|
Volume 24 — Issue 27 | July 5, 2024 |
|
|
On the evening of February 3, 2023, an eastbound Norfolk Southern Railway freight train derailed 38 railcars in East Palestine, Ohio. The incident received national media attention due to public health concerns about the hazardous materials release. It also drew attention to the importance of getting real-time information to first responders about the hazards at the scene.
The National Transportation Safety Board (NTSB) has been investigating the East Palestine incident over the past year. On June 25, the NTSB conducted its final board meeting related to this investigation. The purpose of this public hearing was to vote on the final findings, probable cause, and recommendations that will be included in the final report on the NTSB’s investigation.
A recording of the NTSB’s final board meeting is now available on the NTSB’s YouTube channel. It begins with a presentation summarizing the NTSB’s findings and recommendations. This presentation is followed by a lengthy deliberation among NTSB members and investigators over the draft report. The NTSB’s final report is not yet released, but the NTSB has just released a Board Meeting Summary, which serves as a written synopsis of the forthcoming report.
One of the NTSB’s final recommendations was for the Pipeline and Hazardous Materials Safety Administration (PHMSA) to require railroads to immediately provide emergency responders with train consist information after a hazardous materials incident occurs on a railroad.
Coinciding with the NTSB’s final hearing, on June 24, PHMSA announced the publication of its final rule, Hazardous Materials: FAST Act Requirements for Real-Time Train Consist Information. This final rule requires railroads to proactively provide first responders with real-time, electronic information about rail hazmat shipments to the primary Public Safety Answering Point (for example, a 9-1-1 call center or emergency responder phone app such as the AskRail Mobile App) as soon as the railroad is aware of an accident or incident involving hazardous materials.
The NTSB has additional recommendations for firefighters and emergency management agencies who responded to this incident. The NTSB recommended that volunteer firefighters are trained to meet the NFPA 1010 standard for professional firefighters and that emergency management agencies share the train consist with the incident commander and all appropriate response agencies as soon as it is received from the railroad.
The NTSB’s report summary contains several additional recommendations related to hazardous materials response to incidents on railroads. Access the report summary and all related information on the NTSB’s investigation page for the East Palestine, Ohio, incident. Access PHMSA’s final rule in the Federal Register.
(Sources: NTSB, PHMSA)
|
|
|
The Department of Homeland Security (DHS) Science and Technology Directorate (S&T) is hosting a virtual showcase of new technologies developed for first responders by small business innovators as part of DHS’ Small Business Innovation Research (SBIR) program.
The SBIR First Responder Showcase 2024 is a two-day webinar series scheduled for July 9 and 10, 2024, from 1-3 p.m. EDT.
All of the technologies in the showcase are focused on keeping first responders, emergency managers, and incident commanders better protected, connected, and prepared to safeguard the homeland and respond to disasters.
The ten innovations that will be presented during the showcase cover a wide variety of capabilities, including detection and containment of infectious diseases in vehicles, detection of biological hazards and drugs, next generation emergency communications security and interoperability, responder tracking technologies, and more.
Visit DHS S&T’s SBIR First Responder Showcase 2024 page to access the full agenda and register.
(Source: DHS S&T)
Because of the growing concerns surrounding the use of fossil fuels and a greater demand for a cleaner, more efficient, and more resilient energy grid, the use of energy storage systems, or ESS, has increased dramatically in the past decade. Renewable sources of energy such as solar and wind power are intermittent, and so storage becomes a key factor in supplying reliable energy. ESS also help meet energy demands during peak times and can supply backup power during natural disasters and other emergencies.
However, the rise in the number of ESS installations requires the need for a heightened understanding of the hazards involved and more extensive measures to reduce the risks.
The National Fire Protection Association (NFPA) released an Energy Storage Systems Safety Fact Sheet to address this.
This 3-page fact sheet first provides an overview of what ESS are, their advantages, hazards, and common failure modes. It then covers tips for designers and installers to help keep people and property safe; a checklist for the authority having jurisdiction (AHJ) who may need to issue permits for use of ESS; and considerations for the fire service who have ESS installations within their jurisdictions. The fact sheet provides considerations for both pre-incident and emergency operations planning for the fire service, with citations to relevant NFPA standards.
The ESS Fact Sheet can be accessed free of charge at NFPA.org after completing a brief questionnaire.
(Source: NFPA)
The Cybersecurity and Infrastructure Security Agency (CISA) will host a webinar on Wednesday, July 24, 2024, at 1 p.m. EDT, Leveraging Survey Data for Collaborative Initiatives and National Planning. This webinar is part of CISA’s National Emergency Communications Plan (NECP) webinar series.
This webinar will introduce participants to the SAFECOM Nationwide Survey (SNS), a valuable tool for shaping national emergency communications planning. The SNS provides a comprehensive view of the current state of emergency communications across the nation and identifies areas for improvement. By leveraging insights from large national surveys like the SNS, public safety and emergency communications entities can better understand the changing dynamics of emergency communications and align their strategies with broader national goals.
The NECP emphasizes the critical role of strategic teambuilding in achieving resilient, secure, and interoperable emergency communications. This webinar will highlight the vital importance of stakeholder involvement in this teambuilding effort by exploring how the SNS was designed and how its findings inform national planning and support evidence-based decision-making for public safety leaders across the nation.
Visit CISA’s page for this webinar event to learn more. Advanced registration is not required to participate. Mark your calendar and join CISA’s virtual meeting room for this event at the scheduled time.
For additional instructions on how to join and more information on the NECP webinar series, visit https://www.cisa.gov/necp-webinars.
(Source: CISA)
|
|
How to get involved in Cybersecurity Awareness Month 2024
October 2024 marks the twenty-first Cybersecurity Awareness Month, and CISA needs your help to amplify messaging, not only throughout the month, but also year-round. The enduring Cybersecurity Awareness Month theme, Secure Our World, reminds us that there are simple behavior changes that will make us all MUCH SAFER while online or using connected devices:
- Using strong passwords and a password manager.
- Turning on multi-factor authentication (MFA).
- Recognizing and reporting phishing.
- Updating software.
Join CISA and the National Cybersecurity Alliance for a webinar on Tuesday, July 16, from 2-3pm EDT, to learn how you and your organization can get involved. To register, click here.
Also, if you would like to request a CISA speaker for your Cybersecurity Awareness Month event, please complete a CISA Speaker Request Form and then email it as an attachment to cisa.speakers@cisa.dhs.gov no later than Friday, August 30, 2024.
Please contact CISA at AwarenessCampaigns@cisa.dhs.gov if you have any questions or concerns.
(Sources: CISA, National Cybersecurity Alliance)
Progress Software releases security bulletin for MOVEit Transfer
Progress Software released a security bulletin to address a vulnerability in MOVEit Transfer. A cyber threat actor could exploit this vulnerability to take control of an affected system.
Users and administrators are encouraged to review the following bulletin and apply the necessary updates:
(Source: CISA)
|
|
HC3 Sector Alert: Critical MOVEit Vulnerabilities Expose Health Sector to Data Breaches
A critical vulnerability has been identified in MOVEit, a common file transfer platform utilized in the health sector. This vulnerability exposes healthcare organizations to cyberattacks, especially ransomware and data breaches. Progress, the company that owns and operates the MOVEit platform, has released patches to fix this vulnerability. However, exploit code is also available to the public, and this vulnerability is being actively targeted by cyber threat actors. All healthcare organizations are strongly urged to identify any vulnerable instances of MOVEit that exist in their infrastructure and patch them as a high priority.
Read the full Sector Alert from the Department of Health and Human Services (HHS), Health Sector Cybersecurity Coordination Center (HC3), for an analysis of these vulnerabilities, patches, mitigations, and workarounds.
(Source: HHS HC3)
HC3: Seashell Blizzard Threat Actor Profile
Seashell Blizzard (also known as APT44 and Sandworm) is a cyber threat group believed to be associated with Russian intelligence agencies, particularly with Unit 74455, the Main Centre for Special Technologies within the Main Directorate of the General Staff of the Armed Forces of the Russian Federation. The group has been operating since at least 2009 and has been implicated in numerous high-profile cyberattacks targeting governments, critical infrastructure, and organizations across the globe. During the ongoing conflict in Ukraine, much of the group’s focus has been aimed toward disrupting Ukrainian operations and trying to obtain battlefield advantages; however, they have displayed a willingness and capability to shift this focus to benefit Russia’s broader national interests. Their tactics include sophisticated malware deployment, spear phishing campaigns, and exploitation of software vulnerabilities. Seashell Blizzard will continue to pose as a threat to cyber operations globally, and should be considered a significant threat to the Healthcare and Public Health (HPH) sector.
Read the full Threat Actor Profile from HHS HC3 for an in-depth report on targeting operations; history of past campaigns; tactics, techniques, procedures; and indicators of compromise.
(Source: HHS HC3)
The US intelligence community is embracing generative AI
The CIA’s director of Artificial Intelligence Innovation, Lakshmi Raman, said U.S. intelligence analysts currently use generative AI in classified settings for search and discovery assistance, writing assistance, ideation, brainstorming and helping generate counter arguments. These novel uses of generative AI build on existing capabilities within intelligence agencies that date back more than a decade, including human language translation and transcription and data processing.
As the functional manager for the intelligence community’s open-source data collection, Raman said the CIA is turning to generative AI to keep pace with, for example, “all of the news stories that come in every minute of every day from around the world.” AI, Raman said, helps intelligence analysts comb through vast amounts of data to pull out insights that can inform policymakers. In a giant haystack, AI helps pinpoint the needle.
Because security requirements are so rigorous within the intelligence community, far fewer generative AI tools are secure enough to be used across its enterprise than in the commercial space. Intelligence analysts can’t, for example, access a commercial generative AI tool like ChatGPT in a sensitive compartmented information facility — pronounced "skiff" — where some of their most sensitive work is performed.
Yet a growing number of generative AI tools have met those standards and are already impacting missions.
(Source: NextGov)
|
|
The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures. |
|
|
Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.
Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.
Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.
|
|
|
|
|
