View as a webpage / Share

Volume 23 — Issue 36 | September 7, 2023

Wildland Fire Lessons Learned Center launches new website with improved Incident Review Database

The Wildland Fire Lessons Learned Center (LLC) is a knowledge resource center for the entire wildland fire community. The LLC was founded in 2002 as a national, federally funded organization with interagency staffing. Its mission is to provide useful and relevant products and services that reveal the complexity and risk faced by firefighters in the wildland fire environment.

Since its founding, the LLC’s products have been used for training, learning, and research on wildland firefighting. They share in-the-field lessons drawn from successes, challenges, close calls, and firefighter fatalities to increase safety.

The LLC announced in April 2023 that it would be overhauling its entire website. Phase one of the new site was launched in July 2023. The domain of the legacy site, wildfirelessons.net, was updated to lessons.wildfire.gov with the July launch. The LLC staff plans to build additional components and functionality on the site and to migrate data from the legacy site in the upcoming months.

The LLC’s existing products are now available at lessons.wildfire.gov, along with enhancements and new publications. These include:

• Annual Incident Review Summaries, providing wildland fire lessons condensed into manageable excerpts and actionable follow-up exercises for wildland firefighter training and discussions.
• The quarterly newsletter, Two More Chains. The Spring 2023 edition was dedicated to lessons learned from the Yarnell Hill fire on its 10-year anniversary.
• The Wildland Fire Lessons Learned Center blog.
• The Incident Review Database. This is a searchable database of lessons submitted by wildland firefighters via the LLC’s Rapid Lesson Sharing platform on incidents dating back to 1910. With the new website launch, the Incident Review Database now has a more robust search capability and more intuitive access. It is searchable by incident name, type, location, key term, or date.
• A new publication, Data Points, which was launched earlier this year. This series summarizes clusters of similar events, or “recurring lessons,” and provides a specific call to action, empowering fire leaders at all levels to take proactive measures based on the experience of others.

Update your bookmarks to the new URL: https://lessons.wildfire.gov/. You can sign up to receive email updates from the Wildland Fire Lessons Learned Center and be notified when new content is posted to the site. You can also follow the LLC on Facebook and YouTube.

(Source: LLC)

Highlights

Wildland Fire Lessons Learned Center launches new website with improved Incident Review Database

Extended: CISA SAFECOM Nationwide Survey now open until Sept. 29

EPA releases handbook for assessing community vulnerabilities to contaminant releases after extreme events

Webinar on naloxone administration for first responders and emergency managers, Sept. 19

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

Extended: CISA SAFECOM Nationwide Survey now open until Sept. 29

On June 1, the Cybersecurity and Infrastructure Security Agency (CISA) launched its SAFECOM Nationwide Survey (SNS) and a related blog. The SNS is a nationwide data collection effort that captures the status of emergency response provider capabilities necessary for achieving operability, interoperability, and continuity of emergency communications.

SAFECOM, an advisory group of public safety and elected officials, in conjunction with CISA, administers the survey. The last survey was conducted in 2018. However, the emergency communications environment is constantly evolving. Due to emerging technologies, new legislation, and new policies, Congress requires a periodic assessment of nationwide capabilities.

The deadline to complete the survey has been extended to Friday, Sept. 29, 2023. It is estimated to take about 30 minutes to complete. Any agency or organization charged with a public safety-related mission that uses emergency communications technology is encouraged to take the survey.

Participation is critical to achieve the following objectives:

• Provide actionable data and findings on the current and future state of public safety communications operability, interoperability, and continuity to keep America safe, secure, and resilient.
• Influence policy and funding decisions by informing decision-makers and government officials about needed support for emergency communications, programs, and services.
• Drive capability improvements by identifying nationwide progress, best practices, and gaps by formulating evidence-based guidance and resources.

Participating in the SNS is one of the most important ways you can impact the future of emergency communications and increase reliability of the data. To learn more about the survey and how to participate, visit cisa.gov/sns. For additional questions and feedback, please email sns@cisa.dhs.gov.

(Source: CISA)

EPA releases handbook for assessing community vulnerabilities to contaminant releases after extreme events

Communities continue to be hit, often unexpectedly, by the effects of prolonged droughts, excessive heat, floods, and wildfires.

In addition to their direct effects, these extreme events also have indirect effects on people through their impacts to infrastructure and the surrounding communities. Indirect consequences of these extreme events may include higher exposures to contaminants accidentally released from sites and facilities that are either actively managing or storing hazardous substances, wastes, or potential contamination, or who have a history of managing or storing these potential contaminants.

The Environmental Protection Agency (EPA) released a new planning resource: Handbook on Indicators of Community Vulnerability to Extreme Events: Considering Sites and Waste Management Facilities. The Handbook can be used to:

• Identify areas that are potentially vulnerable and the sources of their vulnerabilities.
• Communicate how extreme events may impact sites or waste facilities and the surrounding community.
• Develop targeted strategies (e.g., adaptation, mitigation, resilience, response) to prepare for and prevent potential health and environmental impacts.

The Handbook provides a conceptual framework and describes how to select, develop, map, and analyze indicators of community vulnerability. It provides new methods for identifying communities that are downstream and downwind of contaminated sites and waste management facilities and includes indicators of socioeconomic, demographic, and health characteristics.

The indicators were developed using publicly available datasets and in close collaboration with the EPA and regional, state, and local partners. The indicators were further refined in case studies with the City of Phoenix, Maricopa County, Arizona, and Waterbury, Connecticut.

The method presented in the Handbook provides a transparent and replicable approach that teams of planners, decision-makers, and technical advisors (for localities, cities, tribes, states, and regions), scientific researchers, environmental advocates, and community organizations may apply to screen for vulnerabilities and to communicate and focus resources effectively.

Access the new Handbook and companion fact sheets on EPA’s website.

(Source: EPA)

Webinar on naloxone administration for first responders and emergency managers, Sept. 19

Drug overdose deaths continue to be a significant public health burden in the United States, and many of these deaths can now be attributed to synthetic opioids.

The opioid overdose reversal medication naloxone, commonly referred to by the brand name Narcan, is a critical component of efforts to reduce opioid-related overdose deaths. The Department of Health and Human Services (HHS) is working to expand access to naloxone as part of its Overdose Prevention Strategy. In addition to being used by healthcare professionals, naloxone is increasingly being distributed to first responders and family members who may witness and respond to an opioid overdose.

The Federal Emergency Management Agency (FEMA) Region 1 will host a 1.5-hour virtual training session, Naloxone (Narcan) Training. The training will take place via Zoom on Tuesday, Sept. 19, from 1-2:30 p.m. EDT.

This training is targeted to first responders and emergency managers. It will cover the procedure for administering naloxone. The training will also address:

• Important trends related to drug overdose.
• The need for awareness and responsible citizen response.
• Best practices for administering naloxone.

The training will be led by a certified naloxone trainer and United States Public Health Service (USPHS) officer. The Commissioned Corps of the U.S. Public Health Service works on the front lines of public health. The USPHS’ medical, health and engineering professionals fight disease, conduct research, and care for patients in underserved communities across the nation and throughout the world.

Visit FEMA.gov to learn more and register for this free, virtual Naloxone (Narcan) Training.

(Sources: FEMA, HHS)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

US and international partners release report on Russian cyber actors using “infamous chisel” malware

On Aug. 31, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Security Agency (NSA), and agencies in Australia, Canada, United Kingdom, and New Zealand published a joint report on a malware campaign conducted by Russian cyber actors against the Ukrainian military.

The malware analysis report provides technical details of a new kind of malware used to target Android devices in use by Ukrainian military personnel. The malware, called Infamous Chisel, enables unauthorized access to compromised devices and is designed to scan files, monitor traffic, and periodically steal sensitive information.

The campaign was publicly uncovered by Ukraine’s security agency, the SBU, earlier this month and has been attributed to the threat actor known as Sandworm. The United Kingdom and the United States have previously attributed Sandworm to the Russian GRU’s Main Centre for Special Technologies (GTsST).

(Source: CISA)

CISA releases Capacity Enhancement Guide to strengthen agency resilience to DDoS attack

CISA has released actionable guidance for Federal Civilian Executive Branch (FCEB) agencies to help them evaluate and mitigate the risk of volumetric distributed denial-of-service (DDoS) attacks against their websites and related web services. CISA encourages FCEB agencies to review the guidance and apply the recommendations in the new Capacity Enhancement Guide: Volumetric DDoS Against Web Services Technical Guidance. Visit Capacity Enhancement Guides for Federal Agencies for more ways to reduce cybersecurity risk.

(Source: CISA)

CISA warns of hurricane-related scams

CISA urges users to remain on alert for malicious cyber activity following natural disasters, such as hurricanes, as attackers target disaster victims and concerned citizens by leveraging social engineering tactics, techniques, and procedures (TTPs). Social engineering TTPs include phishing, in which threat actors pose as trustworthy persons/organizations—such as disaster-relief charities—to solicit personal information via email or malicious websites. CISA recommends exercising caution in handling emails with disaster-related subject lines, attachments, or hyperlinks. In addition, be wary of social media pleas and texts messages related to severe weather events.

(Source: CISA)

Okta: Hackers target IT help desks to gain Super Admin, disable MFA

Identity and access management company Okta released a warning about social engineering attacks targeting IT service desk agents at U.S.-based customers in an attempt to trick them into resetting multi-factor authentication (MFA) for high-privileged users. The attackers' goal was to hijack highly privileged Okta Super Administrator accounts to access and abuse identity federation features that allowed impersonating users from the compromised organization.

Okta's advisory includes additional indicators of compromise, like system log events and workflow templates pointing to malicious activity in various stages of the attack. The company also provides a set of IP addresses associated with attacks observed between June 29 and August 19.

(Source: Bleeping Computer)

City of Dallas releases "after action" report following ransomware attack

The city of Dallas plans to release its "after action" report on the ransomware attack that crippled the city five months ago. The report says nearly 1,000 computers were infected in the cyber attack and the personal information of more than 30,000 people were compromised. This includes the personal information of Dallas firefighters, police officers and their families.

Dallas’ Chief Information Officer revealed that for at least the last four years the city has been doing simulated training to prepare for how to deal with cyberattacks, including getting guidance from the Department of Homeland Security. He also said the federal government had been putting out advisories since at least March warning of an uptick in cyberattacks targeting local municipalities.

It’s not clear how much data was taken from city servers. The city has identified ransomware group Royal as responsible for the hacking. Dallas officials say they will disclose more information regarding the ransomware attack in a report to City Council members this week.

(Source: CBS News, Texas, Government Technology)

Hundreds of thousands trafficked into cyber scamming in Southeast Asia, UN says

More than 200,000 people are being forced to carry out cyber scams in Southeast Asia, the United Nations estimates. A report published Tuesday by the Office of the High Commissioner for Human Rights documents the monumental scale of trafficking into an illicit industry that took off following the pandemic and shows no sign of slowing down.

In Cambodia, at least 100,000 people are involved against their will, while in Myanmar “credible sources” estimate 120,000 are being held, OHCHR wrote. Victims have been trafficked from all over Asia, as well as East Africa, Egypt, Turkey and Brazil. Typically, people will respond to job opportunities posted on social media promising decent pay in work related to information technology. Usually the job will involve relocating from the applicant’s home country. Upon arrival, the reality is much different from what was advertised.

(Source: The Record)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.