View as a webpage / Share

Volume 24 — Issue 38 | September 19, 2024

SAFECOM releases GPS for Public Safety Location Services: Use Cases and Best Practices

Global positioning system (GPS) is a near-ubiquitous technology commonly embedded in cellular phones, laptops, vehicles, and other consumer devices to support location tracking and navigation capabilities.

In public safety communications, Project 25 (P25) is a set of standards that manufacturers can follow to ensure that their land mobile radio (LMR) equipment can interoperate (communicate) with equipment produced by other manufacturers.

P25 LMR systems use GPS capabilities to maintain situational awareness and to protect the safety and well-being of first responders as they fight fires, respond to emergencies, and perform their day-to-day duties.

The Cybersecurity and Infrastructure Security Agency’s (CISA’s) SAFECOM released a guidance document for public safety agencies, Global Positioning System (GPS) for Public Safety Location Services: Use Cases and Best Practices.

This document provides guidance to public safety practitioners tasked with providing real-time location capabilities to their agencies. The document explores real-world applications of P25 GPS, its limitations, and implementation considerations as learned through a series of interviews, a review of the P25 technical standards, and research into the current application of GPS technology for public safety.

Access SAFECOM’s “GPS for Public Safety Location Services” and other SAFECOM Project 25 resources at CISA.gov/safecom/Project-25.

(Source: CISA)

Highlights

SAFECOM releases GPS for Public Safety Location Services: Use Cases and Best Practices

Lahaina Fire Incident Analysis Report released by the Attorney General of Hawaii

Emergency Management Organizational Structures, Staffing, and Capacity Study

Webinar: Austin Fire Department and Missouri DOT present innovative tools for Traffic Incident Management (TIM)

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

Lahaina Fire Incident Analysis Report released by the Attorney General of Hawaii

On Sept. 13, Hawaii state officials released a report on the tragic fire that destroyed much of Lahaina, Hawaii, on August 8 and 9, 2023.

The Lahaina Fire Incident Analysis Report is the second in a series of three reports commissioned by the Hawaii Department of the Attorney General. The report was prepared by the Fire Safety Research Institute (FSRI), part of UL Research Institutes.

This Phase Two report focuses on the events that occurred prior to, during, and immediately following the Lahaina PM fire, including preparedness efforts, weather and its impact to infrastructure, and other fires occurring on Maui for the time period beginning at 14:55 (2:55 p.m. HST) on August 8, 2023, and concluding at 08:30 (8:30 a.m.) on August 9, 2023.

Using a systems analysis methodology, the Lahaina Fire Incident Analysis Report presents relevant background information; discusses weather, fuel, and infrastructure conditions; describes communication, incident management, fire suppression, and evacuation efforts; and details the impact of the fire on Lahaina’s built environment. It also considers these factors in the context of the National Cohesive Wildland Fire Management Strategy.

This report does not include an analysis of recovery efforts or the fire’s cause and origin, which is being investigated by the County of Maui with assistance from the United States Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF).

This report is the follow up to the Lahaina Fire Comprehensive Timeline Report released on April 17, 2024. These two reports will serve as the foundation for the Forward-Looking Report (Phase Three). The forthcoming Phase Three report will include a standards of cover (SOC) analysis to assess the capabilities of the County of Maui Fire Department, a Community Risk Assessment (CRA) to analyze natural- and human-caused risks to Maui, a community risk reduction plan to help mitigate risk, and a review of fire and building codes.

In conjunction with the release of the Phase Two report on Sept. 13, the Hawaii State Attorney General conducted a Maui Wildfire Press Conference. This press conference was livestreamed and the recording is now available on Olelo Community Media’s YouTube channel and Facebook page. The press conference covered the report’s findings and announced the public availability of Hawaii’s Investigation Documents and Media Database, containing approximately 850 gigabytes of video files, audio files, photographs, and documents relating to the August 8, 2023 Maui fires obtained by the Department of the Attorney General and FSRI in connection with this investigation.

Access the report at http://fsri.org/resource/phase-two-lahaina-fire-incident-analysis-report.

(Sources: FSRI, State of Hawaii Department of the Attorney General)

Emergency Management Organizational Structures, Staffing, and Capacity Study

The Federal Emergency Management Agency (FEMA) has partnered with Argonne National Laboratory (ANL), the International Association of Emergency Managers (IAEM), the National Emergency Management Association (NEMA), and Big City Emergency Managers (BCEM) to conduct the Emergency Management Organizational Structures, Staffing, and Capacity Study.

This study aims to provide insight on how state, local, tribal, and territorial emergency management agencies and organizations are structured and staffed, where they get their funding, and how staff time is focused across the spectrum of emergency management activities.

Key insights about the capacity and challenges facing emergency management agencies across the nation will help FEMA, IAEM, NEMA, BCEM, and others identify strategies to better support emergency management efforts and increase community resilience.

To accomplish the first part of this study, IAEM will be launching four surveys—state, local, tribal, and territorial. The state, local, and territorial surveys are now available. A tribal-specific survey will be available in the coming weeks.

If you are the chief emergency management official of a local jurisdiction such as a municipality or county and did not receive an email from IAEM or your state director with a link to the Local Emergency Management Capacity Survey, please complete the Local Emergency Management Capacity Study - Contact Information Form.

The study will include elicitation sessions to collect qualitative information and follow-up on survey responses, as well as a review of existing research and data from FEMA, emergency management associations, and other publicly available materials. Argonne National Laboratory will be conducting the analysis.

To learn more about the Emergency Management Organizational Structures, Staffing, and Capacity Study and the supporting surveys please visit: https://www.anl.gov/dis/npac/EMStudy

(Source: ANL)

Webinar: Austin Fire Department and Missouri DOT present innovative tools for Traffic Incident Management (TIM)

The National Operational Center of Excellence (NOCoE), supported by the Federal Highway Administration (FHWA), is hosting a webinar on Wednesday, September 25 at 1:30 p.m. EDT as part of its Talking TIM webinar series.

This webinar will feature information on an innovative tool and system for safer, quicker incident clearance on roadways from practitioners within the fire and transportation disciplines:

• Effective Tool for Removing Crash and Disabled Vehicles from the Roadway — Assistant Chief Thayer Smith, Austin Fire Department.
• Missouri’s Rural Automated Queue Warning System — Mark Sommerhauser, Intelligent Transportation Systems Project Manager, Missouri Department of Transportation.

All webinars in the Talking TIM series pertain to traffic incident management (TIM), with a focus on successful programs, best practices, and technology that advances the profession of TIM.

Topics covered in this webinar series are often relevant to anyone with a role in emergency dispatch, emergency medical response to traffic incidents, emergency traffic management, or anyone with an interest in ensuring first responder safety on roadways. Webinars are typically held on the fourth Wednesday of each month.

Those interested in attending the September 25 webinar can register by going to NOCoE’s Zoom registration page for the Talking TIM series and selecting the September 25 date in the registration form. You can also view recordings of past webinars in the series and sign up for updates, so you can be alerted via email when upcoming webinars are announced.

(Source: NOCoE)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA releases analysis of FY23 Risk and Vulnerability Assessments

CISA has released an analysis and infographic detailing the findings from the 143 Risk and Vulnerability Assessments (RVAs) conducted across multiple critical infrastructure sectors in fiscal year 2023 (FY23).

The analysis details a sample attack path including tactics and steps a cyber threat actor could follow to compromise an organization with weaknesses representative of those CISA observed in FY23 RVAs. The infographic highlights the most successful techniques for each tactic that RVAs documented. Both the analysis and infographic map threat actor behavior to the MITRE ATT&CK® framework.

(Source: CISA)

CISA releases plan to align operational cybersecurity priorities for federal agencies

On Sept. 16, CISA published the Federal Civilian Executive Branch (FCEB) Operational Cybersecurity Alignment (FOCAL) Plan.

As the operational lead for federal cybersecurity, CISA uses this plan to guide coordinated support and services to agencies, drive progress on a targeted set of priorities, and align collective operational defense capabilities. The end result is reducing the risk to more than 100 FCEB agencies.

The FOCAL plan is organized into five priority areas that align with agencies’ metrics and reporting requirements. Each priority has goals ranging from addressing universal cybersecurity challenges such as managing the attack surface of internet-accessible assets and bolstering cloud security to long-rage efforts including building a defensible architecture that is resilient in the face of evolving security incidents.

The FOCAL Plan was developed for FCEB agencies, but public and private sector organizations should find it useful as a roadmap to establish their own plan to bolster coordination of their enterprise security capabilities.

(Source: CISA)

Joint Cybersecurity Advisory: People’s Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations

The Federal Bureau of Investigation (FBI), Cyber National Mission Force (CNMF), and National Security Agency (NSA) assess that People’s Republic of China (PRC)-linked cyber actors have compromised thousands of Internet-connected devices, including small office/home office (SOHO) routers, firewalls, network-attached storage (NAS) and Internet of Things (IoT) devices with the goal of creating a network of compromised nodes (a “botnet”) positioned for malicious activity. The actors may then use the botnet as a proxy to conceal their identities while deploying distributed denial of service (DDoS) attacks or compromising targeted U.S. networks.

FBI, CNMF, NSA, and allied partners are releasing this Joint Cyber Security Advisory to highlight the threat posed by these actors and their botnet activity and to encourage exposed device vendors, owners, and operators to update and secure their devices from being compromised and joining the botnet. Network defenders are advised to follow the guidance in the mitigations section to protect against the PRC-linked cyber actors’ botnet activity. Cyber security companies can also leverage the information in this advisory to assist with identifying malicious activity and reducing the number of devices present in botnets worldwide.

Read the full CSA on the FBI’s Internet Crime Complaint Center (IC3).

(Source: FBI IC3)

FBI and CISA release joint PSA, Just So You Know: False Claims of Hacked Voter Information Likely Intended to Sow Distrust of U.S. Elections

On Sept. 12, as part of their public service announcement (PSA) series to put potential election day cyber related disruptions during the 2024 election cycle into context for the American people, the Federal Bureau of Investigation (FBI) and CISA jointly issued the Just So You Know: False Claims of Hacked Voter Information Likely Intended to Sow Distrust of U.S. Elections PSA to raise awareness of attempts to undermine public confidence in the security of U.S. election infrastructure through the spread of disinformation falsely claiming that cyberattacks compromised U.S. voter registration databases.

(Source: CISA)

CISA and FBI release Secure by Design Alert on Eliminating Cross-Site Scripting Vulnerabilities

On Sept. 17, CISA and FBI released a Secure by Design Alert, Eliminating Cross-Site Scripting Vulnerabilities, as a part of their ongoing effort to reduce the prevalence of vulnerability classes at scale. Vulnerabilities like cross-site scripting (XSS) continue to appear in software, enabling threat actors to exploit them. However, cross-site scripting vulnerabilities are preventable and should not be present in software products.

CISA and FBI urge CEOs and other business leaders at technology manufacturers to direct their technical leaders/teams to review past instances of these defects and create a strategic plan to prevent them in the future.

(Source: CISA)

The mystery of Hezbollah’s deadly exploding pagers

An unprecedented wave of small blasts erupted across Lebanon on Tuesday (Sept. 17), killing at least 11 people and injuring nearly 2,800 after the wireless pagers of Hezbollah members began exploding, according to local officials.

It was not immediately clear how the attack was carried out. Initial reports on social media speculated that the pager explosions might have been triggered by digital hacking that caused the pagers’ batteries to overheat and explode. One report by the Lebanese Broadcast Corporation described preliminary reporting about a possible cyberattack. “According to information obtained by LBCI, initial reports suggest the pager server was compromised, leading to the installation of a script that caused an overload. This likely resulted in the overheating of the lithium battery, which then exploded.”

(Source: Wired)

More than 70K Wichita police records compromised from massive cyberattack

Tens of thousands of police records were compromised in a massive cyberattack that brought the City of Wichita’s network to its knees. The attack that happened in May brought city systems offline for nearly a month, from the library to public safety.

The Russian hacker group, Lockbit, claimed responsibility for the attack. The big question following the crime: “What did they get?”

“Only our law enforcement data was impacted,” said City of Wichita Chief Information Officer Mike Mayta. The city said about 77,000 police cases were breached, including incident and arrest reports, along with the information on them. That information included names, birthdates, social security numbers and driver’s license numbers.

As far as communicating with the hackers, the city said it didn’t. Insurance is covering most of the cost of recovering from the attack. An outside consulting group is assisting in the recovery response. The city is focusing on a “zero trust” policy when it comes to its network and keeping data secure.

(Source: 12 News KWCH – Wichita, Kansas)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.