View as a webpage / Share

Volume 23 — Issue 35 | August 31, 2023

PERF report offers strategies to address police staffing challenges

The Police Executive Research Forum (PERF) just released a report in its Critical Issues in Policing Series, Responding to the Staffing Crisis: Innovations in Recruitment and Retention.

The report draws on PERF’s own research, which included a questionnaire completed by more than 250 members of PERF, more than 100 one-on-one interviews with police leaders, and the presentations and discussions among the approximately 275 attendees at PERF’s Nov. 3, 2022, conference, “Innovations in Recruitment and Retention to Meet Tomorrow’s Challenges.”

The report builds on PERF’s 2019 report, The Workforce Crisis, and What Police Agencies Are Doing About It.

The 2019 report recognized the staffing “triple threat” facing police agencies today:

1. Fewer people applying to become officers.
2. More officers leaving their departments and the policing profession before retirement age.
3. More current officers becoming eligible for retirement.

Since 2019, the COVID-19 pandemic and civil unrest related to police shootings have intensified staffing challenges. The 2023 questionnaire results show how these trends have continued to worsen:

• 65% of agencies reported an increase in retirements between 2020 and 2022, and 66% reported an increase in resignations.
• 69% of agencies saw a drop in the number of applications for full-time officer positions between 2020 and 2022.
• Overall officer staffing levels fell by 4.8% between January 2020 and January 2023.

PERF bases its recommended strategies on the recognition that an agency’s operations and community relations affect — and are affected by — its success in recruiting and retaining officers. For example, a decline in community support for policing can negatively impact recruitment and retention efforts. In turn, a decline in the number of officers can result in increased strain on existing officers, making them more likely to leave. These interdependencies can create undesirable feedback loops. However, improvements in any of these four components - agency operations, recruitment, retention, and community relations – can lead to improvements in any of the others.

The report recommends ten ways law enforcement agencies can address staffing challenges and strengthen their agencies overall. These ten recommendations include interventions such as re-examining the hiring process, sharing burdens to help address understaffing, and improving officer well-being.

Chapters discuss recruitment and hiring, officer retention, financial and non-financial recruitment and retention incentives, and agency operations. Each chapter’s recommendations are supported by extensive examples and citations from police departments around the country who share strategies that are currently working for their agencies.

This report and previous reports in the Critical Issues in Policing Series can be accessed on PERF’s website.

(Source: PERF)

Highlights

PERF report offers strategies to address police staffing challenges

September is Sepsis Awareness Month

DHS S&T releases fact sheet on plume models and simulation tools for radiological emergency preparedness

Great ShakeOut earthquake drill will take place on Oct. 19

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

September is Sepsis Awareness Month

Sepsis is the body’s overwhelming response to an infection. Almost any infection, whether bacterial, viral, or fungal in origin, can lead to sepsis. Sepsis is a life-threatening condition that requires urgent medical care to prevent tissue damage, organ damage, and death.

Sepsis is a leading cause of hospital mortality in the United States. There are an estimated 1.7 million adult sepsis hospitalizations annually, of which 350,000 result in hospital death or discharge to hospice.

According to the Centers for Disease Control and Prevention (CDC), most sepsis cases (nearly 87%) begin in the community and are transported to the hospital by emergency medical services (EMS) providers. Since sepsis can progress quickly and unpredictably, it is critical to recognize signs of sepsis and intervene early to help these patients. EMS providers play an essential role in early sepsis intervention.

The Sepsis Alliance Institute released a course this month covering the latest research on prehospital sepsis care. Research shows that when EMS providers are trained to recognize signs of sepsis and alert the hospital that sepsis is suspected when the patient is transferred to the emergency room, patients’ sepsis survival rates in the hospital are significantly improved.

Sepsis presentation is heterogeneous and can be tricky to identify in the field. The Centers for Disease Control and Prevention (CDC) provides an EMS Card with an at-a-glance list of the signs and symptoms of sepsis an EMS provider might see and the information that should be gathered from a patient to help determine whether sepsis should be suspected.

For more in-depth information on how to recognize signs and symptoms of sepsis in the prehospital setting, the CDC recommends the following three awareness courses for EMS from the Sepsis Alliance Institute:

• Sepsis: First Response. This course can be taken for up to 1.9 hours of continuing education credit via the Sepsis Alliance’s learning management system. A 16-minute standalone video presenting all content in this course is also available via the Sepsis Alliance’s YouTube channel.
• Sepsis: Pediatric First Response. This course can be taken for 2.5 hours of continuing education credit. A 17-minute standalone video is also available.
• Disaster Medicine: Sepsis. This course can be taken for 1.5 hours of continuing education credit.

EMS medical directors, coordinators, paramedics, EMTs, and anyone interested in the latest evidence on the impact of prehospital care of sepsis patients may also benefit from the Sepsis Alliance’s latest course, Prehospital Sepsis Care Research Update, 2023. The course is presented by an EMS Coordinator from the Ridgefield (Conn.) Fire Department. The presentation discusses several recently published papers that have reshaped the emergency medical community’s understanding of prehospital alerts as well as prehospital sepsis treatment with fluid administration and antibiotics.

Throughout September, the CDC encourages all healthcare professionals to educate patients, their loved ones and caregivers about how to protect themselves and prevent sepsis using the shareable educational materials in its Get Ahead of Sepsis awareness campaign. Use hashtag #SAM2023 on social media.

(Sources: CDC, Sepsis Alliance Institute)

DHS S&T releases fact sheet on plume models and simulation tools for radiological emergency preparedness

First responders and emergency planners need access to realistic plume models and simulations when conducting radiological emergency preparedness activities.

The Department of Homeland Security (DHS) Science and Technology Directorate (S&T) funded the development of three new tools, available through the Federal Emergency Management Agency’s (FEMA’s) Interagency Modeling and Atmospheric Assessment Center (IMAAC), that offer emergency managers, first responders, and exercise coordinators several options to access plume models and interactive simulations for exercises, trainings, and emergency planning activities.

DHS S&T has just released a 3-page fact sheet summarizing these tools and how to access them: Obtaining Models and Simulations for Radiological/Nuclear Trainings and Exercises.

The three tools covered in the fact sheet are:

• RadResponder Simulation Tool.
• IMAAC Exercise Support.
• Consequence Management Website (CMWeb) Simulation Planning Scenario Tool.

The RadResponder Simulation Tool and IMAAC’s exercise support are available as part of FEMA’s CBRNResponder Network, which is managed by FEMA’s Office of Emerging Threats, formerly called the Chemical, Biological, Radiological and Nuclear (CBRN) Office. A CBRNResponder Network account is required to access these two tools.

CMweb is managed by the Department of Energy. It is a web-based, data dissemination application used to assist decision making during a radiological incident. The system provides a convenient method of sharing consequence management information, such as event status, plume model, deposition predictions, measurement data, and protective action recommendations. This tool can generate customized plume models (including briefing products), and the simulation files that can be uploaded to the RadResponder Simulation Tool. A CMWeb account is required to access the Simulation Planning Scenario Tool.

To learn more about these tools and how to request access, see DHS S&T’s fact sheet, Obtaining Models and Simulations for Radiological/Nuclear Trainings and Exercises, available on DHS’s website.

(Source: DHS S&T)

Great ShakeOut earthquake drill will take place on Oct. 19

FEMA has announced this year’s Great ShakeOut earthquake drill, scheduled for Thursday, Oct. 19, at exactly 10:19 a.m. (local time for your region).

While earthquakes are more common in some areas of the United States than others, earthquakes can happen anywhere, and they can strike at any time with little warning.

The drill focuses on what to do when the ground shakes during an earthquake to stay safe and minimize injuries:

• DROP where you are, onto your hands and knees. This position protects you from being knocked down and reduces your chances of being hit by falling or flying objects.
• COVER your head and neck with one arm and hand.
• HOLD ON until the shaking stops.

The event is also an opportunity to educate the public about their local earthquake risk and what everyone can do to be more prepared. The California-based Earthquake County Alliance provides preparedness information, such as how to Secure Your Space by identifying hazards and securing moveable items in your home or workplace.

While the Great ShakeOut Earthquake Drill is an international effort, the drill is organized by Official ShakeOut Regions. Supporting instruction surrounding the drill is customized for the preparedness needs of each region. Therefore, the first step to getting better prepared is to register to participate in the drill. From there, you can access drill manuals, materials, and other resources appropriate for your audience and Official ShakeOut Region to get started. Resources supporting drill leaders are also available on the website for areas that fall outside of an Official ShakeOut Region.

FEMA encourages everyone to register, whether as an individual or as an organization, to be included in the millions participating and to receive useful information and guidance.

Visit ShakeOut.org to learn more about the drill, to see who is participating this year, and to register. Check out ShakeOut.org’s YouTube channel for even more educational resources. You can also text "ShakeOut" to 43362 to be added to the Great ShakeOut distribution list.

(Sources: FEMA, ShakeOut.org, United States Geological Survey)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

Suspected PRC Cyber Actors Continue to Globally Exploit Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868)

On Aug. 23, the Federal Bureau of Investigation (FBI) released an FBI FLASH advisory, Suspected PRC Cyber Actors Continue to Globally Exploit Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868).

As a part of the FBI investigation into the exploitation of CVE-2023-2868, a zero-day vulnerability in Barracuda Network’s Email Security Gateway (ESG) appliances, the FBI has independently verified that all exploited ESG appliances, even those with patches pushed out by Barracuda, remain at risk for continued computer network compromise from suspected PRC cyber actors exploiting this vulnerability.

The cyber actors utilized this vulnerability to insert malicious payloads onto the ESG appliance with a variety of capabilities that enabled persistent access, email scanning, credential harvesting, and data exfiltration. The FBI strongly advises all affected ESG appliances be isolated and replaced immediately, and all networks scanned for connections to the provided list of indicators of compromise immediately.

Read the full FBI FLASH from the FBI’s Internet Crime Complaint Center (IC3) for technical details, indicators of compromise, recommended mitigations, and instructions on how to report a detected compromise.

(Source: FBI IC3)

CISA releases additional IOCs associated with malicious Barracuda activity (CVE-2023-2868) 

On Aug. 29, the Cybersecurity and Infrastructure Security Agency (CISA) released additional indicators of compromise (IOCs) associated with exploitation of CVE-2023-2868. CVE-2023-2868 is a remote command injection vulnerability affecting Barracuda Email Security Gateway (ESG) Appliance, versions 5.1.3.001-9.2.0.006. Malicious threat actors exploited this vulnerability as a zero day as early as October 2022 to gain access to ESG appliances.

(Source: CISA)

FBI, partners dismantle Qakbot infrastructure in multinational cyber takedown

On Aug. 29, the FBI and the Justice Department announced a multinational operation to disrupt and dismantle the malware and botnet known as Qakbot. The action, which took place in the U.S., France, Germany, the Netherlands, Romania, Latvia, and the United Kingdom, represents one of the largest U.S.-led disruptions of a botnet infrastructure used by cybercriminals to commit ransomware, financial fraud, and other cyber-enabled criminal activity. As part of the operation, the FBI gained lawful access to Qakbot’s infrastructure and identified over 700,000 infected computers worldwide—including more than 200,000 in the U.S. 

(Source: FBI)

CISA and FBI Publish joint advisory on QakBot infrastructure

On Aug. 30, CISA and the FBI released a joint Cybersecurity Advisory (CSA), Identification and Disruption of QakBot Infrastructure, to help organizations detect and protect against newly identified QakBot-related activity and malware. QakBot—also known as Qbot, Quackbot, Pinkslipbot, and TA570—is responsible for thousands of malware infections globally.

Originally used as a banking trojan to steal banking credentials for account compromise, QakBot—in most cases—was delivered via phishing campaigns containing malicious attachments or links to download the malware, which would reside in memory once on the victim network. QakBot has since grown to deploy multiple types of malware, trojans, and highly-destructive ransomware variants targeting the United States and other global infrastructures, including the Election Infrastructure Subsector, Financial Services, Emergency Services, and Commercial Facilities Sectors.

(Source: CISA)

LockBit 3.0 ransomware variants surge post builder leak

The leak of the LockBit 3.0 ransomware builder has triggered a surge in personalized variants, impacting various organizations. LockBit 3.0, also known as LockBit Black, first emerged in June 2022 and posed challenges for security analysts and automated defense systems due to its encrypted executables, random passwords and undocumented Windows functions.

In September 2022, the uncontrolled leak of the LockBit 3.0 builder surfaced, enabling cyber-criminals to create tailored ransomware strains. Two versions of the builder appeared, each with slight variations. Subsequently, attacks utilizing these customized LockBit variants increased, deviating from the usual LockBit operations in aspects like ransom notes and communication channels.

Through this investigation, the team was able to unravel the complexities of the builder’s design, gaining insights into how it assembles the ransomware strains, secures its payload and configures various parameters that govern its behavior. The investigation provided comparative data that can be used by law enforcement, as well as information for cyber defenders.

(Source: Infosecurity Magazine)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.