On Friday, May 12^th, 2017 NENA Headquarters became aware of a widely-reported ransomware attack affecting both private- and public-sector enterprises in multiple countries. Open-source reporting on the attack is available here. NENA is not aware of any attacks affecting PSAP systems or 9-1-1 service at this time. However, reporting indicates that life-safety institutions in the U.K., including several hospitals, have been affected. Consequently, we are issuing this special alert to help members defend against any attacks that may occur.

The so-called “WannaCry” attack leverages recently-released vulnerabilities (CVEs 2017-0143 through 0148) and exploit techniques to take control of Windows-based computers. After infecting vulnerable machines, the attack software encrypts data on the system, and demands payment of $300+ in an internet currency known as BitCoin. Victims that fail to pay are threatened with deletion of the encryption key, which renders their data irretrievable.

Mitigation Steps

To protect critical public safety services from this attack, NENA recommends that members take the following steps:

1.      PSAP IT departments should download, validate, test, and install a Microsoft-issued patch to all affected machines as soon as possible. Microsoft has issued a critical security bulletin and update (MS17-010) to resolve the vulnerability.

2.      Center Managers should ensure that on- and off-site backups for all critical systems are being routinely maintained. Existing backups should be verified and test restores performed using systems without an active internet connection.

3.      PSAP IT departments should consider permanently disabling the SMB 1.0, SMB 2.0, and CIFS file sharing support of all Windows systems. SMB 3.0 is currently maintained, offers higher speeds, and provides greater security than these legacy protocols.

4.      Shift supervisors should remind front-line employees to report any unusual computer behavior, and to exercise added care when clicking links and entering credentials, even in normally-trusted systems.

5.      In the event of a compromise, DO NOT PAY! Contact your local FBI field office, notify the National Cybersecurity and Communications Integration Center of any 9-1-1 service impacts at 888.282.0870, and take steps to preserve log files and other materials that may have forensic value.

 PSAPs with questions or concerns may contact Trey Forgety at tforgety@nena.org or via telephone at 202.681.4392.

NG9-1-1 GIS Data Needs & the Standards to Support Them
Wednesday, May 24 | 3PM Eastern (live) or On-demand
$50 for NENA Members | $85 for Non-Members
Click here to register!

 This webinar covers important developments in NG9-1-1 location data needs and upcoming requirements. Attendees will learn about the impact of the ECRF/LVF provisioning standard, LVF consistency workgroup efforts, and the upcoming map database service debate. Updates on the NEAD (National Emergency Address Database) work and the NG9-1-1 GIS Data Model will be discussed, as well as improved location accuracy needs and use in 2017. You’ll leave this hour-long webinar with a better understanding of:

• NG9-1-1 GIS data needs;
• NENA' GIS standards in development now to support these needs; and
• Future data needs that you should be planning for today.

Presenter: Richard Kelly – 911Datamaster | NENA Liaison to the National States Geographic Information Council

CEUs: Attend this webinar and receive one-half ENP re-certification point towards the ten-point maximum for NENA courses in the Professional Development CEU/Course Credits section.

Can't attend on the 24th? Register now and you will receive an email after the live presentation with instructions for accessing the on-demand webinar archive.

Webinar Access Info: Dial-in and web-access details will be provided to attendees via email the week of the webinar.