View as a webpage / Share

Volume 23 — Issue 32 | August 10, 2023

ATF investigation discusses failure of CSST gas lines after lightning strikes, lessons learned from 2 firefighter LODDs

The Howard County, Maryland, Department of Fire and Rescue Services (HCDFRS) just released a report and companion video presentation with the results of an investigation conducted by the Baltimore Field Division of the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) and ATF’s Fire Research Laboratory.

The ATF investigated the line-of-duty death (LODD) of HCDFRS firefighter Nathan Flynn, which occurred on July 23, 2018, during response to a house fire. The ATF’s investigation determined the origin and cause of this fire to be lightning-induced arc failure of Corrugated Stainless Steel Tubing (CSST) within the residence. CSST is a common gas supply piping used in residential construction.

The report and video provide a detailed forensic timeline of this 2018 incident. This incident is then compared with another residential fire that occurred on Aug. 11, 2021, in Frederick County, Maryland, which led to the LODD of Battalion Chief Josh Laird. This 2021 fire was also caused by lightning-induced arc failure of CSST. The report and video provide a side-by-side comparison of the timelines for the 2018 and 2021 incidents, drawing attention to the similarities in the sequences of events that led to these two LODDs.

The report draws five key takeaways from the investigation relevant to firefighter safety. These conclusions are supported by discussions on the role of CSST in the fire origin, the hazards of elevated fire dynamics and the increased likelihood of floor collapse, the importance of thermal imaging, ruling out fire spread on all levels and immediately controlling utilities when a fuel or gas fire is suspected, unique fire dynamics in extremely large residences, and more.

The forensic analysis provides valuable information on CSST for the fire protection community. The report discusses how CSST is typically routed within structures and its susceptibility to lightning-induced electrical surges. This can lead to arcing to nearby grounded objects or compromise of the CSST, which can then lead to fires and gas leaks in concealed spaces or near combustible structural materials. The report can inform efforts to promote awareness and improve safety measures related to CSST and its susceptibility to lightning, as well as efforts within the codes and standards community to increase performance criteria for CSST products.

Lexipol will host a webinar on Aug. 23, 2023, at 1 p.m. EDT, CSST & Lightning: An Examination of 2 Line-of-Duty Death Incidents. The webinar will include presentations from the ATF on its investigation and findings in the report. Participants will learn about potential ignition sequences of lightning-induced structure fires and the role of CSST, common traits and hazards of below-grade, lightning-related fires, and considerations for firefighting tactics and fire investigations for fuel-gas system fires.

You can access the HCDFRS’ report on Howard County’s website. The accompanying video is available on HCDFRS’ YouTube channel. Register for Lexipol’s Aug. 23 webinar and access many additional CSST awareness resources on Lexipol’s website.

(Sources: HCDFRS, Lexipol)

Highlights

ATF investigation discusses failure of CSST gas lines after lightning strikes, lessons learned from 2 firefighter LODDs

DHS S&T and Pacific Northwest National Laboratory partner to advance next-generation emergency operations centers

CISA and FEMA provide $374.9 million in state and local cybersecurity grants

Webinar: CISA’s Protective Security Advisor Program

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

DHS S&T and Pacific Northwest National Laboratory partner to advance next-generation emergency operations centers

The Department of Homeland Security (DHS) Science and Technology Directorate (S&T) recently announced the launch of a research project with the Department of Energy (DOE) Pacific Northwest National Laboratory (PNNL) that will focus on advancing next generation emergency operations centers (EOCs).

This research will support state, local, tribal, and territorial emergency managers to enhance communication and coordination, improve response capabilities during emergencies, and ultimately to reduce the societal and economic costs of disasters.

S&T and PNNL will work with emergency management practitioners, technologists, futurists, and others to:

• Develop concepts, requirements, and vision for next-generation EOCs.
• Establish the framework for a national, coordinated approach to emergency management research.
• Develop new and novel information-sharing technologies, as well as planning, modeling and simulation tools.
• Consider emerging innovations in areas such as artificial intelligence, geospatial intelligence, machine learning, data analytics, and decision aids, to equip and support emergency managers for the future.

Over the next year, the project will assess emergency management research at academic institutions, U.S. national laboratories, and other research institutes. The endeavor will also advocate using AI for disaster management and identify and commence AI research to fill emergency management capacity gaps. After the research is conducted, PNNL will curate a comprehensive framework that would inform future research investments.

To learn more about this project, see S&T’s news release.

(Source: DHS S&T)

CISA and FEMA provide $374.9 million in state and local cybersecurity grants

On Tuesday, Aug. 8, the Department of Homeland Security announced the availability of $374.9 million in grant funding for the Fiscal Year (FY) 2023 State and Local Cybersecurity Grant Program (SLCGP).

State and local governments face increasingly sophisticated cyber threats to their critical infrastructure and public safety. Now in its second year, the SLCGP is a first-of-its-kind cybersecurity grant program specifically for state, local, and territorial (SLT) governments across the country to help them strengthen their cyber resilience. Established by the State and Local Cybersecurity Improvement Act, and part of the Bipartisan Infrastructure Law, the SLCGP provides $1 billion in funding over four years to support SLT governments as they develop capabilities to detect, protect against, and respond to cyber threats.

This year’s funding allotment represents a significant increase from the $185 million allotted in FY22, demonstrating the Administration and Congress’s commitment to help improve the cybersecurity of communities across the nation.  Applicants are encouraged to submit their cybersecurity plans developed with FY22 funds to access FY23 funding.

SLCGP is jointly administered by the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Emergency Management Agency (FEMA). CISA provides expertise and guidance on cybersecurity issues while FEMA manages the grant award and allocation process. Award recipients may use funding for a wide range of cybersecurity improvements and capabilities, including cybersecurity planning and exercising, hiring cyber personnel, and improving the services that citizens rely on daily.

State and local governments have until Friday, Oct. 6, 2023, to apply for this FY23 grant opportunity.

A complete outline of changes for this year’s program can be found in the FY23 SLCGP fact sheet, key changes document, and FAQs. For more information and helpful resources on the State and Local Cybersecurity Grant Program, visit CISA’s webpage: cisa.gov/cybergrants.

(Source: CISA)

Webinar: CISA’s Protective Security Advisor Program

CISA will host a webinar on Tuesday, Aug. 29, 2023, at 1 p.m. EDT on its Protective Security Advisor Program. This webinar is for homeland security, public safety, emergency management, and emergency response personnel.

CISA’s Protective Security Advisor Program leads the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure. Protective Security Advisors (PSA) are trained critical infrastructure protection and vulnerability mitigation subject matter experts. PSAs primary mission is to proactively engage with federal, state, local, tribal, and territorial government mission partners and members of the private sector stakeholder community to protect critical infrastructure through five mission areas:

• Conducting security assessments of nationally significant critical infrastructure.
• Conducting outreach activities and providing access to critical infrastructure security and resilience resources, training, and information.
• Supporting National Special Security Events (NSSEs) and Special Event Assessment Rating (SEAR) events.
• Serving as liaisons between federal and local government officials and private sector critical infrastructure owners and operators during and after an incident.
• Coordinating and supporting improvised explosive device awareness and risk mitigation training, as well as CISA's Cybersecurity Division assessments and resources.

PSA Eugene Wade has had experience in creating and implementing security programs that included PSA resources, close coordination between private sector security and first responders, and coordinating private sector response during state-wide emergencies.

No advanced registration is required to join this webinar. Save the date and go to CISA’s Homeland Security Information Network (HSIN) Connect Room at the scheduled time to join: http://share.dhs.gov/psaprogram/. A HSIN account is not required to join; participants may enter the room as a guest.

For more information or to seek additional help, contact the Emergency Services Sector Management Team at EmergencyServicesSector@cisa.dhs.gov.

(Source: CISA)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

US and international cybersecurity partners warn organizations of routinely exploited vulnerabilities

CISA, the National Security Agency (NSA), Federal Bureau of Investigation (FBI), and international security partners published an advisory on Aug. 3 on the common vulnerabilities and exposures (CVEs), to include associated common weakness enumeration (CWE), that were routinely and frequently exploited by malicious actors last year.

The joint Cybersecurity Advisory, titled 2022 Top Routinely Exploited Vulnerabilities, provides technical background details on the 12 most exploited vulnerabilities and an overview of an additional 30 vulnerabilities often used to compromise organizations, including specific details that organizations can use to identify and mitigate their exposure.

For the first time, this advisory outlines the CWEs associated with these vulnerabilities, which reflects the underlying root causes that led to the exploited vulnerability. In order to reduce the prevalence of common classes of vulnerabilities, this advisory urges technology vendors to implement specific secure by design principles and to ensure that all published CVEs include the proper CWE identifying the root cause of the vulnerability.

(Source: CISA)

Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure

The electric vehicle (EV) extreme fast charging (XFC) infrastructure ecosystem relies on multiple connected subsystems to include EV charging stations, data flow networks, and utility power distributers. This required interconnectedness of systems leaves users and the EV/grid infrastructure vulnerable to a range of threats and open to multiple attack vectors, both physical and cyber.

The National Institute for Standards and Technology’s (NIST’s) National Cybersecurity Center of Excellence (NCCoE) is currently soliciting public comments on a draft Cybersecurity Framework Profile for Electric Vehicle (EV) Extreme Fast Charging (XFC) Infrastructure (NIST IR 8473). The Framework provides users with a national-level, risk-based approach for managing cybersecurity activities for EV XFC systems.

The public comment period for this NIST IR is now open through Aug. 28, 2023.

(Source: NIST NCCoE)

Center for Internet Security launches strategic collaboration with Microsoft to strengthen cybersecurity for state and local governments

The Center for Internet Security, Inc. (CIS®) announced on Aug. 9 a strategic collaboration with Microsoft aimed at bolstering cybersecurity measures for state, local, tribal, and territorial (SLTT) organizations.

This collaboration comes on the heels of CIS’s induction into the Microsoft Intelligent Security Association (MISA) in July and marks a significant step in providing multi-cloud security compliance solutions to help fortify digital defense capabilities against cyber threats to the public sector.

CIS has been directly supporting the cybersecurity of state and local governments since 2010 through the Multi-State and Elections Infrastructure Information Sharing and Analysis Centers (MS-ISAC® and EI-ISAC®)

(Source: CIS)

FBI investigating ransomware attack crippling hospitals across 4 states

A major hospital network with arms in multiple states is dealing with widespread network outages due to a cyberattack, which the FBI confirms is ransomware. Prospect Medical Holdings operates 16 hospitals in California, Connecticut, Pennsylvania, and Rhode Island as well as a network of 166 outpatient clinics and centers.

On Thursday, Aug. 3, the network began facing issues at its hospitals nationwide — some of which had to divert patients to other facilities and stop operation.

Local news outlets in California, Connecticut, Pennsylvania, and Rhode Island tracked multiple hospital emergency rooms that were forced to divert patients or close their doors starting on Thursday. Some hospitals posted about the outages on Facebook pages.

Several local news outlets across Pennsylvania and Connecticut have reported that the Federal Bureau of Investigation (FBI) is working directly with the hospitals to respond to the incident.

(Source: The Record)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.