S. Forest Service-Research and Development, U.S. Forest Service-Missoula Fire Sciences Laboratory)

DHS releases FY 2023 Targeted Violence and Terrorism Prevention Grant Program application guidance

American communities continue to be vulnerable to the threats of targeted violence and terrorism. These forms of violence impact our collective sense of security and freedom as Americans.

The Department of Homeland Security’s (DHS’s) Center for Prevention Programs and Partnerships (CP3) administers the Targeted Violence and Terrorism Prevention (TVTP) Grant Program to help communities address these threats.

The TVTP Grant Program provides financial assistance to eligible applicants to develop sustainable, multidisciplinary targeted violence and terrorism prevention capabilities in local communities, to pilot innovative prevention approaches, and to identify prevention best practices that can be replicated in communities across the country.

DHS CP3 released a forecasted funding opportunity for its fiscal year (FY) 2023 TVTP Grant Program last month.

To supplement the FY 2023 application guidance provided in the forecasted funding opportunity, CP3 has posted the successful grant applications for FY 2022 TVTP grants and summary descriptions and award amounts for FY 2022 projects. Additionally, CP3 held a series of webinars in late January 2023 for interested applicants. The recordings of these webinars will be posted soon.

These resources are intended to assist grant applicants in getting a head start on developing successful applications for FY 2023 TVTP grants and registering in the required systems before the application period opens later this year. The anticipated release of the Notice of Funding Opportunity (NOFO) is early March 2023, with an anticipated application due date of April 25, 2023, and an anticipated award announcement in September 2023. $20 million in funding is available.

Eligible applicants include U.S. state, local, tribal, and territorial government agencies, institutions of higher education, and nonprofits.

See DHS CP3’s TVTP Grants website to learn more about the TVTP Grant Program and access all application guidance documents for FY 2023. Please contact the CP3 grants team at TerrorismPrevention@hq.dhs.gov with any questions.

(Source: DHS)

CISA webinar: 1993 bombing of the World Trade Center commemoration presentation

On the afternoon of February 26, 1993, a group of Sunni violent extremists, including some that trained in al-Qaida camps on the Afghanistan-Pakistan border, detonated a Vehicle Borne Improvised Explosive Device (VBIED) in the parking garage of the World Trade Center (WTC) in New York City, New York. The VBIED included over 1,000 pounds of urea-nitrate explosives, homemade dynamite, and hydrogen gas cylinders. The blast damaged seven levels of the North Tower, killed 6 people, injured over 1,000, and caused approximately $500 million in structural damage.

This incident is a reminder of the importance of securing explosive precursor chemicals and the need for awareness and preparation.

In memory of this tragic event, the Cybersecurity and Infrastructure Security Agency’s (CISA’s) Office for Bombing Prevention and the CISA Chemical Security Office is offering a webinar on Monday, Feb. 27, 2023, at 1 p.m. EST.

The webinar will discuss the 30-year commemoration of the WTC bombing. A case study of the bombing will be presented that describes the attack, followed by a discussion of bombing prevention training, tools and resources intended to prevent future loss of life and critical infrastructure.

This webinar is part of CISA’s Emergency Services Sector Resilience Development Webinar Series (ESS - RDWS), a quarterly webinar series facilitated by CISA’s Emergency Services Sector Management Team that focuses on topics of interest to ESS stakeholders.

The target audience for this webinar series is homeland security, public safety, emergency management, and emergency response personnel.

No advanced registration is required to join this webinar. Save the date and go to CISA’s Homeland Security Information Network (HSIN) Connect Room for this webinar at the scheduled time to join: https://share.dhs.gov/essandobpwtc/. A HSIN account is not required to join; participants may enter the room as a guest.

For more information or to seek additional help, contact the Emergency Services Sector Management Team at EmergencyServicesSector@cisa.dhs.gov.

(Source: CISA)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

#StopRansomware - Ransomware attacks on critical infrastructure fund DPRK espionage activities

CISA, the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), the Department of Health and Human Services (HHS), and Republic of Korea’s Defense Security Agency and National Intelligence Service have released a joint Cybersecurity Advisory (CSA), Ransomware Attacks on Critical Infrastructure Fund DPRK Espionage Activities, to provide information on ransomware activity used by North Korean state-sponsored cyber to target various critical infrastructure sectors, especially Healthcare and Public Health (HPH) Sector organizations. The authoring agencies urge network defenders to examine their current cybersecurity posture and apply the recommended mitigations in this joint CSA.

(Source: CISA)

HC3 Threat Brief: 2022 healthcare cybersecurity year in review, and a 2023 look-ahead

This Threat Brief from the Department of Health and Human Services (HHS) Health Sector Cybersecurity Coordination Center (HC3) reviews events impacting healthcare and public health (HPH) cybersecurity in 2022 and considers implications for HPH organizations today and into the future.

The presentation begins with an overview of types of cyberattacks in recent years; changes in technology and threat actors and their impact on HPH security; how geopolitical events impact healthcare cybersecurity; and what the U.S. government and allied countries are doing about these threats.

The presentation then provides a comprehensive review of the current cyber threat environment, with a focus on cyber threats that continue to significantly impact HPH cybersecurity. This section covers specific threats and vulnerabilities such as the Conti ransomware gang, Black Basta ransomware, Emotet, the Log4J vulnerability, as well as trends in data breach incidents. It also covers the most recent cybersecurity-related legislative changes and federal guidance.

The last section provides mitigation guidance from the FBI and CISA.

(Source: HHS HC3)

Cyber insurance price increases highlight ransomware defense

In 2020, the  Cyber Threat Intelligence (CTI) team at the Multi-State and Elections Infrastructure Information Sharing and Analysis Centers (MS-ISAC and EI-ISAC) released a report disclosing how the number of organizations seeking cyber insurance coverage grew significantly over the previous years. The spike in cyber insurance demand and increase in ransomware payments pushed insurance payouts above 70% of premiums, exceeding the break-even point.

Now roughly a year and a half since its initial report, the CTI team observes that the trend of decreasing cyber insurance affordability initially held up but shifted in early 2022. In its 2022 State of the Market report, Risk Strategies found that steep rate increases in cyber insurance began to stabilize largely due to organizations improving their cyber maturity, no doubt influenced in part by stricter policies from insurance underwriters. Beyond the impact of improved controls and insurer policies, recent open-source reporting indicates organizations are increasingly refusing to pay ransoms.

Despite the recent downturn in insurance rates, the CTI team assess evolving cybercriminal activity is likely to once again drive rates upward, albeit at a slower pace than pre-2022 levels, over the next two years.

Rising costs and uncertainty in assessing organizations' risk profiles may eventually lead the federal government to intervene. Regardless of whether government intervention follows, however, you can take this time to review your current policies and ensure that your defensive controls are sufficient to meet insurer requirements and stand up against increasingly sophisticated ransomware attacks.

Read the full article in the Center for Internet Security’s (CIS’) Cyber Threat Intelligence Blog.

(Source: CIS)

Critical infrastructure at risk from new vulnerabilities found in wireless IIoT devices

Israeli industrial cybersecurity company Otorio reported a set of 38 security vulnerabilities in wireless industrial internet of things (IIoT) devices from four different vendors that could pose a significant attack surface for threat actors looking to exploit operational technology (OT) environments.

The flaws, in a nutshell, offer a remote entry point for attack, enabling unauthenticated adversaries to gain a foothold and subsequently use it as leverage to spread to other hosts, thereby causing serious damage. Some of the identified shortcomings could be chained to give an external actor direct access to thousands of internal OT networks over the internet.

Of the 38 defects, three affect ETIC Telecom's Remote Access Server (RAS) – CVE-2022-3703, CVE-2022-41607, and CVE-2022-40981 – and could be abused to completely seize control of susceptible devices. Five other vulnerabilities concern InHand Networks InRouter 302 and InRouter 615 that, if exploited, could result in command injection, information disclosure, and code execution. Also identified are two weaknesses in Sierra Wireless AirLink Router (CVE-2022-46649 and CVE-2022-46650) that could allow a loss of sensitive information and remote code execution. The remaining flaws are still under responsible disclosure.

The findings underscore how OT networks could be put at risk by making IIoT devices directly accessible on the internet, effectively creating a "single point of failure" that can bypass all security protections.

Alternatively, local attackers can break into industrial Wi-Fi access points and cellular gateways by targeting on-site Wi-Fi or cellular channels, leading to adversary-in-the-middle (AitM) scenarios with major potential impact.

(Source: The Hacker News)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.