View as a webpage / Share

Volume 24 — Issue 39 | September 26, 2024

OSHA releases statement on its emergency response rulemaking and volunteer emergency responders, hearing on Nov. 12

The Department of Labor’s Occupational Safety and Health Administration (OSHA) released a statement regarding its emergency response rulemaking and volunteer emergency responders on Sept. 17.

On February 5, 2024, OSHA published the Notice of Proposed Rulemaking (NPRM), Emergency Response Standard. While OSHA does not directly cover volunteer emergency responders, some OSHA State Plans treat volunteers as employees under state law, which is how a federal proposed standard could affect volunteer responders in those State Plan states. OSHA requested commenters' input on whether the proposed rule would be feasible for these entities. OSHA received that input during the extended comment period from February 5, 2024, through July 22, 2024. 

The comments OSHA received from many stakeholders, including volunteer emergency responders, fire chiefs, trade organizations, and members of Congress, raise serious concerns about the economic feasibility of the proposed standard for volunteer fire departments. OSHA states it is committed to taking steps in its final standard to minimize detrimental effects on volunteer fire departments. If supported by the record, this may include excluding voluntary emergency response organizations entirely based on these feasibility concerns.

While the initial comment period has closed, OSHA strongly encourages stakeholders to continue to provide information and data relevant to this question at the public rulemaking hearing scheduled to begin on November 12, 2024, and during the post-hearing comment period. Instructions for how to participate in the hearing are available on the Emergency Response rulemaking webpage, www.osha.gov/emergency-response/rulemaking.

Read OSHA’s full statement at OSHA.gov.

(Source: OSHA)

Highlights

OSHA releases statement on its emergency response rulemaking and volunteer emergency responders, hearing on Nov. 12

FEMA releases “20 Years of NIMS” report

JCAT releases First Responder’s Toolbox, “Enhancing Bystander Reporting to Prevent Terrorism”

Updates for EMS on the latest Mpox outbreak, webinar Oct. 2

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

FEMA releases “20 Years of NIMS” report

Earlier this week, the Federal Emergency Management Agency (FEMA) announced the release of a report, 20 Years of the National Incident Management System.

The National Incident Management System (NIMS) was established in 2004 to provide stakeholders across the whole community with the shared vocabulary, systems and processes to successfully deliver the capabilities described in the National Preparedness System.

The NIMS community includes emergency responders and other emergency management personnel, federal partners, non-governmental organizations, the private sector, and elected and appointed officials responsible for making decisions about incidents.

Before NIMS, the emergency response community had long recognized the need for standardized incident management guidance, particularly when responding to major incidents that required collaboration among multiple organizations and jurisdictions. Key incidents such as Southern California’s 1970 wildfire season, the terrorist attacks on September 11, 2001 (9/11), and Hurricane Katrina in 2005, served as pivotal points for the nation to both recognize and reaffirm the need for a shared multijurisdictional, multiagency incident management system.

Since 2004, NIMS evolved through numerous iterations of guidance, resources, and tools. Now, more than 20 years after the tragic terrorist attacks on September 11th that drove the creation of NIMS, the threat of human-induced disasters also has only become more complex. As these hazards and threats evolve, the NIMS model continues to offer communities a flexible system for unified response to incidents of any type, level, or scope.

The 35-page report highlights the evolution of NIMS and showcases success stories from across the nation. The report can be accessed at: https://www.fema.gov/emergency-managers/nims

(Source: FEMA)

JCAT releases First Responder’s Toolbox, “Enhancing Bystander Reporting to Prevent Terrorism”

Each year on Sept. 25, the Department of Homeland Security (DHS) observes #SeeSayDay, the If You See Something, Say Something® campaign’s annual national awareness day. This year’s theme, “Spot the Signs. Report the Activity,” highlights the crucial role of public vigilance in national security and counter-terrorism efforts within the current threat environment. The #SeeSayDay call-to-action urges individuals to spot and report suspicious activity to help prevent terrorism-related crime – on September 25, and year-round.

For first responders, the National Counterterrorism Center’s Joint Counterterrorism Assessment Team (JCAT) developed a First Responder’s Toolbox, Enhancing Bystander Reporting to Prevent Terrorism, released earlier this month.

Bystanders enhance terrorism prevention when they recognize, intervene, and report concerning behaviors and indicators to authorities. However, some bystanders face barriers to reporting these indicators. This First Responder’s Toolbox highlights considerations for engaging with bystanders to overcome those barriers. It expands on a First Responder’s Toolbox, Bystanders Are Key to Countering Terrorism, that was released in 2020.

Access these First Responder’s Toolboxes on ODNI.gov, within the JCAT First Responder Toolbox library.

(Source: JCAT)

Updates for EMS on the latest Mpox outbreak, webinar Oct. 2

One of the latest threats to public health is Mpox—a rare but potentially serious viral disease that has emerged in countries where it’s not normally found, including the United States. To ensure early detection and isolation of those affected, emergency medical services (EMS) clinicians must understand the disease and be on alert for signs of infection.

EMS clinicians have been transporting patients with suspicion of Mpox since July 2022, when the World Health Organization declared the first Public Health Emergency of International Concern (PHEIC) for Mpox. The 2022 PHEIC was declared due to a global outbreak of the Clade IIb subtype of Mpox. That PHEIC was declared over in May 2023 after there had been a sustained decline in global cases, although this Clade of Mpox is still actively being spread through human-to-human contact in the United States.

In December 2023, the Centers for Disease Prevention and Control (CDC) issued a health advisory about the emergence of a new clade of Mpox, Clade 1, which was spreading via human-to-human contact in the Democratic Republic of the Congo (DRC) with potential to spread to the United States through anyone who may have recently traveled to DRC.

On Aug. 7, 2024, the CDC released an update to its December 2023 Health Advisory, warning that, while clade I Mpox is endemic, or naturally occurring, in DRC, the current outbreak is more widespread than any previous DRC outbreak and has resulted in clade I mpox transmission to some neighboring countries. In late July 2024, Burundi, Rwanda, and Uganda, which sit on the eastern border of DRC, reported confirmed cases of mpox, with some cases having linkages to DRC. Since January 2023, over 22,000 suspected cases and more than 1,200 suspected deaths were reported, marking a significant increase compared to previous years.

On Aug. 8, 2024, the National Emerging Special Pathogens Training and Education Center (NETEC) released a situation report about the latest Mpox spread in Africa.

On Aug. 14, 2024, the WHO declared a second PHEIC for Mpox due to concern about the continued rapid spread of this new virus strain in DRC, clade 1b, into countries neighboring the DRC, mainly through sexual networks.

Earlier this week, on Sept. 23, 2024, the CDC issued another Health Alert Network (HAN) Health Update on the latest Mpox outbreak,. The CDC reports that states continues to be affected by the ongoing global outbreak of clade II mpox that began in 2022, but that no domestic cases of clade I mpox have been identified in the United States at this time.

On Sept. 24, the U.S. Department of Health and Human Services (HHS), through the Administration for Strategic Preparedness and Response (ASPR), announced actions to increase the supply of mpox vaccine, supporting the U.S. Government commitment to make over a million combined doses of mpox vaccines available to the global mpox response. This is the largest international donation of the JYNNEOS mpox vaccine to date, which just received regulatory approval from WHO last week.

The National Highway Traffic Safety Administration’s Office of EMS will hold a webinar in its EMS Focus series, Navigating Mpox: Latest Updates and Strategies for EMS Clinicians. The webinar is scheduled for Wednesday, Oct. 2 at 1 p.m. EDT.

The webinar will explore the latest updates on the Mpox outbreak and its impact on EMS operations. Panelists will review current epidemiological data on the new respiratory transmissible clade in Africa, along with essential guidance for emergency responders.

Webinar panelists will also discuss:

• Vaccine eligibility.
• Response and strategies to prevent further spread.
• Available treatments and therapeutics.

Register for this webinar on Zoom.

(Sources: NHTSA OEMS, CDC, WHO)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA warns of hurricane-related scams

As Hurricane Helene approaches, the Cybersecurity and Infrastructure Security Agency (CISA) urges users to remain on alert for potential malicious cyber activity. Fraudulent emails and social media messages—often containing malicious links or attachments—are common after major natural disasters. Exercise caution in handling emails with hurricane-related subject lines, attachments, or hyperlinks. In addition, be wary of social media pleas, texts, or door-to-door solicitations relating to severe weather events.

Read CISA’s full Alert for resources to avoid falling victim to malicious cyber activity.

(Source: CISA)

Threat actors continue to exploit OT/ICS through unsophisticated means

CISA continues to respond to active exploitation of internet-accessible operational technology (OT) and industrial control systems (ICS) devices, including those in the Water and Wastewater Systems (WWS) Sector. Exposed and vulnerable OT/ICS systems may allow cyber threat actors to use default credentials, conduct brute force attacks, or use other unsophisticated methods to access these devices and cause harm.   

CISA urges OT/ICS operators in critical infrastructure sectors to apply the recommendations listed in Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity to defend against this activity.

(Source: CISA)

Kansas water plant pivots to analog after cyber event

Arkansas City — population 12,000, a two-hour drive north of Oklahoma City — sits at the junction of the Walnut and Arkansas Rivers, the latter of which supplies the town's drinking water. A notice from the city's Environmental Services Administration revealed that on Sept. 22, its treatment facility experienced a cybersecurity incident. Authorities were contacted and precautionary measures taken. Most notably, the facility moved to fully manual operations — a temporary decision made "out of caution," according to the city manager.

Industrial control systems have long struggled to match old, legacy equipment to the demands of modern-day cybersecurity. Less often spoken of is the opposite problem: newer facilities designed with greater connectivity in mind, which introduce attack surfaces that the older machines didn't have.

The new 5.4 million-gallon-per-day water treatment facility in Arkansas City opened in February 2018. It cost $22 million to build, and sports advanced technology estimated to save the city up to 20% on operational and maintenance costs. The exact nature of its cybersecurity posture is unknown.

(Source: Dark Reading)

Ban sought for Chinese, Russian software and hardware used in autonomous vehicles on US roads

The Commerce Department said Monday it’s seeking a ban on the sale of connected and autonomous vehicles in the U.S. that are equipped with Chinese and Russian software and hardware with the stated goal of protecting national security and U.S. drivers.

The proposed rule would prohibit the import and sale of vehicles with Russia and China-manufactured software and hardware that would allow the vehicle to communicate externally through Bluetooth, cellular, satellite or Wi-Fi modules. It would also prohibit the sale or import of software components made in Russia or the People’s Republic of China that collectively allow a highly autonomous vehicle to operate without a driver behind the wheel. The ban would include vehicles made in the U.S. using Chinese and Russian technology.

The proposed rule would apply to all vehicles, but would exclude those not used on public roads, such as agricultural or mining vehicles.

Vehicles are now “mobility platforms” that monitor driver and passenger behavior and track their surroundings. In extreme situations, a foreign adversary could shut down or take simultaneous control of multiple vehicles operating in the United States, causing crashes and blocking roads, the U.S. Secretary of Commerce told reporters on a call Sunday.

(Source: Security Week)

MFA your way: Three paths to CJIS compliance

In April 2021, the Washington D.C. Metropolitan Police Department suffered a massive data leak when hackers breached its network in a ransomware attack. The attackers claimed to have stolen more than 250 GB of data, which included hundreds of intelligence reports—some of which they began to release on the dark web.

Attacks like this are a law enforcement agency’s worst nightmare, and they’re frighteningly common. In 2023, ransomware attacks were up more than 95% over the previous year, with targets that included the Dallas Police Department, the Stanford University Department of Public Safety and several U.S. government agencies.

The FBI’s latest CJIS Security Policy, which requires organizations to implement multifactor authentication (MFA) across all systems and applications that store and access Criminal Justice Information (CJI), attempts to address this new landscape. The intention is clear: Make sure that CJI, like arrest records and digital evidence, can only be accessed by individuals who are authorized to view it.

Starting October 1, 2024, organizations that store and access CJI must have implemented MFA using at least two factors to authenticate individuals across all systems and applications. Failure to comply with the new CJIS requirements could lead to a denial of access to the Federal Bureau of Investigation’s (FBI’s) CJIS resources and data, in addition to monetary fines. Every three years, the FBI will perform official audits on CJIS subscribers. However, agencies are anticipated to submit self-reports annually.

The deadline for the new MFA mandate reflects how critical CJI is to public safety—and how attractive it is to cybercriminals.

(Source: Forbes)

GAO: Cyber Resiliency - CrowdStrike Outage Highlights Challenges

Challenges in supply chain risk management, testing, contingency planning, and cyber information sharing make it more difficult to mitigate cybersecurity risks to IT systems. The Government Accountability Office (GAO) released a report on Sept. 23, Cyber Resiliency: CrowdStrike Outage Highlights Challenges.

In July 2024, a software update from the cybersecurity firm CrowdStrike caused Microsoft Windows operating systems to crash—resulting in potentially one of the largest IT outages in history. The outage disrupted critical infrastructure operations by grounding commercial flights and interrupting critical hospital care, among other impacts.

CrowdStrike’s investigation of the incident found that a faulty security update caused widespread system failures, affecting millions of Windows systems. Although the CrowdStrike crash was caused by human error and not a cyberattack, it highlights similar vulnerabilities we saw during the SolarWinds attack in 2019. In that event, instead of attacking systems directly, malicious actors targeted system support software.

Concerted action among the federal government and its nonfederal partners in critical infrastructure sectors is essential to mitigating the risks posted by cyber-based threats. Therefore, in 2018 GAO included four major cybersecurity challenges facing the federal government in its High Risk update. The federal government has also taken steps to improve the response to such incidents.

The federal government has acted to address the challenges in protecting its systems and those of the critical infrastructure sectors. For example, Congress enacted the Cyber Incident Reporting for Critical Infrastructure Act of 2022. The act established cyber incident reporting requirements across the 16 critical infrastructure sectors. CISA has efforts underway to finalize a rule that would implement the act’s requirements for cyber incident reporting by October 2025. Continued persistence in combating cyber incidents is essential to protecting systems that are vital to the United States.

Read the full report at GAO.gov.

(Source: GAO)

City of Richardson reacting after cyber security attack

The city of Richardson, Texas, is responding with caution after a cyberattack on its servers. According to a release from the city, an external party gained access to city servers at 6:22 a.m. on Wednesday and tried to encrypt data files on the network. The city says a small number of files were encrypted, but network security systems prevented further damage.

According to city officials, while access to internal systems is limited, essential services like emergency response, online payments, solid waste services and other customer portals are still available. The city says they are cooperating with the FBI, which is investigating, and the Department of Homeland Security

(Source: WFAA - Dallas-Ft. Worth)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.