TLP White| FB-ISAO Newsletter was distributed on January 15, and may be accessed below.

TLP White| FB-ISAO Newsletter was distributed on January 15, and may be accessed below.
In cognizance of our mission to provide members with information, analysis, and capabilities to help reduce risk while enhancing preparedness, security, and resilience, our team at Faith-Based Information Sharing & Analysis Organization (FB-ISAO) is always eager to find like-minded partners.
The Department of Homeland Security has identified Houses of Worship as a prime category of ST-CP, or Soft Targets-Crowded Places, as noted by Assistant Director Brian Harrell in his letter introducing the updated Security of Soft Targets and Crowded Places–Resource Guide last month. He wrote, “The cornerstone of our democracy is a free and open society where citizens can enjoy a wide range of activities without fear of harm. People across the U.S. should expect that they will be safe and secure as they cheer on a favorite team at a sporting event, shop at a mall, attend a house of worship, go to school, dine out with family and friends, or go to a concert.”
The threats and risks houses of worship and the broader community of faith-based organizations face have been made all to clear in recent headlines and FB-ISAO reporting. As our team strives to execute our mission, we are always searching for safety services partners who share our commitment to protecting worshipers. One such partner is Vizsafe, which provides an intuitive and easy to use mobile incident reporting and management platform.
Their cloud-based Geoaware®️ platform is currently protecting some of the world’s most valuable facilities where it is used by employees, visitors and first responders. Vizsafe has generously agreed to provide their base incident reporting and sharing platform to registered Faith Based-ISAO Professional Member organizations at no charge. We are proud to partner with Vizsafe to provide this service to our members. Please review the quick reference and visit vizsafe.com to learn more on this mission-enhancing capability.
Contact FB-ISAO at [email protected] for more and if you’re not already, consider joining FB-ISAO!
Here is where you can find everything you need to know about joining The Faith Based Information Sharing and Analysis Organization.
by Jennifer Lyn Walker and Omar Tisza
This post was originally informed by a TLP: GREEN FB-ISAO report distributed on 14 February 2019.
Like every other business type, faith-based organizations (FBOs) are susceptible to digital extortion attacks. History has shown many cyber criminals are not selective in their targets – they exploit vulnerabilities in people, processes, and technology regardless of industry or sector.
At its core, digital extortion is a psychological tactic designed–through social engineering–to elicit an emotional response primarily through fear, embarrassment, or humiliation, and often aims to profit through ransom payments.According to the FBI, in 2018 extortion by email complaints increased 242%, totaling $83 million in losses.
Some types of extortion threats are credible, in so far as the threat actor is able to inflict, or has already inflicted disruption or damage to some degree; however, there has also been an uptick in non-credible extortion-based threats during the past year. These empty threats may use personal information, such as passwords or email addresses as intimidation, but are nothing more than hoaxes. While ransomware may be the most well-known type of extortion attempt, there are many variants including the increasingly popular “sextortion” campaign.
Below is an overview of common types of digital extortion, including ransomware and sextortion, that faith-based organizations are likely to encounter.
Nary a week goes by without reports of organizations who have fallen victim to ransomware. Ransomware is malicious software (malware) that encrypts files on infected computers, making the files inaccessible until (presumably) unlocked with a decryption key. The malware displays a warning message along with a ransom demand and instructions for payment. The ransom is usually requested to be paid in Bitcoin or other cryptocurrency in exchange for ‘said’ decryption key – which may or may not work, let alone be provided.
In many cases, organizations have had to rebuild their computers and file systems from scratch, costing valuable time and money – and causing many headaches. Recently there has been a spate of incidents affecting cities, municipalities – and other government entities, charities, non-profit organizations, and FBOs, including a food bank, and a catholic archdiocese.
In the past year, other extortion-based threats have been known to be non-credible, such as bomb threats and hitman scams. In December 2018, emails containing bomb threats and hitman schemes went viral. These messages gained worldwide attention and awareness for the hoaxes they were, but not before causing major disruptions to countless businesses and individuals.
The majority of email extortion complaints to the FBI were comprised of sextortion. While not a “credible” threat, perpetrators are adept at crafting sextortion emails that appear believable enough to evoke fear or concern. A recipient receives an email purporting that the scammer has compromised their computer and stolen all their files, including contacts and browser history. The email further threatens the victim with public disclosure of unsavory pictures or videos to family, friends, and colleagues (allegedly captured with malware they placed on an “adult” website they visited) unless a ransom is paid for the scammer to keep quiet. These fraudsters do not have the “dirt” they claim; nonetheless, some include personal details to make the ruse seem more credible to increase the chance victims will pay the ransom. There is even a variation that looks like it comes from your own email address as the fraudsters want you to think they have also compromised your email account.
In addition to ransomware, FB-ISAO believes that FBOs are likely to observe sextortion-based attacks. Given the personal and sensitive nature and appearance of impropriety, malicious actors would victimize the community of faith on what could be perceived as the need to protect image and reputation by succumbing to ransom demands. Yet, contrary to the majority of FBI complaints, for those same reasons, it is plausible that sextortion emails in the faith-based community are likely to go unreported.
It is also important to report digital extortion incidents to the appropriate authorities and share with the broader faith-based community to improve security and resiliency.
o Report all incidents to the FBI through the Internet Crime Complaint Center (IC3)
o If there has been a financial loss, you should (and in some cases, may be required to) contact local law enforcement
o Report the incident to FB-ISAO for broader awareness among the Community of Faith
Jennifer Lyn Walker is a cybersecurity professional with over nineteen years’ experience supporting critical infrastructure and SLTT governments. As Director, Cybersecurity Services for FB-ISAO and Gate 15, she advises and consults on cyber threats related to homeland security for critical infrastructure and vital lifeline sectors, including WaterISAC. She is experienced in malware analysis, threat assessments, cyber threat intelligence, compliance, and cybersecurity awareness.
Omar Tisza graduated from American University in 2017 with a bachelor’s in International Relations. After a brief stint in business development on the federal market, he began his role as Jr. Risk Analyst at Gate 15 in 2018 and currently supports the Health Information Sharing and Analysis Center (HISAC) and the Healthcare Sector Coordinating Council – Cybersecurity under the leadership of Executive Director Greg Garcia, former Assistant Secretary for Cyber Security and Communications at DHS.
Join FB-ISAO! We welcome faith-based organizations, charities and critical partners to join FB-ISAO. Access our TLP AMBER and TLP GREEN reports, join our collaborative forums, working groups, participate in leadership opportunities and take the next step in enhancing your organization’s preparedness, security and resilience!
Mayya Saab, of the Faith-Based Information Sharing and Analysis Organization (FB-ISAO) had the honor of attending the Multi-Faith Targeted Violence Roundtable meeting at FBI Headquarters on 18 June 2019. This was a meeting between leaders of faith-based organizations (FBOs) and members of government, who are given the difficult task of preventing bias-based attacks on religious institutions. Safety of houses of worship is a mammoth task and one that government cannot do alone, so the task requires close collaboration between government, faith-based leaders and the community. Representatives from the Christian, Muslim, and Jewish faiths included leaders from the Christian Emergency Network, Secure Community Network and the Muslim Public Affairs Council.
There were multiple presentations such as:
Especially poignant were presentations on lessons learned from the Sutherland Springs Church Shooting. During that presentation, a deep discussion on the assailant’s behavior leading up to, and including, the day of the shooting took place. Another presentation covered the Oak Tree Temple Shooting. This presentation was particularly personal for the FBI agent who responded to the event since the Oak Tree Temple was his house of worship and some of the victims were his family members. There was a discussion about the effect of these types of incidents on law enforcement personnel. On multiple occasions, attendees expressed gratitude to law enforcement for their work on protecting houses of worship.
The FBI provided information about the current threat environment. Here are some key points for the community to note:
The FBI and DHS issue and maintain multiple products designed to inform and educate FBOs and individuals on what they can do to prepare for hostile events. Here are publications that were specifically referenced during the meeting:
What can an FBO do?
The meeting concluded with a deep commitment to public private partnerships – that is partnership between government and private organizations, like FB-ISAO. Also affirmed was the need for greater communication and collaboration between government and faith-based groups. Although this meeting was the first of its kind, it is expected that there will be future meetings to follow-up on action items and to establish an on-going dialogue between government and faith-based leaders and their communities.
By Andy Jabbour
TL;DR:
Information Sharing and Analysis Centers (ISACs) got their start in 1998 through an executive order from then-President Clinton. Over the ensuing years, ISACs developed across critical infrastructure, each developing uniquely to its community – or Sector. As the model succeeded, and as the cyber threat landscape developed and became more threatening, in February 2015 then-President Obama issued Executive Order 13691, Promoting Private Sector Cybersecurity Information Sharing, which stated that, “The Secretary of Homeland Security (Secretary) shall strongly encourage the development and formation of Information Sharing and Analysis Organizations (ISAOs)… ISAOs may be organized on the basis of sector, sub-sector, region, or any other affinity, including in response to particular emerging threats or vulnerabilities.”
Having spent a few years in support of DHS, working with many of the ISACs, and then going to work directly for the ISAC community, I began to discuss the wisdom of this initiative with a few of my close colleagues and we pondered where this idea made sense. At first, we struggled, but over time, a few areas began to make sense. Among those, most notably to a couple of us was the community of faith. Based on a combination of our personal faith and concern over a vulnerable community, we determined to develop the Faith-Based Information Sharing and Analysis Organization, or FB-ISAO. By late 2015 we were developing the concept and working with trusted partners in government and industry to begin to gain support for the initiative.
Turns out, it was really hard. There simply wasn’t a lot of interest from the community and after several months of frustrated efforts, in summer 2016, we sadly decided to table the project until we could more deliberately pick it back up. Over the following year and change, one trusted partner moved on, but new opportunities brought new resources and new team members with a passion for their faith and the security of our country. After a few months of discussion, as 2018 began, we renewed the effort to develop FB-ISAO and in May 2018, the organization was formally established.
The Faith-Based Information Sharing & Analysis Organization (FB-ISAO) provides members with information, analysis, and capabilities to help reduce risk while enhancing preparedness, security, and resilience. We perform our mission across the all-hazards threat environment – including physical security, cybersecurity, public health, and natural disasters.
Underwritten by Gate 15 resources and personnel, FB-ISAO began its Initial Operating Capability phase, establishing baseline reporting and communications capabilities, reengaging with partners across government, establishing a trusted Advisory Board of leaders, and engaging the community of faith at events, through reporting, and other outreach. As we developed the community, we also continued to mature our capabilities, building on our start and, with good counsel from our Board and others, developed new tools, capabilities and a reasonable membership model that could be accepted by the community.
This year has seen tragedy and high-impact incidents to faith-based facilities and believers around the world and across the all-hazards threat environment. From the horrendous killings in New Zealand and Sri Lanka to our own nation with the hateful attack in San Diego, to high-dollar cybersecurity incidents and data breaches, the first few months of 2019 have underscored in a terrible way the very reason FB-ISAO needs to succeed.
As many organizations ponder their security posture and their readiness to meet the threats they face, to protect their facilities, their staff, those that come to work, those that come to worship and all those that come to seek God and find the fulfillment in faith that is a vital part of our American story, we – as a community – must work together. With our partners in the private and public sectors, we must take the reasonable and responsible steps to understand the threats, assess the risks, and take appropriate preparedness and operational actions to support the National Preparedness Goal of: “A secure and resilient Nation with the capabilities required across the whole community to prevent, protect against, mitigate, respond to, and recover from the threats and hazards that pose the greatest risk,” especially as it pertains to Faith-Based Organizations.
As we progress into the next phase of our operational development and organizational maturity and transition to our membership model and enhanced engagement and capabilities, we hope to continue to grow our community, our collaboration, and the security and resilience of our nation’s community of faith. This will be a process, will take time, and will take commitment from the community itself. I hope many of you will join us. For the good of our country and for all who seek to serve and know God, FB-ISAO will continue to do everything we can to help FBOs “protect against, mitigate, respond to, and recover from the threats and hazards that pose the greatest risk” to our community and our way of life. We are stronger together. We are better together. I hope you’ll join us. We need leaders, we need collaboration – we need you to help our country and our community. Find out more at FB-ISAO.
Read more on membership from the link at left and below.
by Andy Jabbour, Managing Director, FB-ISAO
Every month, FB-ISAO provides a TLP GREEN report, the FB-ISAO Monthly Threat Overview. The report is developed over a specific reporting period by a team of analysts. The report addresses all-hazards – to include physical, cyber, natural hazards, and health threats. Reviewing the draft of the most recent report, finalized and distributed on 24 May and covering the period from 25 April – 22 May 2019, I was amazed by the remarkable number of incidents that were included.
Addressing the area of hostile events, the report notes, “The persistence of domestic arrests, incidents, and continued jihadist and other extremist rhetoric remains a direct threat to the Faith-Based Organizations (FBOs). We continue to consider the threat of lone actor or a small group of extremists to be a credible threat. Over the past month, there were several events and arrests that continue to serve as reminders of the continuous physical security threats facing the sector.”
“Our right to worship freely and without fear is fundamental to life in America.”
Renn Cannon, Special Agent in Charge of the FBI in Oregon
The complete physical security section includes incidents involving vandalism, theft, harassment, arrests and other notable events. But it was the section covering Active Shooter & Hostile Events that jumped out at me. An excerpt from that section follows. I encourage you to review the list of incidents and let that sit with you for a few moments.
Is your organization properly, reasonably, and responsibly addressing the risks you are facing? Are you actively working on preparedness and operations to protect and prepare your people and places?
FB-ISAO will be providing our second offering of the Hostile Events Preparedness Series educational presentation on 20 June. It is free, and only costs you an hour and a half of your time. Contact our team for more information on that event. Consider joining FB-ISAO, tying in to our growing community of security-focused faith leaders and help enhance the security and resilience of your FBO and our collective community of faith. As recently stated by Renn Cannon, Special Agent in Charge of the FBI in Oregon, “Our right to worship freely and without fear is fundamental to life in America.” Are you doing everything you can to help protect and prepare your people and places so all Americans, and those within our boarders, are able to “worship freely and without fear?”
The complete FB-ISAO Monthly Threat Overview goes into additional incidents, other threat vectors and provides resources for members. As a TLP GREEN report, it is available to all Standard and Professional members, as well as our Government and Law Enforcement members (read more on membership here).
Active Shooter & Hostile Events, for period from 25 April – 22 May 2019.
Our partners at FEMA, developed an FAQ on the Fiscal Year (FY) 2019 Nonprofit Security Grant Program (NSGP).
The Fiscal Year (FY) 2019 Nonprofit Security Grant Program (NSGP) provides funding support for security related activities to nonprofit organizations at risk of a terrorist attack. For a nonprofit to qualify for the grant, it must meet the description under section 501(c)(3) of the Internal Revenue Code of 1986 (IRC) and exempt from tax under section 501(a) of such code. A nonprofit can be considered vulnerable to attack (e.g. verbal threats, vandalization) if an attack has occurred at the facility. A nonprofit may also qualify if current events indicate that a nonprofit may be a target because other organizations have been targeted due to a similar mission, belief, or ideology.
Grant allocations can be used for emergency response planning activities, equipment, training and exercises.
The application window opened on April 12, 2019. The deadline for applications is determined at the state level. Links to state contacts can be found here. The Fiscal Year (FY) 2019 Nonprofit Security Grant Program (NSGP) is a program that Faith-Based Organizations can benefit from, directly, to improve their security posture and resiliency. Questions about the grant application process and deadlines can be directed to [email protected].
by David Pounder & Omar Tisza
Blended threats, in which attacks can cause harm to both cyber and physical systems, are a growing reality for many organizations.The more connected organizations and individuals become, the more impact technology has on their respective physical worlds. In March 2019, we were reminded of how the opposite can be true when two journalists were able to access sensitive fiber optic communications cables simply because someone forgot to lock the gate. Once they gained unimpeded access to the station, the journalists were able to go into a “nondescript hut” where the Hibernia Submarine Communication Cable reaches the British mainland. Despite having CCTV on site, the journalists were not challenged. Had they been there for nefarious purposes, they could have executed physical actions, such as tampering with cables, which could have had a direct cyber-related impact.
For most of us, it is common to think of ways in which cyber actions impact physical security, such as the Ukraine powerplant attack, Mirai botnet attack, or this amusing Amazon thermostat review. But when physical actions have a cyber impact, it is a stark reminder that physical and cyber security go hand-in-hand and need to be addressed concurrently, especially in the area of access controls. Once a user is granted access to a system or network cybersecurity controls manage and track activity, but actions leading up to that access, and afterwards, are in the realm of physical security.[Understanding the various ways in which the two disciplines work together–within access controls–can help organizations from all industries improve their overall security posture.
For FBOs, physical access controls may not have as much direct impact as a larger business – but useful nonetheless – even with smaller staff. FBOs maintain sensitive financial and personal information about their members which make them an attractive target for cybercriminals. As part of their risk management approach, FBOs are encouraged to undergo a risk assessment to determine relevant controls for the type of information being protected. For example, while it may not be practical to install a badging system, key pads or safes would be viable solutions to protect sensitive information from unauthorized physical access. Considerations for risk assessments include:
Additional unauthorized access tactics that security teams should be on guard for include:
In our increasingly blended threat environment, FBOs need to continue to increase their mutual understanding and collaboration within the cyber and physical disciplines. Increased awareness of the various ways in which the two disciplines work together within access controls can help organizations from all industries improve their overall security posture. So, to answer the question, are access controls a physical or cyber security concern, the answer: BOTH.
Consider joining FB-ISAO!
Read more on membership from the link at left and below.
David Pounder is the Director for Intelligence and Analysis at Gate 15, supporting FB-ISAO. Dave provides expert threat and risk analysis, assessments and special project support for internal activities and client needs.
Omar Tisza is a Jr. Risk Analyst at Gate 15. After a brief stint in business development on the federal market, he began his role as at Gate 15 in 2018 and currently supports a number of efforts, including the Health Information Sharing and Analysis Center (H-ISAC) and the Healthcare Sector Coordinating Council.