|
Volume 23 — Issue 43 | October 26, 2023 |
|
|
Every minute of every day, law enforcement, fire and rescue, emergency medical services (EMS), public works, transportation, towing, and other responders work to make roadways safe for all road users. These traffic incident responders put their lives at risk when working on roadways, clearing each of the nearly 7 million motor vehicle crashes and many more incidents involving stalled vehicles or roadway debris each year.
Crash Responder Safety Week (CRSW) takes place Nov. 13–17, 2023. This Federal Highway Administration (FHWA)-sponsored initiative communicates the simple steps everyone can take to keep roadway responders and the public safe around traffic incidents.
This year’s theme is “Protect Those Who Protect You.” Participate in the National Kickoff Webinar for CRSW 2023, on Monday, Nov. 13, from 1-2:30 p.m. EST, for an opportunity to honor responders, sign the CRSW National Proclamation, and learn more about this year’s theme and the activities planned for the week.
The FHWA and its National Operations Center of Excellence (NOCoE) have established day-of-week themes for this year’s campaign. For each day’s theme, many resources are provided for the public and responder education:
To stay up-to-date throughout the year on the latest innovative TIM practices being implemented around the country, you can sign up for the NOCoE’s newsletter to receive notifications on upcoming webinars in the NOCoE’s monthly Talking TIM series. Webinars in this series regularly feature briefings from departments of transportation and public safety agencies on innovative TIM practices that directly impact responder safety on roadways. Some topics related to responder safety that were covered in recent webinars, now available on demand, include:
- The June 2023 Talking TIM webinar featured a briefing from the Grover Heights (Minnesota) Fire Department on using fire apparatus to protect responders and communicate with drivers, along with a related presentation on how to retrofit aging fire apparatus into traffic management units.
- The July 2023 Talking TIM webinar featured a briefing from the Maricopa Association of Governments in the Phoenix, Arizona, region on emergency vehicle preemption.
- The August 2023 Talking TIM webinar featured a briefing on medical helicopter landing zone considerations for roadway crashes and another briefing on wearable 360-degree lighting for roadside visibility.
- The October 2023 Talking TIM webinar discussed the state of practice of Safety Service Patrol programs, featuring briefings from the North Carolina Department of Transportation and the DOT VOLPE Center.
Register for the National Kickoff Webinar for CRSW 2023 on Nov. 13, and visit the NOCoE’s website to learn more.
Finally, if you are involved in a roadway incident where you, a fellow responder, or any emergency equipment was struck or nearly struck by an oncoming vehicle, you can now easily report the incident to the national database, ReportStruckBy.com. The Emergency Responder Safety Institute (ERSI) has been collecting struck-by incident data directly from responders since the launch of ReportStruckBy.com in 2021. ERSI published its initial analysis on the data collected so far in September 2023.
(Sources: FHWA, NOCoE, ReportStruckBy.com)
|
|
|
In July 2022, the Substance Abuse and Mental Health Services Administration (SAMHSA) launched the 988 Suicide & Crisis Lifeline, a national network of more than 200 state and local call centers that can be reached by dialing 988. These call centers are supported by the Department of Health and Human Services (HHS) through SAMHSA.
Since the launch of the 988 Suicide & Crisis Lifeline, the National Association of Counties (NACo) hosted a series of conversations with county leaders to understand the progress, challenges and lessons learned from efforts to establish 911/988 interoperability across various models, including embedded clinicians, call transfer, and co-located response.
NACo recently published a Shaping Crisis Response Spotlight Series, where it featured five counties in five different states who have implemented innovative crisis response systems involving 911/988 integration:
-
Douglas County, Kansas. Douglas County hosts Kansas’ primary crisis call center, Kansas Suicide Prevention Headquarters (KSPHQ), which responds to 988 calls placed in 103 out of the state’s 105 counties. KSPHQ created a 911/988 transfer program that utilizes 911 location technology so that callers within the counties that KSPHQ serves, regardless of their phone’s area code, are located and transferred directly to KSPHQ without significant delays. Douglas County also worked with a 911 law enforcement liaison at KSPHQ to develop criteria for diverting cases from 911 to 988.
-
Durham County, North Carolina. Durham County leveraged a strategic partnership with the City of Durham to create a community-driven vision for public safety and crisis response. The county-city planning committee established the Community Safety Department (DCSD) to create unarmed, equitable and community-centered responses.
-
Los Angeles (LA) County, California. LA County is the most populous county in the United States, with over 10 million residents, 70 public safety answering points (PSAPs) and 80 law enforcement agencies. LA County launched a comprehensive call diversion program to make behavioral health care as accessible as traditional emergency responses.
-
Travis County, Texas. In 2019, Travis County expanded its partnership with a local mental health and intellectual and developmental disability authority, creating the Crisis Call Diversion Program (CCD). Under this program, Crisis Center Clinicians were embedded within 911 PSAPs, serving as co-located, trained behavioral health experts.
-
Pima County, Arizona. Pima County was one of the first communities in the country to embed clinicians within its 911 operating system. Pima County also deploys Mobile Crisis Teams (MCTs) using a dispatch optimization tool that tracks MCTs’ locations with GPS and monitors their status.
This project was conducted by NACo in collaboration with The Pew Charitable Trusts and the RAND Corporation.
Learn more about NACo’s Shaping Crisis Response Spotlight Series on NACo’s website.
(Source: NACo)
The Federal Emergency Management Agency (FEMA) has posted fiscal year (FY) 2023 notices of funding opportunities for two competitive Hazard Mitigation Assistance grant programs. For this grant cycle, $800 million is available for the Flood Mitigation Assistance (FMA) grant program and $1 billion is available for the Building Resilient Infrastructure and Communities (BRIC) grant program.
The FMA and BRIC grant programs provide states, local communities, tribes, and territories funding to address high-level future risks from natural disasters such as wildfires, drought, hurricanes, earthquakes, extreme heat, and increased flooding to foster greater community resilience and reduce disaster suffering.
The application period opened on Oct. 16, 2023. Eligible applicants must apply for funding using FEMA Grants Outcomes, FEMA’s grants management system. Applications must be submitted in the portal no later than 3 p.m. EST on Feb. 29, 2024. Local governments should consult with their state, tribal or territorial agency to confirm deadlines to submit subapplications.
FEMA has planned three live webinars for governments to learn more about preparing applications and will be producing on-demand videos on subjects like technical and qualitative criteria, application pitfalls and building codes.
See FEMA’s Oct. 12 press release for more information about key changes to these grant programs this year. Visit FEMA.gov for more information about Hazard Mitigation Assistance.
(Source: FEMA)
The Federal Communications Commission’s (FCC’s) Public Safety and Homeland Security Bureau (PSHSB) and the Cybersecurity and Infrastructure Security Agency’s (CISA’s) Emergency Communications Division are hosting a public roundtable on Emergency Alerting Security on Monday, Oct. 30, from 9:30 a.m. – 3:05 p.m. EDT.
In October 2022, the FCC proposed rules to protect against cyberattacks of the Emergency Alert System and Wireless Emergency Alerts. The upcoming roundtable will build upon the record in that proceeding.
On Oct. 16, 2023, the FCC posted an announcement and Public Notice with information on the background and purpose of the Oct. 30 roundtable event. On Oct. 26, the FCC announced the agenda for the roundtable. A series of four panels will focus on:
- The Need for Cybersecurity in Alerting.
- Cybersecurity Risk Management and Safeguards.
- Cyber Incident Reporting.
- Cost Burden Analysis.
The four panels will have federal representation from the Federal Bureau of Investigation (FBI), CISA, the White House, FEMA, the National Institute of Standards and Technology (NIST), National Telecommunications and Information Administration (NTIA), the Small Business Administration, and others.
Panels will also have representation from several East Coast metro area emergency management agencies, including New York City Emergency Management; Fairfax County Department of Emergency Management and Security; Arlington County Department of Public Safety Communications and Emergency Management; and DC Homeland Security and Emergency Management Agency.
Private sector representation will include leading commercial wireless carriers and other emergency communications and cybersecurity service providers, including the MITRE Corporation and the Center for Internet Security.
The event will take place in-person at the FCC Headquarters in Washington, D.C., but there will be a livestream accessible on the FCC’s YouTube channel and via fcc.gov/live. The FCC encourages everyone to register ahead of the event, whether attending in person or virtually. A recording should be available soon after the event in the FCC’s event archive.
(Source: FCC)
|
|
CISA announces effort to revise the National Cyber Incident Response Plan
On Oct. 20, CISA announced next steps for ongoing engagement with industry and government to update the National Cyber Incident Response Plan (NCIRP). As directed by the President’s 2023 National Cybersecurity Strategy, CISA, in close coordination with the Office of the National Cyber Director, is embarking on a process to gather input from public and private sector partners– including the federal interagency, Sector Risk Management Agencies (SRMAs), regulators, and critical infrastructure organizations, to identify key changes for incorporation into the updated NCIRP.
Published in 2016, the NCIRP is the nation’s framework for coordinated response to significant cyber incidents. Since then, the cybersecurity threat landscape and national response ecosystem have changed dramatically. Through the Joint Cyber Defense Collaborative (JCDC), CISA will work to ensure that the updated NCIRP addresses significant changes in policy and cyber operations since the initial NCIRP was released.
All organizations are encouraged to read CISA’s new fact sheet on the NCIRP webpage to learn about ways to participate in this long-term effort and stay updated on the development of the NCIRP 2024.
(Source: CISA)
|
|
CISA, HHS release collaborative cybersecurity healthcare toolkit
On Oct. 25, CISA and the Department of Health and Human Services (HHS) co-hosted a roundtable discussion on the cybersecurity challenges that the U.S. healthcare and public health (HPH) sector system faces, and how government and industry can work together to close the gaps in resources and cyber capabilities.
As healthcare organizations increasingly rely on digital technologies to store patient and medical information, carry out medical procedures, and communicate with patients, they are exposed to greater risk. However, hospitals, health centers, and clinics, especially those that are under-resourced, are coping with a wide range of challenges, making it harder to invest the necessary resources into cybersecurity.
Over the past year, CISA, HHS and its Health Sector Coordinating Council (HSCC) Cybersecurity Working Group have been working together to deliver tools, resources, training, and information that can help organizations within this sector.
A key part of this effort is a new Cybersecurity Toolkit for Healthcare and Public Health that was unveiled at the Oct. 25 roundtable. This toolkit is easy to navigate online at www.CISA.gov/healthcare.
(Source: CISA)
CISA updates guidance for addressing Cisco IOS XE Web UI vulnerabilities
On Oct. 20, CISA, in response to active, widespread exploitation, released guidance addressing two vulnerabilities, CVE-2023-20198 and CVE-2023-20273, affecting Cisco’s Internetworking Operating System (IOS) XE Software Web User Interface (UI). An unauthenticated remote actor could exploit these vulnerabilities to take control of an affected system. Specifically, these vulnerabilities allow the actor to create a privileged account that provides complete control over the device.
On Oct. 23, CISA updated its guidance addressing these two vulnerabilities. The guidance now notes that Cisco has fixed these vulnerabilities for the 17.9 Cisco IOS XE software release train with the 17.9.4a update. According to Cisco's Security Advisory: Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature, fixes are still to be determined for the following Cisco IOS XE software release trains: 17.6, 17.3, 16.12 (Catalyst 3650 and 3850 only).
CISA urges organizations with the 17.9 Cisco IOS XE software release train to immediately update to the 17.9.4a release.
(Source: CISA)
CISA, NSA, FBI, and MS-ISAC release update to #StopRansomware Guide
On Oct. 19, CISA, the National Security Agency (NSA), the FBI, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released an updated version of the joint #StopRansomware Guide. The update includes new prevention tips such as hardening SMB protocols, revised response steps, and added threat hunting insights.
Developed through the U.S. Joint Ransomware Task Force (JRTF), #StopRansomware Guide is designed to be a one-stop resource to help organizations minimize the risks posed by ransomware incidents through best practices to detect, prevent, respond, and recover, including step-by-step approaches to address potential attacks.
CISA and its partners encourage organizations to implement the recommendations in the guide to reduce the likelihood and impact of ransomware incidents. For more information, visit CISA’s Stop Ransomware page.
(Source: CISA)
HC3 Analyst Note: SolarWinds Critical Remote Code Execution Flaws
On Oct. 18, 2023, SolarWinds published security fixes for their Access Rights Manager (ARM) software, which is a product that is designed to help security administrators provision, deprovision, manage, and audit user access rights to systems, data, and files. This can help IT infrastructure monitor for suspicious account activity. The Zero Day Initiative has identified eight vulnerabilities, with three of them being rated as critical. The critical flaws can allow for remote attackers to execute arbitrary code on the affected installation. Additional, authentication is not required for the exploitation of any of the three vulnerabilities and they can be leveraged in the context of “SYSTEM”. This could enable an attacker to operate with the highest level of privileges available on the machine and grant the attacker full control over files.
In early 2020, the SolarWinds Orion system was targeted by an attacker(s), which led to the supply chain compromise of up to 18,000 of its customers. Due to the previous malicious targeting and wide use of SolarWinds, HC3 strongly encourages users to monitor and upgrade their systems to prevent serious damage from occurring to the Healthcare and Public Health (HPH) sector.
Read the full Analyst Note from the Department of Health and Human Services (HHS), Health Sector Cybersecurity Coordinating Council (HC3) for more information and mitigation recommendations.
(Source: HHS HC3)
|
|
The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures. |
|
|
Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.
Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.
Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.
|
|
|
|
|
