View as a webpage / Share

Volume 23 — Issue 11 | March 16, 2023

NWCG issues Safety Warning on non-specification fire shelters

Wildland firefighters must always have escape routes and safe zones so they are prepared to act quickly if a wildfire suddenly changes direction or speed. But if a firefighter becomes trapped by flames, their last resort may be to deploy a fire shelter.

A wildland fire shelter is a portable, rapidly deployable shelter that looks somewhat like an oversized sleeping bag. A wildland firefighter can jump into a fire shelter as a last resort for protection against radiant heat and smoke. As critical pieces of life-saving equipment, fire shelters must be built to strict specifications.

The National Wildfire Coordinating Group (NWCG), Equipment Technology Committee has just released a Safety Warning concerning fire shelters being sold on the open market that do not meet Forest Service (FS) specification 5100-606 requirements.

This discovery of non-specification fire shelters being sold on the open market was made by the Forest Service’s National Technology and Development Program (NTDP) on Feb. 22, 2023.

Safety concerns include:

• Shelters constructed with materials that do not meet the FS specification requirements have not been tested and may release hazardous toxicants to the shelter occupant.
• A visual inspection showed deviations from the specification that will result in the shelter not deploying as designed.

The Safety Warning recommends that any non-FedMall (open market) fire shelter purchases should be inspected to verify they are built to specification 5100-606. Any non-specification fire shelter should be removed from service and not carried on the fireline. In the event of an entrapment or burnover, serious injury or death could occur.

The Safety Warning contains detailed instructions and photos to guide firefighters on what to look for when inspecting their fire shelter to determine if it meets or does not meet the 5100-606 specification.

NTDP was informed of the non-specification fire shelters by a contractor who inspected their shelters upon delivery. The fire shelters identified in this Safety Warning are the only known non-specification fire shelters being sold on the open market, but that does not mean there may not be others. All fire shelters, regardless of supplier, should be inspected upon receipt to ensure that all shelter components are accounted for, the shelter meets specification requirements, and that no damage occurred during shipping or storage.

See the full Safety Warning 23-01: Non-Specification Fire Shelters on NWCG’s website.

(Source: NWCG)

Highlights

NWCG issues Safety Warning on non-specification fire shelters

SAFECOM and NCSWIC release white paper explaining land mobile radio “link layer security” features

FEMA will release major updates to National Risk Index in late March, webinar March 20

Webinar: CISA’s Power of Hello and De-escalation Program

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

SAFECOM and NCSWIC release white paper explaining land mobile radio “link layer security” features

SAFECOM and the National Council of Statewide Interoperability Coordinators (NCSWIC) recently released a white paper, Link Layer Authentication and Link Layer Encryption: Are You Really Secure?

The white paper explains these two security features – Link Layer Authentication (LLA) and Link Layer Encryption (LLE) – and their role in securing land mobile radios (LMRs) that adhere to the Project 25 (P25) Standards. The paper explains the impact of LLA and LLE on securing public safety communications and provides a case study demonstrating why these features should be used to provide additional LMR system safeguards.

Project 25 (P25) standards are used by manufacturers to ensure that their LMR equipment can interoperate with equipment produced by other manufacturers. Most P25 radio systems come with built-in safeguards, but the availability of software key generators and other attack vectors used by threat actors means that new P25 features are needed to maintain P25 communications security.

Over the past few years, Link Layer Security (LLS) features such as Link Layer Authentication (LLA) and Link Layer Encryption (LLE) have received increased attention from manufacturers and users looking to improve communications security.

• LLA ensures that only authorized radios with the appropriate radio unit identification (ID) and matching authentication keys can register on the P25 system.
• LLE is a feature that encrypts air interface messages on both trunked and conventional P25 systems. These messages contain important identity and signaling information related to user IDs, talkgroups, and supplementary data services.

While both LLA and LLE sound similar and improve P25 security, they serve different purposes and are in different stages of development and adoption. First included in the P25 Standards in 2005, LLA is available from most radio manufacturers and some infrastructure manufacturers. However, this function has seen limited adoption to date. LLE, on the other hand, is still under standards development and not available on any P25 systems today.

For questions about the LLA and LLE: Are You Really Secure?  whitepaper, please contact SAFECOMGovernance@cisa.dhs.gov or visit cisa.gov/safecom/p25 for additional P25 resources.

(Source: CISA)

FEMA will release major updates to National Risk Index in late March, webinar March 20

The National Risk Index shows the communities most at risk to 18 natural hazards. FEMA officially launched the National Risk Index in August 2021. Since then, it has become a key tool to helping communities better learn and reduce their risk. It can support mitigation planning, community preparedness and emergency management.

In late March, the Federal Emergency Management Agency (FEMA) will release major updates to the National Risk Index. Updates will include Census 2020 data and geographies, risk assessment for U.S. territories, Centers for Disease Control and Prevention (CDC) Social Vulnerability data, shifting all scores to percentiles, adding risk metrics for trend analyses and more.

FEMA is hosting a webinar before the release on March 20 at 12 p.m. EDT. The webinar will preview the updates and review any impacts to the data services. Registration is required on Zoom and login information will be emailed after you register. An open Question and Answer Session will follow the presentation.

This webinar is for those who use the National Risk Index data and reporting or have integrated the application’s data, GIS services or information into any tools or applications. This may include emergency managers, planners, GIS developers, community stakeholders, state, local and federal agencies, commercial organizations and more.

Register for the March 20 webinar via FEMA’s Zoom page for the event.

(Source: FEMA)

Webinar: CISA’s Power of Hello and De-escalation Program

CISA will host a webinar on its Power of Hello and De-escalation Program on Tuesday, April 11, 2023, at 1 p.m. EDT. 

CISA leads the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure. CISA provides access to a multitude of capabilities that can enhance security posture in a cost-effective and informed manner. To augment security beyond traditional protective measures, organizations can enable their security and non-security personnel to reduce risk through non-confrontational techniques.

This presentation will discuss CISA’s Power of Hello and De-escalation Program. These resources empower employees to identify suspicious activity, navigate the threat of potentially escalating behavior, and take measures to stabilize or de-escalate the encounter. The presentation will also discuss how to report the situation to an organization’s multi-disciplinary threat management team or directly to local law enforcement.  

This webinar is part of CISA’s Emergency Services Sector (ESS) Resilience Development Webinar Series, a quarterly webinar series facilitated by CISA’s Emergency Services Sector Management Team that focuses on topics of interest to ESS stakeholders. The target audience for this webinar series is homeland security, public safety, emergency management, and emergency response personnel.

No advanced registration is required to join this webinar. Save the date and go to CISA’s Homeland Security Information Network (HSIN) Connect Room for this webinar at the scheduled time to join: https://share.dhs.gov/powerofhello/. A HSIN account is not required to join; participants may enter the room as a guest.

For more information or to seek additional help, contact the Emergency Services Sector Management Team at EmergencyServicesSector@cisa.dhs.gov.

(Source: CISA)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA announces Ransomware Vulnerability Warning Pilot

On March 13, CISA announced the creation of the Ransomware Vulnerability Warning Pilot (RVWP), as authorized by the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022. Through the RVWP, CISA will determine vulnerabilities commonly associated with known ransomware exploitation and warn critical infrastructure entities of those vulnerabilities, enabling mitigation before a ransomware incident occurs.  

The RVWP will identify organizations with internet-accessible vulnerabilities commonly associated with known ransomware actors by using existing services, data sources, technologies, and authorities, including our free Cyber Hygiene Vulnerability Scanning service. CISA notifications will contain key information regarding the vulnerable system, such as the manufacturer and model of the device, the IP address in use, how CISA detected the vulnerability, and guidance on how the vulnerability should be mitigated.

For more information on RVWP and other available resources for ransomware protection, detection, and response, all organizations are encouraged to visit StopRansomware.gov, a whole-of-government approach for ransomware resources and alerts. Organizations interested in enrolling in CISA’s Cyber Hygiene Vulnerability Scanning can contact vulnerability@cisa.dhs.gov.

(Source: CISA)

Threat actors exploited Progress Telerik vulnerability in U.S. government IIS server

On March 15, CISA, the Federal Bureau of Investigation (FBI), and Multi-State Information Sharing and Analysis Center (MS-ISAC) released a joint Cybersecurity Advisory (CSA), Threat Actors Exploit Progress Telerik Vulnerability in U.S. Government IIS Server. This joint CSA provides IT infrastructure defenders with tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and methods to detect and protect against similar, successful CVE-2019-18935 exploitation.

As detailed in the advisory, CISA analysts determined that multiple cyber threat actors, including an Advanced Persistent Threat (APT) actor, exploited a .NET deserialization vulnerability in Progress Telerik user interface for ASP.NET AJAX. Exploitation of this vulnerability allowed malicious actors to successfully execute remote code on a federal civilian executive branch (FCEB) agency’s Microsoft Internet Information Services (IIS) web server. Actors were then able to upload malicious dynamic-link library (DLL) files (some masqueraded as portable network graphics [PNG] files) to the C:\Windows\Temp\ directory.

CISA, FBI, and MS-ISAC encourage network defenders to review the Detection and Mitigations sections of this advisory, as well as refer to the accompanying Malware Analysis Report, MAR-10413062-1.v1 Telerik Vulnerability in U.S. Government IIS Server, to reference CISA's analysis for the identified malicious files.

(Source: CISA)

HC3 Threat Profile: Black Basta

Black Basta was initially spotted in early 2022, known for its double extortion attack, the Russian-speaking group not only executes ransomware, but also exfiltrates sensitive data, operating a cybercrime marketplace to publicly release it, should a victim fail to pay a ransom.

The threat group’s prolific targeting of at least 20 victims in its first two weeks of operation indicates that it is experienced in ransomware and has a steady source of initial access. The level of sophistication by its proficient ransomware operators, and reluctance to recruit or advertise on Dark Web forums, supports why many suspect the nascent Black Basta may even be a rebrand of the Russian-speaking RaaS threat group Conti, or also linked to other Russian-speaking cyber threat groups.

Previous HC3 Analyst Notes on Conti and BlackMatter even reinforce the similar tactics, techniques, and procedures (TTPs) shared with Black Basta. Nevertheless, as ransomware attacks continue to increase, this Threat Profile highlights the emerging group and its seasoned cybercriminals and provides best practices to lower risks of being victimized.

Read the full Threat Profile from the Department of Health and Human Services (HHS) Heath Sector Cybersecurity Coordination Center (HC3).

(Source: HHS HC3)

TikTok: Influence ops, data practices threaten US security

The Multi-State Information Sharing and Analysis Center (MS-ISAC) assesses that TikTok, a video-sharing app poses a risk to users and U.S. security more broadly due to the Chinese Communist Party’s (CCP) ability to leverage the app for influence operations and as a data harvesting clearinghouse.

As reported by CNBC in February 2023, the app faces regulatory pressure from officials across various levels of government calling to regulate and even ban the app in the United States. In response, TikTok announced plans for a transparency project called “Project Texas" in July 2022. Despite this, any solution still enabling CCP oversight and data to flow through Chinese servers via TikTok’s parent company, ByteDance, leaves the risk that the CCP will leverage the app to serve geostrategic goals to harvest data and manipulate the U.S. populace through censorship and influence operations.

Read the full blog by MS-ISAC’s Cyber Threat Intelligence (CTI) team.

(Source: MS-ISAC)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.