InfoGram 15-10: April 15, 2010

This InfoGram will be distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures. For further information, contact the Emergency Management and Response - Information Sharing and Analysis Center (EMR-ISAC) at (301) 447-1325 or by email at emr-isac@fema.dhs.gov.

Receive InfoGrams and Bulletins by Email

2009 NIPP Regional Collaboration Emphasis

After reviewing the 2009 National Infrastructure Protection Plan (NIPP) (PDF, 4.5 Mb) released late last year, the Government Accountability Office (GAO) discerned a significant change from the preceding version. In its Highlights (PDF, 61 Kb), the GAO noted that the 2009 update places greater emphasis on regional collaboration through a consortium of stakeholders from multiple regional organizations.

The Emergency Management and Response—Information Sharing and Analysis Center (EMR-ISAC) confirmed that the revised NIPP encourages more cross-sector regional planning, coordination, and information sharing. At paragraph 4.1.3, the NIPP states regional organizations provide structures at the strategic and/or operational levels that can facilitate cross-sector critical infrastructure and key resources (CIKR) planning and protection program implementation. “They may also provide enhanced coordination among jurisdictions within a State where CIKR cross multiple jurisdictions and help sectors coordinate with multiple States that rely on a common set of CIKR.”

The EMR-ISAC acknowledges that “regionalization” may be a more desirable approach for local, county, and State leadership, emergency managers, and first responders to acquire scarce resources. Joining with other communities to develop regional plans and response packages of personnel and equipment can significantly improve the interoperability of mission-essential assets and systems. Additionally, pre-existing agreements and written plans that specify roles, payment, incident command, etc., should enhance thorough collaboration and synchronization among the numerous responding organizations within the region.

See sub-chapter 4.1 at page 12 of the National Preparedness Guidelines (PDF, 560 Kb) for more information about regional collaboration.

Another Superbug Threat

According to an article in USA Today, clostridium difficile, a bacterium commonly known as “C.diff” has surpassed methicillin-resistant staphylococcus aureus (MRSA) as a serious threat to the nation’s medical facilities. It is spread by contact and can cause painful intestinal infections and in some cases death.

Considering the obvious threat to the Emergency Medical Services, the Emergency Management and Response—Information Sharing and Analysis Center (EMR-ISAC) consulted with the Centers for Disease Control and Prevention (CDC) and verified that “C.diff” spores are not easily eliminated with most conventional household cleaners or alcohol-based hand sanitizers. Medical research also substantiated that “C.diff” is resistant to some antibiotics.

“This superbug is especially difficult to stop because in addition to being a bacterium, it can exist in a dormant spore form, which can survive for weeks or months on hard surfaces, then begin multiplying when ingested.”

Common symptoms of “C.diff” include watery diarrhea 3 or more times a day lasting for more than 2 days and accompanied by mild abdominal cramping and tenderness. Serious cases of this bacterium are indicated by watery diarrhea 10 to 15 times a day, severe abdominal cramping, pains, fever, nausea, dehydration, loss of appetite, and weight loss.

The EMR-ISAC recommends MayoClinic.com for comprehensive information about clostridium difficile, particularly regarding symptoms, causes, risk factors, complications, tests and diagnosis, treatments, remedies, and prevention.

Spear Phishing: Dangerous Attack Vector

In a NextGov.com cybersecurity report, Adam Ross wrote that spear phishing attacks have become increasingly sophisticated, tailored, professional, personal, and prevalent. The author further indicated that this malicious and criminally fraudulent action is among the most dangerous attack vectors that are exploiting organizations and their unsuspecting employees.

Instead of sending thousands of random emails hoping a few victims will bite, the Emergency Management and Response—Information Sharing and Analysis Center (EMR-ISAC) confirmed that spear phishers target select groups of people with something in common (e.g., firefighter, paramedic). The typical thread among recipients is that they work at the same organization, department, agency, bank, etc. The emails are ostensibly sent from organizations or individuals the potential victims would normally get emails from, making the messages even more deceptive. Consequently, the emails look authentic and offer urgent and legitimate-sounding explanations regarding why the recipient should click on a link inside the message. The link takes them to a fake but realistic-looking Website, where they are asked to provide user names, passwords, account numbers, access codes, PINs, and sometimes more.

A paper by the Federal Bureau of Investigation (FBI) recommends actions to avoid becoming a spear phishing victim. The EMR-ISAC listed the FBI suggestions as follows:

• Keep in mind that most organizations, departments, agencies, etc., do not request personal information via email. If in doubt, give them a call, but do not use the phone number contained in the email because that is usually phony as well.
• Use the phishing filter included in many of the latest Web browsers or offered by them as a “plug-in.”
• Never follow a link to a secure site from an email. Always enter the URL manually.
• Do not be fooled by the latest scams. Visit the Internet Crime Complaint Center (IC3) and “LooksTooGoodToBeTrue” Website for tips and information.

National Fire Academy Application Period

The Emergency Management and Response—Information Sharing and Analysis Center (EMR-ISAC) received information from the U.S. Fire Administration stating that the National Fire Academy (NFA) will begin accepting applications for the first semester FY2011 on 15 April. The application period will close on 15 June. The first semester includes classes that begin 1 October 2010 through 31 March 2011.

Interested individuals can examine the course schedule or conduct an advanced course search by using the following hyperlinks:

• 2010-2011 NFA Course Schedule
• NFA Advanced Course Search

There are no tuition fees for NFA courses. All instruction and course materials are provided at no cost. Transportation expenses and lodging for students who represent career or volunteer fire departments, rescue squads, or State/local government attending on-campus courses are currently provided as part of funding under the student stipend reimbursement program.

Information regarding how to apply is available for downloading. The EMR-ISAC encourages applicants to review the “8 Tips for Completing a Successful NFA Application” (PDF, 326 Kb) for helpful hints.