View as a webpage / Share

Volume 24 — Issue 25 | June 20, 2024

Become a Gold Helmet Department: Join the National Firefighter Registry for Cancer

In 2018, Congress passed the Firefighter Cancer Registry Act, which directed the National Institute of Occupational Safety and Health (NIOSH) to develop a registry to study cancer among firefighters.

NIOSH launched the National Firefighter Registry (NFR) for Cancer in April 2023. By matching information provided by participating NFR firefighters with cancer diagnosis information from state cancer registries, NIOSH researchers will be able to study the relationship between firefighting and cancer outcomes over time.

Registration is open to all firefighters in the United States – whether paid or volunteer, active or retired, with or without cancer, and no matter their length of service. Participation is voluntary.

As of April 2024, more than 12,000 firefighters have enrolled. NIOSH hopes this number will continue to grow so that the dataset in the NFR will reflect the diversity of our nation’s firefighters and will provide stronger evidence to improve cancer prevention measures.

NIOSH has just launched an initiative to recognize fire departments who achieve high participation rates in the NFR among their active firefighters: The Gold Helmet Challenge. Any department who enrolls 50% of their active firefighters or more than 300 active firefighters in the NFR will be recognized as a Gold Helmet Department. Gold Helmet Departments receive a certificate, web badge, and social media posts to share.

NIOSH is now inviting all fire departments to the Gold Helmet Challenge. Visit NIOSH’s Gold Helmet Department page to learn more about how to sign up. Use #NFRGoldHelmet to share the Gold Helmet Challenge on social media.

Visit CDC.gov/NFR for communication materials to promote the NFR in your department. Join the NFR at NFR.CDC.gov.

(Source: NIOSH)

Highlights

Become a Gold Helmet Department: Join the National Firefighter Registry for Cancer

CISA is updating the National Cyber Incident Response Plan, listening session June 27

ASHRAE Guideline 44: Protecting Building Occupants from Smoke During Wildfire and Prescribed Burn Events, now open for comment

National Counterterrorism Innovation, Technology, and Education Center’s ENVISION24 annual conference, livestream June 26-27

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

CISA is updating the National Cyber Incident Response Plan, listening session June 27

The Cybersecurity and Infrastructure Security Agency (CISA) is updating the National Cyber Incident Response Plan (NCIRP) 2024, the primary strategic framework for coordinating with the federal sector in response to significant cyber incidents.

In the spirit of whole of community response and collaborative cyber defense, CISA is inviting stakeholders from across public and private sectors, academia, and individual researchers, and experts in cybersecurity and response, to attend a series of three virtual NCIRP 2024 listening sessions.

The intent of these sessions is to hear feedback about the existing NCIRP and any experience with incident response coordination with the federal government more broadly. A draft of the NCIRP 2024 is being prepared and will be posted to CISA’s NCIRP webpage for public comment this summer. Perspectives gathered during the listening sessions will inform the update which will be published at the end of calendar year 2024.

CISA is releasing a newsletter series, New and Noteworthy, to support the NCIRP 2024 update. Each newsletter will keep the public informed on planning processes, plan development, and stakeholder engagement efforts in support of the NCIRP 2024.

The first listening session was held on May 8, 2024. During this session, CISA addressed the following topics:

• Overview of the NCIRP and the process for updating the 2024 Plan.
• The role of Information Sharing and Analysis Centers (ISACs).
• The integration of state, local, tribal, and territorial (SLTT) entities into cyber incident response.
• The role of state fusion centers in the information sharing process
• Cyber incident reporting, specifically, how to define who an “asset owner” is and who should be contacted during a significant cyber incident.

CISA has just announced its second listening session, which will be held on Thursday, June 27, 2024, from 1-2 p.m. EDT. See CISA’s second issue of New and Noteworthy to learn more and register.

For more information on the NCIRP, visit CISA’s NCIRP page.

(Source: CISA)

ASHRAE Guideline 44: Protecting Building Occupants from Smoke During Wildfire and Prescribed Burn Events, now open for comment

In recent years, wildland fires have increased in number of fires per year, severity, and duration of each event.

All fires generate smoke pollution, but large landscape and wildland fires often cause episodes of severely degraded air quality that last for days, weeks, or months. The smoke produced from wildland fires can have a significant negative impact on ambient air quality, which can negatively impact health.

Early in 2020, EPA’s Office of Air and Radiation (OAR) and Office of Research and Development (ORD) worked with the National Institute of Standards and Technology (NIST) to propose that ASHRAE (formerly the American Society of Heating, Refrigerating and Air Conditioning Engineers) develop a guideline for protecting building occupants from smoke during wildfire and prescribed burn events.

ASHRAE formed its Guideline Project Committee (GPC) 44 in mid-2020. Although Guideline 44P, “Protecting Building Occupants from Smoke During Wildfire and Prescribed Burn Events,” was not due to be completed for several years, a subset of this committee developed interim guidance in the fall of 2020 because of the urgent need to protect building occupants from infiltration of wildfire smoke, especially during the COVID-19 pandemic.

The following interim guidance was provided by ASHRAE and the EPA ahead of the 2021 wildfire season:

• ASHRAE, Planning Framework for Protecting Commercial Building Occupants from Smoke During Wildfire Events.
• ASHRAE Journal, Protecting Commercial Building Occupants from Smoke during Wildfire and Prescribed Burn Events.
• EPA flyer, Recommendations for Reducing Wildfire Smoke in Commercial Buildings and Schools.

This month, ASHRAE’s GPC 44 released its second public review draft of Guideline 44, “Protecting Building Occupants from Smoke During Wildfire and Prescribed Burn Events” for public review and comment.

Guideline 44P is the first of its kind to provide recommendations to help building owners and managers prepare and respond to smoke. It was primarily developed to address episodes of severe wildfire smoke, but it can be applied to smoke from all types of fires, including prescribed burns. The guideline provides comprehensive information for building design, commissioning, operation, and maintenance for commercial buildings; institutional buildings, including healthcare facilities; and multi-unit residential buildings, as well as dedicated spaces within these building types intended for temporary human occupancy during a wildfire or prescribed burn smoke event.

This guidance is part of a resource collection at EPA on Wildfires and Indoor Air Quality in Schools and Commercial Buildings, which provides several resources for building owners and managers, school facility managers, public health officials, and emergency managers to reduce smoke concentrations in buildings.

Access the Second Public Review Draft of Guideline 44P at ASHRAE.org. Comments can be submitted via ASHRAE’s Online Comment Database. The comment period closes on Monday, July 29, 2024.

(Sources: EPA, ASHRAE)

National Counterterrorism Innovation, Technology, and Education Center’s ENVISION24 annual conference, livestream June 26-27

The National Counterterrorism Innovation, Technology, and Education Center (NCITE) is the Department of Homeland Security's Center of Excellence for terrorism prevention and counterterrorism research. Based at the University of Nebraska at Omaha (UNO), the NCITE consortium includes more than 50 expert researchers from partner institutions across the U.S. and Europe.

NCITE will hold its annual ENVISION conference on June 26 and 27, 2024, in Omaha, Nebraska. While the in-person conference is invite-only, presentations will be streamed online throughout the day on June 26 and 27. The livestreams of the conference sessions are free to attend and open to the public after completing a brief registration form.

This year’s conference, ENVISION24, will explore topics such as changes in terrorist behaviors, extremist use of emerging technology, international threat assessment tools, and more.

Visit NCITE’s website to learn more about the speakers and see the full conference agenda. Complete the registration form to stream presentations from NCITE's annual conference live online via Zoom. Livestreamed sessions will run from 10:30 a.m. to 5 p.m. EDT on June 26 and from 10:00 a.m. to about 3:45 p.m. EDT on June 27.

(Source: NCITE)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA and partners release guidance for modern approaches to network access security

On June 18, CISA, the Federal Bureau of Investigation (FBI), and international partners released the guidance, Modern Approaches to Network Access Security.

The guidance urges business owners of all sizes to move toward more robust security solutions—such as Zero Trust, Secure Service Edge (SSE), and Secure Access Service Edge (SASE)—that provide greater visibility of network activity. Additionally, this guidance helps organizations to better understand the vulnerabilities, threats, and practices associated with traditional remote access and VPN deployment, as well as the inherent business risk posed to an organization’s network by remote access misconfiguration.

CISA and its partners encourage leaders to review the guidance to help with the prioritization and protection of remote computing environments.

(Source: CISA)

FBI Miami Field Office and DOJ join European partners in major takedown of critical online infrastructure to disrupt ISIS propaganda

Ongoing coordination between judicial and law enforcement authorities across Europe and the United States resulted in the dismantlement of critical online infrastructure of platforms and websites used for the Islamic State of Iraq and al-Sham’s (ISIS) propagation of terrorist content. Dozens of servers supporting ISIS’s online propaganda infrastructure were taken down earlier this week in the United States, Germany, the Netherlands, and Iceland.

Spanish authorities arrested nine individuals with alleged ties to the use of the disrupted servers.

The disrupted servers supported the I’lam Media Foundation, and other terrorist websites. I’lam Media Foundation, although not formally recognized in ISIS’s official platform catalog, serves as a primary conduit for both “official” content endorsed by ISIS and “unofficial” content created by sympathizers worldwide. I’lam Media Foundation’s online presence boasts a formidable multilingual capability, disseminating ISIS ideologies and directives in over 30 languages, including Spanish, Arabic, English, French, Urdu, and German, catering to a global audience.

(Source: FBI Miami)

GAO: High-Risk Series: Urgent Action Needed to Address Critical Cybersecurity Challenges Facing the Nation

Risks to our nation's essential technology systems are increasing. Threats to these systems can come from a variety of sources and vary in terms of the types and capabilities of the actors, their willingness to act, and their motives.

Federal agencies reported 30,659 information security incidents to DHS’ United States Computer Emergency Readiness Team in fiscal year 2022. Such attacks could result in serious harm to human safety, national security, the environment, and the economy.

The White House, through the Office of the National Cyber Director, has taken important steps in providing cybersecurity leadership, including developing and publicly releasing the National Cybersecurity Strategy and its accompanying implementation plan.

However, in February 2024, the Government Accountability Office (GAO) reported that the strategy and implementation plan addressed some, but not all, of the desirable characteristics of a national strategy. In particular, the strategy and implementation plan did not fully incorporate outcome-oriented performance measures and estimated resources and costs.

Read the full report from GAO to learn more.

(Source: GAO)

NCCoE releases initial public draft of Cybersecurity for the Water and Wastewater Sector

NIST’s National Cybersecurity Center of Excellence (NCCoE) has released for public comment a draft of Cybersecurity for the Water and Wastewater Sector: Build Architecture, Operational Technologies Remote Access. The comment period is open through July 15, 2024.

This Technical Note describes the product agnostic remote access reference architectures and presents three remote access example solutions the NCCoE plans to demonstrate as part of the Cybersecurity for the Water and Wastewater Sector: A Practical Reference Design for Mitigating Cyber Risk in Water and Wastewater Systems project. The Technical Note presents a traditional on-premises remote access reference architecture and two example solutions: one for medium to large water and wastewater systems (WWS) and one for very small to small WWS. A cloud-based remote access reference architecture and example solution are also described. 

The NCCoE first plans to address the remote access scenario and describing architectures and example solutions which allow authorized access to a water or wastewater utility’s Operational Technology (OT) assets. Subsequent publications will address the other identified risk scenarios and solutions.

Visit NCCoE’s Securing Water and Wastewater Utilities page to learn more about this project and submit comments.

(Source: NIST)

Cleveland City Hall to reopen Thursday following cyberattack, city says it won't pay ransomware attackers

The city of Cleveland has announced that "after addressing the recent cyberattack" on its systems, City Hall will "resume select operations" this Thursday starting at noon.

The reopening comes after a cyber incident impacted the city's IT operations for most of last week. Officials later deemed the incident to be a ransomware attack

In a statement given to 3News on Wednesday, Cleveland Chief Communications Officer Sarah Johnson says the city does not intend to pay off the ransom hackers.

According to a release from the Bibb administration, available services at the reopened City Hall will include Building & Housing, Assessments/Licenses, and Vital Statistics. The city adds that "civil service examinations are operating normally and regular meetings are being held unless otherwise notified."

WKYC is not naming the cyber gang, but according to the FBI, the group has previously used ransomware to encrypt and lock victims' files before demanding a ransom in exchange for the decryption key. The cyber gang has been blamed for multiple attacks on U.S. businesses and government entities.

(Source: 3News, WKYC Studios – Cleveland)

Officials blame firewall malfunction for 911 outage

Massachusetts officials released an explanation Wednesday for the 911 outage that impacted the statewide system this week.

An investigation found that the disruption was caused by a firewall that prevented 911 dispatch centers from receiving calls, according to the State 911 Department. Typically, firewalls are meant to protect against cyberattacks. The specific reasons that the firewall malfunctioned in this way are still being reviewed. The outage was not caused by any sort of cyberattack or hack, officials said.

The system was down from about 1:15 p.m. to 3:15 p.m. on Tuesday, causing officials to hastily communicate to residents other options for reporting emergencies like using red call boxes or the administrative phone numbers for police and fire stations. A statewide emergency alert was also sent to residents’ phones.

(Source: Boston.com)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.