View as a webpage / Share

Volume 24 — Issue 19 | May 9, 2024

Firefighter Safety Stand Down 2024 – “Fire Training: Back to Basics”

The 2024 Firefighter Safety Stand Down will take place the week of June 16-22, and this year’s theme is “Fire Training: Back to Basics.”

This year’s theme focuses on the important role training plays in a department’s success and building the right foundation for a department-specific training program. Each day will focus on a different topic within this theme:

• Monday: Building the Foundation of a Training Program.
• Tuesday: Assessing the Needs of the Community and Department.
• Wednesday: Safety During Training.
• Thursday: Physical and Mental Health Considerations.
• Friday: The 12 Foundations of Fire Department Training.

Fire and emergency medical services (EMS) departments are encouraged to suspend all non-emergency activity during Safety Stand Down to focus on training and education related to this year’s theme.

Safety Stand Down is a joint initiative of the International Association of Fire Chiefs (IAFC), Safety, Health and Survival Section; the National Volunteer Fire Council (NVFC); the National Fire Protection Association (NFPA); the Fire Department Safety Officers Association (FDSOA); and the International Association of Fire Fighters (IAFF) and is supported by national and international fire and emergency service organizations as well as health and safety-related organizations and agencies.

Visit SafetyStandDown.org to learn more, see what other departments have done, and to access resources to implement Safety Stand Down in your department.

(Source: SafetyStandDown.org, IAFC, NVFC, NFPA, FDSOA, IAFF)

Highlights

Firefighter Safety Stand Down 2024 – “Fire Training: Back to Basics” 

FEMA releases ground EMS and ambulance resource types

Hurricane Preparedness Week is May 5-11, 2024

COPS Office launches Training Portal mobile app for law enforcement and public safety partners

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

FEMA releases ground EMS and ambulance resource types

After a 30-day period of national engagement from Oct. 24 – Nov. 23, 2023, the Federal Emergency Management Agency (FEMA) has published resource typing documents related to ground EMS and ambulance incident response. The 12 updated resource typing documents are:

• Advanced EMT (A-EMT).
• Ambulance Ground Team – ALS.
• Ambulance Ground Team – BLS.
• Ambulance Strike Team – ALS.
• Ambulance Strike Team – BLS.
• Ambulance Strike Team Leader.
• Emergency Medical Responder (EMR).
• Emergency Medical Services (EMS) Vehicle Operator.
• Emergency Medical Technician (EMT).
• Emergency Vehicle Operator Heavy (EVO-H).
• Medical Ambulance Bus (MAB).
• Paramedic.

These resource typing documents enhance the interoperability and effectiveness of mutual aid by establishing baseline qualifications. This facilitates sharing deployable resources at all jurisdictional levels.

The documents are now available within FEMA’s Resource Typing Library Tool, which is part of FEMA’s Preparedness Toolkit.

(Source: FEMA)

Hurricane Preparedness Week is May 5-11, 2024

Hurricane season starts May 15 for the Eastern Pacific region and June 1 for the Atlantic and Central Pacific regions.

While the National Oceanic and Atmospheric Administration (NOAA) has not yet released its 2024 hurricane season outlook, Colorado State University (CSU) released its extended range forecast in April for the 2024 Atlantic basin hurricane season. CSU Tropical Weather & Climate Research is predicting “an extremely active Atlantic hurricane season,” with an estimated 23 named storms, 11 hurricanes, and 5 major hurricanes this year.

On May 3, the White House proclaimed May 5-11, 2024, as National Hurricane Preparedness Week. This week is an excellent time for public safety agencies to share best practices with their communities on how to prepare and stay safe throughout the 2024 hurricane season.

FEMA’s Ready.gov/hurricanes page provides information for individuals and businesses on preparedness for hurricanes and associated hazards such as flooding, wind, and tornadoes.

NOAA provides tips you can share with friends and family to help with pre-season preparation, with topics for each day of the week:

• May 5 — Know Your Risk: Wind & Water.
• May 6 — Prepare Before Hurricane Season.
• May 7 — Understand Forecast Information.
• May 8 — Get Moving When a Storm Threatens.
• May 9 — Stay Protected During Storms.
• May 10 — Use Caution After Storms.
• May 11 —Take Action Today.

FEMA and NOAA are hosting the annual Hurricane Awareness Tour along the East Coast. The purpose of this event is to raise awareness of the impacts from tropical cyclones and the danger of being caught without a personal hurricane plan. Tour NOAA’s “Hurricane Hunter” aircraft at a tour stop near you.

For emergency managers and other public safety officials, additional pre-season preparedness opportunities are available.

NOAA’s 2024 Hurricane Awareness Webinars are underway, covering lessons learned from the 2023 hurricane season, what’s new for 2024, responding to marine debris after disasters, using data to understand effects of coastal hurricanes, and preparing for tsunami hazards. Recordings of past webinars in this series are accessible after completing the registration form for that webinar.

FEMA’s National Hurricane Program (NHP) is offering its annual virtual training series on HURREVAC, a web-based hurricane evacuation decision support tool provided free to emergency managers in state, local, tribal, and territorial governments. The 2024 HURREVAC Webinar Series will run from Monday, June 10 through Friday, June 14, 2024, starting at 2 p.m. EDT each day. Each session will run for approximately 60-90 minutes. Visit HURREVAC.com to learn more and register. Recordings will be posted on the HURREVAC YouTube channel.

NOAA’s National Hurricane Center (NHC) has posted a summary of its new products and services for the 2024 hurricane season at hurricanes.gov (nhc.noaa.gov). NOAA NHC will post its hurricane forecasting products here throughout the 2024 season.

(Sources: FEMA, NOAA)

COPS Office launches Training Portal mobile app for law enforcement and public safety partners

The Department of Justice’s (DOJ’s) Office of Community Oriented Policing Services (COPS Office) created the COPS Training Portal (the Portal) in 2017 as a convenient way for law enforcement professionals and community partners to access interactive online training in emerging public safety topics. Additionally, the Portal serves as a gateway to a variety of multimedia community policing resources at no cost.

Recently, the COPS Office announced that the Portal has reached a milestone of 100,000 course enrollments. It now offers 45 trainings and resources on topics as varied as active shooter events, mental health crisis response, school safety, and implementing a public safety drone program.

In 2024 and beyond, the COPS Office will continue to add training and resources on emerging topics, such as vehicular pursuits, human trafficking, responding to persons with intellectual and developmental disabilities, community engagement around critical incidents, and more.

To extend the reach of the Portal even further, on May 1, the COPS Office announced the launch of a mobile app for the Portal. Learners will be able to complete courses offline. The app will sync with the website when the learner’s mobile device has sufficient internet connection.

The COPS Office has partnered with the National Center for Policing Innovation (NCPI) for administering the COPS Training Portal. The Portal is also made possible by the organizations who have partnered with the COPS Office to create training:  International Association of Chiefs of Police; National Alliance for Drug Endangered Children; National Association of School Resource Officers; National Center for Policing Innovation; National Criminal Justice Training Center of Fox Valley Technical College; National Highway Traffic Safety Administration; University of Tennessee Law Enforcement Innovation Center; Western Community Policing Institute; WILL Interactive; and XERO Associates, Inc.

Create a free account on the COPS Training Portal to gain access to case studies, scenarios, interactive publications, training videos, visuals, and simulation-based activities that could supplement training or lead action planning within your team. Download the mobile app on the Apple App Store or Google Play.

(Source: DOJ)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA and FBI release Secure by Design Alert to urge manufacturers to eliminate directory traversal vulnerabilities

On May 2, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released a joint Secure by Design Alert, Eliminating Directory Traversal Vulnerabilities in Software. This Alert was crafted in response to recent well-publicized threat actor campaigns that exploited directory traversal vulnerabilities in software (e.g., CVE-2024-1708, CVE-2024-20345) to compromise users of the software—impacting critical infrastructure sectors, including the Healthcare and Public Health Sector.

Additionally, this Alert highlights the prevalence, and continued threat actor exploitation of, directory traversal defects. Currently, CISA has listed 55 directory traversal vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog. Approaches to avoid directory traversal vulnerabilities are known, yet threat actors continue to exploit these vulnerabilities which have impacted the operation of critical services, including hospital and school operations.

(Source: CISA)

CISA and partners release fact sheet on Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity  

On May 1, CISA, in collaboration with U.S. and international partners, published a joint fact sheet, Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity. This fact sheet provides information and mitigations associated with cyber operations conducted by pro-Russia hacktivists who seek to compromise industrial control systems (ICS) and small-scale operational technology (OT) systems in North American and European critical infrastructure sectors, including Water and Wastewater Systems, Dams, Energy, and Food and Agriculture Sectors.

The pro-Russia hacktivist activity appears mostly limited to unsophisticated techniques that manipulate ICS equipment to create nuisance effects. However, investigations have identified that these actors are capable of techniques that pose physical threats against insecure and misconfigured OT environments.

(Source: CISA)

Under the digital radar: Defending against People’s Republic of China’s nation-state cyber threats to America’s small businesses

According to the latest annual report by the Office of the Director of National Intelligence, “China remains the most active and persistent cyber threat to U.S. Government, private sector, and critical infrastructure networks.” Recently, CISA and U.S. Government partners have seen a troubling shift: PRC nation-state cyber actors are setting their sights on U.S. critical infrastructure with an eye toward future disruption.

Many critical infrastructure owners and operators either are small businesses themselves or rely on small business service providers and vendors to support their operations. The PRC aims to infiltrate those networks now in order to be ready to disrupt and degrade services at a later date, which makes the cybersecurity of critical infrastructure and small businesses a national security priority.

CISA will host a CISA Live!  Webinar on Wednesday, May 15 at 11:30 a.m. EDT on LinkedIn Live: People’s Republic of China Cyber Threats and What We Can Do. Join the webinar to learn more about CISA’s efforts to detect, prevent, and defend against PRC cyber actors' efforts to pre-position for disruptive or destructive attacks against U.S. critical infrastructure. Participants will also learn about information, tools, technical assistance, and other resources available through CISA.

(Source: CISA)

MITRE hack: China-linked group breached systems in December 2023

MITRE, a not-for-profit company operating research and development centers on behalf of U.S. government sponsors, revealed on April 19 that hackers had targeted its Networked Experimentation, Research, and Virtualization Environment (NERVE), an unclassified collaborative network used for research, development, and prototyping.

The hackers gained initial access through the exploitation of Ivanti Connect Secure VPN device zero-day vulnerabilities tracked as CVE-2023-46805 and CVE-2024-21887.

The zero-days were leveraged by a cyberespionage group linked to China — tracked by Mandiant as UNC5221 — in targeted attacks for weeks before their existence came to light and Ivanti released mitigations. The list of victims included the cybersecurity agency CISA, which said the incident could affect up to 100,000 individuals.

Initially, MITRE said the attack occurred in early January, but it has now revealed that the first evidence of intrusion dates to December 31, 2023. That is when the hackers exploited the Ivanti zero-days for initial access to the NERVE network.

(Source: Security Week)

Change Healthcare cyberattack: 5 technical takeaways from UnitedHealth CEO’s testimony

Over the span of more than four hours in two Congressional hearings before the U.S. Senate Committee on Finance and the House Energy and Commerce Subcommittee on Oversight and Investigations, the UnitedHealth Group CEO Andrew Witty shared key technical details which helped illustrate why the late February attack had such a devastating impact on the healthcare industry.

Read the full article from Cybersecurity Dive to learn more about five takeaways from the CEO’s testimonies:

1. Legacy tech at Change amplified attack’s impact.
2. Stolen credentials unlocked access.
3. Incident response cavalry called in.
4. Response and recovery snags.
5. Multifactor authentication wasn’t turned on.

(Source: Cybersecurity Dive)

First responders impacted by City of Wichita cyber attack

The City of Wichita is staying tight-lipped on details about a cyberattack that led to the shutdown of some of its online systems. What is known is the City is shutting down computer systems to prevent malware spread and that’s leading to adjustments for firefighters and first responders.

The Wichita Fire Department’s Union President, Ted Bush, says firefighters know about as much as the public does. According to Bush, with some computer systems down, firefighters have to make some adjustments.

“When dispatch sends the alarm to the station for them to go to the alarm, the lights will come on automatically, and we get the tones that everybody hears,” he said. That alarm system isn’t working right now, which means firefighters will have to stay up in shifts, listening carefully to radio dispatch. Firefighters are also experiencing issues with email, so a lot of communication is being done by text.

A county official told KSN that the computer-aided dispatch (CAD) system for police is also down.

The City says it is working on getting more details on the cybersecurity incident and will post the latest information on the “alerts” page on the City’s website.

(Source: KSN.com)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.