FB-ISAO

Tag: faith

  • December 2020: FB-ISAO Physical Threat Level Remains SEVERE; Cyber Threat Level Remains GUARDED

    December 2020: FB-ISAO Physical Threat Level Remains SEVERE; Cyber Threat Level Remains GUARDED

    This message is TLP:WHITE. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.

    The ongoing COVID-19 global pandemic is a complex and blended threat impacting members and the broader faith-based and charity community in numerous ways and that continues to impact security and response, both to manmade and natural threats. FB-ISAO’s Threat and Incident Response Group (TIG) continues to assess the ongoing threats and risks to our community and has made the following updates to our Threat Level Assessments:

    The TIG has determined to maintain the Physical Threat Level at “SEVERE.” SEVERE means an event is highly likely. Given the ongoing threat of the COVID-19 pandemic and the approaching U.S. winter season and associated health concerns, we have determined to maintain the broad Physical Threat Level at SEVERE and anticipate this level being maintained until a decrease in the threat of the pandemic (such as via an effective vaccine being administered) and / or the end of the winter health threats. The TIG will continue to assess the Physical Threat Level regularly and provide updates accordingly. This determination will be periodically re-evaluated, especially with respect to non-COVID-19-related threats.

    The TIG has determined to maintain the Cyber Threat Level at “GUARDED.” GUARDED means FB-ISAO is unaware of any specific or targeted cyber attacks, but a general risk of cyber attacks exist, particularly with respect to holiday shopping scams. The TIG will continue to assess the Cyber Threat Level and provide updates accordingly. Likewise, the cyber threat landscape will be continuously monitored, but this Cyber Threat Level determination is valid until further notice. Please see below for on-going considerations regarding the Cyber Threat Level.

    Concerns Regarding the Physical Threat Level

    COVID-19 Pandemic. As we continue through this pandemic, with jurisdictions around the country and internationally  having moved back to more stringent local restrictions based on the continued surge of COVID-19, FB-ISAO continues to strongly encourage members “hold the line.” By hold the line, we mean continue to follow FSLTT guidance and directives and reopen, reenter and resume operations in accordance with, and not ahead of, such guidance and directives. Especially during the start of flu season, and the likely confluence of COVID-19 and annual influenza threats, members are advised to respect and adhere to FSLTT guidance.

    The pandemic has not peaked and in fact, new cases and fatalities are at very high levels as cases continue to rise and at the time of this assessment, COVID cases continue to increase rapidly during the current surge, with recent record highs and daily deaths known increasing from what had been a generally flat pace of around 800 a day in the previous assessment to almost double that at the time of this assessment.  As of 27 Nov, we are approaching four million new cases since our last assessment (from 8.68 million cases and over 225,084 deaths, to almost 12.5 million cases ansd 259,005 deaths) and as of 23 Nov, the CDC reports that the national ensemble forecasting predicts significantly increasing numbers of anticipated deaths with “10,600 to 21,400 new deaths likely to be reported in the week ending December 19, 2020. The national ensemble predicts that a total of 294,000 to 321,000 COVID-19 deaths will be reported by this date.” Based on current behaviors and trends, the surge in cases and deaths will continue into the winter with no clear end to that surge in sight until the effective distribution of vaccines to the population. Additionally, a potential surge in cases from Thanksgiving travel and events could further the surge in both new cases and resulting deaths. As noted above, this current situation is further complicated by annual flu season, which has the potential to complicate and overwhelm healthcare professionals and facilities. Some have referred to this as a potential “twindemic” – meaning the continuation of the COVID-19 pandemic and the start of flu season. Exacerbating these challenges is the increasing challenge of “pandemic fatigue,” as Americans grow tired of restrictions and seek to return to normalcy. While understandable, a decrease in vigilance and safety will only prolong recovery and a return to a more open and safe environment. 

    While there is a lot of conflicting reporting and varied assessments regarding the threat, and as both personally and organizationally, many are understandably feeling pandemic fatigue, the coronavirus remains a very active health threat with continued local outbreaks or broader flare-ups, with more potential concerns particularly if established best practices such as social distancing and mask wearing are not followed. FB-ISAO assesses that we remain in a high risk period.

    Worth noting, many FBOs have begun or continued phased reopening and by applying smart practices and safety measures, they have been able to avoid outbreaks at their facilities and among their congregations. These successes are commendable but recognizing success should not lead to complacency or a false sense that the threat has passed. As we wrestle with pandemic fatigue and the continued surge in cases, we need to avoid the danger of overconfidence. Outbreaks can happen quickly and lead to closures and broad infections, as has been observed in communities and FBOs around the country. For those that have been successful, we encourage you to maintain discipline and hold on to your success.

    As leaders, we encourage members to fight complacency and fatigue. FBOs should not base policies or enforcement on personal feelings, politics, or other subjective considerations. While as individuals we may agree or disagree with specific measures, FB-ISAO continues to strongly discourage defying state and local guidance and directives and encourages members to reopen, reenter and resume operations in accordance with government guidance and directives.

    Again, we encourage members to adhere to established best practices such as social distancing and mask wearing, and to make informed decisions based on observable data, not personal or political feelings.

    Beyond the explicit health threat, we have other security concerns, including:

    • Protests. Since June, we have expressed concern over the potential of protest activities – whether relating to social justice, elections, or other topics – would continuen to post direct and indirect threats to FBOs. Observed throughout this period and noted in previous threat assessments and FB-ISAO reporting, whether seen as supportive of protests – directly, logistically, or as sanctuaries or meeting places – or if seen as being opposed to protests, FBOs have been attacked from both sides. Given recent events, ongoing protests, a tense political election season, and other considerations, we continue to assess protests may pose direct and indirect risks to FBOs. With continued frustrations over the 2020 elections or with new frustrations that may develop with an incoming presidential administration, protests may again flare-up in the weeks ahead.
    • Hostile Events and the Targeting of FBOs, Both People and Facilities. As acts of violence, vandalism and arson are being reported regularly in the FB-ISAO Daily Journal, including hate crimes such as spray-painting hate symbols and the destruction of statues, arson and stabbings, it is important to note there are often connections between other issues and events and actions that may be taken at FBOs. Relating to protests and for other issues, and sometimes for no clear grievance, FBOs have been targeted by a variety of types of aggression and violence – at facilities, on statues, with threats, and more. This is unlikely to change in our current environment. Further, Europe has seen several low-tech terrorism attacks conducted by violent jihadists. While such attacks have not occurred recently in the U.S., terrorist propaganda continues to promote attacks and it is possible would-be jihadists could seek to conduct attacks domestically, and potentially aimed at FBOs, as has been observed overseas.
    • Disgruntled Individuals. Individuals who do not agree with positions taken by an FBO during periods of closure and reopening may take action against those organizations or others. We have continued to see various protests and violent actions aimed at COVID restrictions and individuals enforcing safety procedures. On 24 Aug, the CDC released Limiting Workplace Violence Associated with COVID-19 Prevention Policies in Retail and Services Businesses. While not aimed at FBOs, the guidance may be useful for safety and security personnel to consider. As FBOs reopen and welcome back individuals, it is possible that some may have heightened sensitivities regarding these issues and may not respond well to personnel attempting to enforce safety actions. FBOs should prepare “frontline” staff and volunteers regarding how to engage personnel, when to ask for help from senior personnel, and other considerations to prepare them to effectively communicate and assist visitors.
    • The Winter Holiday Season. As we move into fall, holidays and celebrations continue, with annual major events to include Hanukkah (10-18 Dec), Christmas Eve / Christmas Day (24, 25 Dec) and New Year’s events, the possibility of potential targeting of FBOs and people of faith may increase. A less direct threat to FBOs but one that may impact members and visitors of FBOs is the continued concern around increased domestic violence during the pandemic. Since at least this summer there have been concerns over the “shadow pandemic” of violence against intimate partners – particularly women. A recent post notes, “Cases of violence against women have surged in 2020. According to the United Nations Population Fund, for every three months the COVID-19 lockdown continues, an additional 15 million women are expected to be directly affected by violence.” Domestic violence and continued stress relating to new COVID restrictions may have cascading implications to FBOs.

    Concerns Regarding the Cyber Threat Level

    FB-ISAO assess the current volume of coronavirus-related cyber attack campaigns continues to recede and the pre-pandemic frequency of non-coronavirus lures is consistent with a general “GUARDED” posture. While we assess remaining at “GUARDED” is reasonable, increased vigilance is still recommended due to the ongoing pandemic and associated concerns and distractions. Furthermore, as the holiday shopping season is upon us, members are urged to treat every sale and solicitation communication with suspicion. Likewise, members are encouraged to review the #cybersecurity channel in FB-ISAO Slack for a general level of awareness to on-going incidents.

    As we offer the constant reminder that WE ARE ALL TARGETS of opportunity, the following are general considerations for continued vigilance:

    • Gift Card Impersonation Scams. As highlighted in a recent FB-ISAO blog post, an increase in holiday bonus gift card impersonation phishing scams should be anticipated. Scammers are highly likely to use the “after such a challenging year” ploy to cajole COVID-weary employees or volunteers into unwitting accomplices to help the boss secretly procure gift cards to use for things like company bonuses or charitable donations. But whatever the financial or information-stealing theme, employees should be repeatedly reminded to never act on such requests. But since it may be excruciatingly difficult to tell the boss “no,” it is up to bosses and leaders to empower employees and volunteers to NOT act and to report said activity. Likewise, it is up to bosses and leaders to make any legitimate special, secret, or surprise requests in-person, and not through an email or text. For more tips on shopping safely this holiday season, visit the resources at NCSA and CISA.
    • Phishing. Cyber tactics such as phishing, smishing (SMS phishing), vishing (voice phishing), whaling (targeting of high-profile targets), disinformation/misinformation, and counterfeit websites leveraging current events represent a perpetual threat. Phishing is most often associated and expected with financially motivated cybercrime attacks. However, advanced persistent threat (APT) groups motivated by espionage also leverage phishing, as highlighted by recently observed activity targeting entities – including religious organizations – associated with diplomatic relations. This recent report by Proofpoint describes activity targeting entities involved in diplomatic relations between The Vatican and the Chinese Communist Party.
    • On-going ransomware attacks with subsequent leaked data. Ransomware continues impacting organizations of all types and sizes, including a recently reported attack against televangelist Kenneth Copeland. Members are encouraged to review ransomware and data breach playbooks, policies, and procedures with staff and MSPs and discuss necessary actions should ransomware impact your organization or third party partners. For more on ransomware preparedness and response, see the Ransomware Guide from CISA and the MS-ISAC.
    • Continued “Zoombombing.” Faith-based organizations continue to experience disturbing and heart-wrenching “Zoombombing” incidents. Many Zoombombing incidents occur due to public posting of meeting links and often deficient procedures when hosting such videoconferencing events. Members are encouraged to review the security settings on their video-conferencing platforms and apply best practices and procedures to reduce the risk from this prevalent disturbance. Most teleconference platform vendors have published tips for maintaining secure meetings and FB-ISAO has previously shared tips for securing online events. Please contact our team with questions.
    • Mis/disinformation is still a concern. Mis/disinformation continues to spread regarding coronavirus related and other highly charged matters, including post-election activity. It is imperative to think critically and continue verifying everything. Visit CISA’s #Protect2020 resources, including the Disinformation Stops With You infographic to better understand the continued threats to the election process.
    • #BlueLeaks. While there is nothing significant to report, we continue to stress the need to exercise vigilance when receiving communications purporting to come from any impacted organization, including FB-ISAO, fusion centers, and law enforcement entities.
    • Continue enabling/encouraging remote staff to work securely. As organizations continue prolonged or permanent work from home models, it is important to promote a secure remote work environment. To enable safe telecommuting, review CISA’s Telework Guidance and Resources page and StaySafeOnline’s COVID-19 Security Resource Library.
    • Continue providing threat awareness training to staff. There are many open source examples of emails, lures, images, and indicators of compromise being shared daily in the FB-ISAO Daily Journal. Consider appropriate ways to use that information to educate and better prepare staff. FB-ISAO is happy to help develop education and cybersecurity awareness materials for dissemination.

    Please contact our team with any questions, needs for information, assistance or any other concerns.

    • We encourage members to review the FB-ISAO Daily Journal for general threat awareness, updates and ideas on what other organizations are doing.
    • Join the #covid-19, #protest_awareness, #cybersecurity, #terrorism_us and other topical channels in FB-ISAO Slack to see more updates, reports, and conversation on threats, and to share your questions, ideas, and actions for others.

    This assessment has been developed by FB-ISAO and is our general, nationwide, cyber threat assessment for the U.S. community of faith. As always, for local threat information, members are encouraged to work closely with neighborhood partners, local law enforcement, state and local fusion centers, local FBI field offices, DHS Protective Security Advisors (PSAs), Cybersecurity Advisors (CSAs), and other local experts and responders.

  • November 2020: FB-ISAO Physical Threat Level Remains SEVERE; Cyber Threat Level Remains GUARDED

    November 2020: FB-ISAO Physical Threat Level Remains SEVERE; Cyber Threat Level Remains GUARDED

    This message is TLP:WHITE. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.

    The ongoing COVID-19 global pandemic is a complex and blended threat impacting members and the broader faith-based and charity community in numerous ways and that continues to impact security and response, both to manmade and natural threats. FB-ISAO’s Threat and Incident Response Group (TIG) continues to assess the ongoing threats and risks to our community and has made the following updates to our Threat Level Assessments:

    The TIG has determined to maintain the Physical Threat Level at “SEVERE.” SEVERE means an event is highly likely. Given the ongoing threat of the COVID-19 pandemic and the approaching U.S. winter season and associated health concerns, we have determined to maintain the broad Physical Threat Level at SEVERE and anticipate this level being maintained until a decrease in the threat of the pandemic (such as via an effective vaccine being administered) and / or the end of the winter health threats. The TIG will continue to assess the Physical Threat Level regularly and provide updates accordingly. This determination will be periodically re-evaluated, especially with respect to non-COVID-19-related threats.

    The TIG has determined to maintain the Cyber Threat Level at “GUARDED.” GUARDED means FB-ISAO is unaware of any specific or targeted cyber attacks, but a general risk of cyber attacks exist. The TIG will continue to assess the Cyber Threat Level and provide updates accordingly. Likewise, the cyber threat landscape will be continuously monitored, but this Cyber Threat Level determination is valid until further notice. Please see below for more statements regarding the Cyber Threat Level.

    COVID-19 Pandemic. As we continue through this pandemic, with the continued possibility of having to move back to more stringent local restrictions based on events in our communities, FB-ISAO continues to strongly encourage members “hold the line.” By hold the line, we mean continue to follow FSLTT guidance and directives and reopen, reenter and resume operations in accordance with, and not ahead of, such guidance and directives. Especially during the start of flu season, and the likely confluence of COVID-19 and annual influenza threats, members are advised to respect and adhere to FSLTT guidance.

    After the summer spike, we were encouraged by a slower trend of decreasing cases. However, continuing the trend since mid-September, cases continue to rise and at the time of this assessment, COVID-19 cases are increasing, with recent record highs and daily deaths staying generally flat with around 800 a day.  As of 27 Oct, we are approaching two million new cases since our last assessment (from 6.87 million cases in the U.S. and 200,275 deaths to 8.68 million cases and over 225,084 deaths) and as of 17 Sep, the CDC reports that the national ensemble forecasting predicts increasing numbers of anticipated deaths. Forecasting (as of 19 Oct) “3,500 to 7,600 new deaths will likely be reported during the week ending November 14, 2020. The national ensemble predicts that a total of 235,000 to 247,000 COVID-19 deaths will be reported by this date.” The likelihood of a broad second wave of COVID-19 remains very possible, particularly if individuals, organizations and communities fail to follow identified best practices to mitigate risks. As noted above, this is further complicated by annual flu season, which has the potential to complicate and overwhelm healthcare professionals and facilities. Some have referred to this as a potential “twindemic” – meaning the continuation of the COVID-19 pandemic and the start of flu season. Exacerbating these challenges is the increasing challenge of “pandemic fatigue,” as Americans grow tired of restrictions and seek to return to normalcy. While understandable, a decrease in vigilance and safety will only prolong recovery and a return to a more open and safe environment.  

    While there is a lot of conflicting reporting and varied assessments regarding the threat, and as both personally and organizationally, many are understandably feeling pandemic fatigue, the coronavirus remains an active health threat with the potential to lead to local outbreaks or broader flare-ups, particularly if established best practices such as social distancing and mask wearing are not followed. With the resumption of K-12 and higher education, and some areas moving towards further “opening up” onsite learning, coupled with upcoming holidays that often include larger gatherings of friends and families, we remain in a higher risk period.

    Worth noting, many FBOs have begun reopening over the last few months and by applying smart practices and safety measures, they have been able to avoid outbreaks at their facilities and among their congregations. These successes are commendable but recognizing success should not lead to complacency or a false sense that the threat has passed. As we wrestle with pandemic fatigue we also need to avoid the danger of overconfidence. Outbreaks can happen quickly and lead to closures and broad infections, as has been observed in communities and FBOs around the country. For those that have been successful, we encourage you to maintain discipline and hold on to your success.

    As leaders, we encourage members to fight complacency and fatigue. FBOs should not base policies or enforcement on personal feelings, politics, or other subjective considerations. While as individuals we may agree or disagree with specific measures, FB-ISAO continues to strongly discourage defying state and local guidance and directives and encourages members to reopen, reenter and resume operations in accordance with government guidance and directives.

    Also important to note, as the 2020 election season winds up and we move into the post-election period, the pandemic, government data and guidance and other information continue to be politicized and questioned – some valuably, some politically, and some deliberately by those who seek to cause confusion and harm via disinformation activities. Again, we encourage members to adhere to established best practices such as social distancing and mask wearing, and to make informed decisions based on observable data, not personal or political feelings.

    Beyond the explicit health threat, we have other security concerns, including:

    • Protests. On 01 June we assessed that “protests relating to the death of George Floyd and racial issues take on a political dimension, it is also possible extremists could choose to target predominantly African American places of worship.” In the ensuing months, we have seen that come to fruition and be further complicated by several additional incidents of excessive use of force resulting in death or serious injury as well as the 23 Sep Breonna Taylor decision. As we write this threat assessment update, protests have been ongoing in Philadelphia, Washington, D.C., and New York City, all relating to excessive use of force issues. At some of these prior and ongoing events, FBOs and people of faith have experienced acts of violence and vandalism from varied actors. Recent examples include election-related events in New York and recent incidents relating to the October protests in Philadelphia. Whether seen as supportive of protests – directly, logistically, or as sanctuaries or meeting places – or if seen as being opposed to protests, FBOs have been attacked from both sides. Given recent events, ongoing protests, a tense political election season, and other considerations, we continue to assess protests may pose direct and indirect risks to FBOs.
    • Hostile Events and the Targeting of FBOs and African-American People and Facilities. As acts of violence, vandalism and arson are being reported regularly in the FB-ISAO Daily Journal, including hate crimes including spray-painting hate symbols and the destruction of statues, it is important to note there are often connections between other issues and events and actions that may be taken at FBOs. On 01 June we assessed that “protests relating to the death of George Floyd and racial issues take on a political dimension, it is also possible extremists could choose to target predominantly African American places of worship.” In the ensuing months, we have seen that come to fruition and be further complicated by several additional incidents of excessive use of force resulting in death or serious injury. Organizations supportive of protesters and those showing support for law enforcement, and organizations targeted for various other issues, and in some cases just as targets of opportunity and representing faith, have all been targeted by a variety of types of aggression and violence – at facilities, on statues, with threats, and more. This is unlikely to change in our current environment.
    • Disgruntled Individuals. Individuals who do not agree with positions taken by an FBO during periods of closure and reopening may take action against those organizations or others. We have continued to see various protests and violent actions aimed at individuals enforcing safety procedures. On 24 Aug, the CDC released Limiting Workplace Violence Associated with COVID-19 Prevention Policies in Retail and Services Businesses. While not aimed at FBOs, the guidance may be useful for safety and security personnel to consider. As FBOs reopen and welcome back individuals, it is possible that some may have heightened sensitivities regarding these issues and may not respond well to personnel attempting to enforce safety actions. FBOs should prepare “frontline” staff and volunteers regarding how to engage personnel, when to ask for help from senior personnel, and other considerations to prepare them to effectively communicate and assist visitors.

    “Many… violent extremists, both domestic and international, are motivated and inspired by a mix of ideological, sociopolitical, and personal grievances against their targets, which recently have more and more included large public gatherings, houses of worship… Trends may shift, but the underlying drivers for domestic violent extremism—such as perceptions of government or law enforcement overreach, sociopolitical conditions, racism, anti-Semitism, Islamophobia, misogyny, and reactions to legislative actions—remain constant. As stated above, the FBI is most concerned about lone offender attacks, primarily shootings…” – FBI Director Wray, in remarks to the U.S. Senate in September 2020.,

    • U.S. Elections and Events. Presidential elections, particularly during times of adversity, such as with the pandemic and associated economic impacts, or relating to other emotional topics, can lead to a highly-charged atmosphere and pose associated risks to FBOs in the area which may not be directly targeted by indirectly implicated. As election-related activities and rhetoric increase in the final days of the election season and as we move to the post-election period and the possibility of delayed decisions of winners, it is possible that political rallies may see protests and counter-protests – aimed at politicians, groups, or places of worship where events may be held. Such concerns are not limited to any party or individual but are a possibility for any political event occurring at or near an FBO. Such incidents have occurred in October across the country, to include at events where faith-based groups showing support for a candidate have seen violence. Given the possibility of a prolonged period of time to identify winners from November’s elections, tensions may be elevated for some time, and after results are announced. FBOs should remain mindful of local events and tensions as they assess threats and security needs.
    • The Winter Holiday Season. As we move into fall, holidays and celebrations continue, with annual major events from Thanksgiving to December’s Hanukkah (10-18 Dec), Christmas Eve / Christmas Day (24, 25 Dec) and New Year’s events, the possibility of potential targeting of FBOs and people of faith may increase. At this point, it is difficult to anticipate how holiday events may be conducted, and what the political and protest environments may be like at those times.

    Regarding the Cyber Threat Level, FB-ISAO assess the current volume of coronavirus-related cyber attack campaigns continues to recede and the pre-pandemic frequency of non-coronavirus lures is consistent with a general “GUARDED” posture. While we assess remaining at “GUARDED” is reasonable, increased vigilance is still recommended due to the ongoing pandemic, continued widespread teleworking, abundance of information and updates from legitimate and less-established sources (including social media and unofficial expert blogs), and commensurate distractions in businesses and homes across the U.S., among other considerations.

    As we offer the constant reminder that we are all targets of opportunity, the following are general considerations for continued vigilance:

    • Phishing. Cyber tactics such as phishing, smishing (SMS phishing), vishing (voice phishing), disinformation/misinformation, and counterfeit websites leveraging current events represent a perpetual threat.
    • On-going ransomware attacks with subsequent leaked data. All organizations experience ransomware infections. Likewise, every organization carries a risk from a ransomware attack on a contracted third party. Data leaked from third parties could be used in spear phishing against all partners in the victim’s supply chain for a variety of goals, including distributing more ransomware. Members are encouraged to review ransomware and data breach playbooks, policies, and procedures with staff and MSPs, or at least discuss necessary actions should ransomware impact your organization or one of your third party partners. For more on ransomware preparedness and response, see the Ransomware Guide from CISA and the MS-ISAC.
    • Continued “Zoombombing.” Faith-based organizations continue to experience “Zoombombing” incidents. While these incidents are indeed disturbing and often heart-wrenching, Zoom and other video-conferencing providers have made great strides to provide the settings, even default settings necessary to significantly reduce occurrences of such lewd and disrupting attacks. Many Zoombombing incidents occur due to public posting of meeting links and often deficient procedures when hosting such videoconferencing events. Members are encouraged to review the security settings on their video-conferencing platforms and apply best practices and procedures to reduce the risk from this prevalent disturbance. Most teleconference platform vendors have published tips for maintaining secure meetings and FB-ISAO has previously shared tips for securing online events. Please contact our team with questions.
    • Mis/disinformation is still a concern. Mis/disinformation continues to spread regarding coronavirus related and other highly charged matters, including elections. Disinformation is being increasingly spread by various entities for disruption, deceit, and even to discredit legitimate government efforts, including the integrity of American elections. It is imperative to think critically and continue verifying everything. Visit CISA’s #Protect2020 resources, including the Disinformation Stops With You infographic to better understand the evolving threats to the election systems.
    • #BlueLeaks. While there is nothing significant to report, we continue to stress the need to exercise vigilance when receiving communications purporting to come from any impacted organization, including FB-ISAO, fusion centers, and law enforcement entities.
    • Continue enabling/encouraging remote staff to work securely. As organizations continue prolonged or permanent work from home models, it is important to promote a secure remote work environment. To enable safe telecommuting, review CISA’s Telework Guidance and Resources page and StaySafeOnline’s COVID-19 Security Resource Library.
    • Continue providing threat awareness training to staff. There are many open source examples of emails, lures, images, and indicators of compromise being shared daily in the FB-ISAO Daily Journal. Consider appropriate ways to use that information to educate and better prepare staff. FB-ISAO is happy to help develop education and cybersecurity awareness materials for dissemination.

    Please contact our team with any questions, needs for information, assistance or any other concerns.

    • We encourage members to review the FB-ISAO Daily Journal for general threat awareness, updates and ideas on what other organizations are doing.
    • Join the #covid-19, #protest_awareness, #cybersecurity, #terrorism_us and other topical channels in FB-ISAO Slack to see more updates, reports, and conversation on threats, and to share your questions, ideas, and actions for others.

    This assessment has been developed by FB-ISAO and is our general, nationwide, cyber threat assessment for the U.S. community of faith. As always, for local threat information, members are encouraged to work closely with neighborhood partners, local law enforcement, state and local fusion centers, local FBI field offices, DHS Protective Security Advisors (PSAs), Cybersecurity Advisors (CSAs), and other local experts and responders.

  • October 2020: FB-ISAO Physical Threat Level Remains SEVERE; Cyber Threat Level Remains GUARDED

    October 2020: FB-ISAO Physical Threat Level Remains SEVERE; Cyber Threat Level Remains GUARDED

    This message is TLP:WHITE. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.

    The ongoing COVID-19 global pandemic is a complex and blended threat impacting members and the broader faith-based and charity community in numerous ways and that continues to impact security and response, both to manmade and natural threats. FB-ISAO’s Threat and Incident Response Group (TIG) continues to assess the ongoing threats and risks to our community and has made the following updates to our Threat Level Assessments:

    The TIG has determined to maintain the Physical Threat Level at “SEVERE.” SEVERE means an event is highly likely. Given the ongoing threat of the COVID-19 pandemic and the approaching U.S. winter season and associated health concerns, we have determined to maintain the broad Physical Threat Level at SEVERE and anticipate this level being maintained until a decrease in the threat of the pandemic (such as via an effective vaccine being administered) and / or the end of the winter health threats. The TIG will continue to assess the Physical Threat Level regularly and provide updates accordingly. This determination will be periodically re-evaluated, especially with respect to non-COVID-19-related threats.

    The TIG has determined to maintain the Cyber Threat Level at “GUARDED.” GUARDED means FB-ISAO is unaware of any specific or targeted cyber attacks, but a general risk of cyber attacks exist. The TIG will continue to assess the Cyber Threat Level and provide updates accordingly. Likewise, the cyber threat landscape will be continuously monitored, but this Cyber Threat Level determination is valid until further notice. Please see below for more statements regarding the Cyber Threat Level.

    COVID-19 Pandemic. As we continue through this pandemic, with the continued possibility of having to move back to more stringent local restrictions based on events in our communities, FB-ISAO continues to strongly encourage members “hold the line.” By hold the line, we mean continue to follow FSLTT guidance and directives and reopen, reenter and resume operations in accordance with, and not ahead of, such guidance and directives. Especially during the start of flu season, and the likely confluence of COVID-19 and annual influenza threats, members are advised to respect and adhere to FSLTT guidance.

    After the summer spike, we were encouraged by a slower trend of decreasing cases. However, at the time of this assessment, COVID-19 cases are increasing, and daily deaths are not notably decreasing.  As of 24 Sep, there are over a million new cases since our last assessment (from 5.75 million cases in the U.S. and nearly 178,000 deaths to 6.87 million cases and 200,275 deaths) and as of 17 Sep, the CDC reports that the national ensemble forecasting “predicts that 3,000 to 7,100 new deaths will likely be reported during the week ending October 10, 2020. The national ensemble predicts that a total of 207,000 to 218,000 COVID-19 deaths will be reported by this date.” The likelihood of a broad second wave of COVID-19 remains very possible,  particularly if individuals, organizations and communities fail to follow identified best practices to mitigate risks. As noted above, this is further complicated by annual flu season, which has the potential to complicate and overwhelm healthcare professionals and facilities. Some have referred to this as a potential “twindemic” – meaning the continuation of the COVID-19 pandemic and the start of flu season.

    While there is a lot of conflicting reporting and varied assessments regarding the threat, and as both personally and organizationally, many are understandably feeling pandemic fatigue, the coronavirus remains an active health threat with the potential to lead to local outbreaks or broader flare-ups, particularly if established best practices such as social distancing and mask wearing are not followed. Especially with the resumption of K-12 and higher education, couple with upcoming holidays that often include larger gatherings of friends and families, we remain in a higher risk period. As leaders, we encourage members to fight complacency and fatigue. FBOs should not base policies or enforcement on personal feelings, politics, or other subjective considerations. While as individuals we may agree or disagree with specific measures, FB-ISAO continues to strongly discourage defying state and local guidance and directives and encourages members to reopen, reenter and resume operations in accordance with government guidance and directives.

    Also important to note, as the 2020 election season continues, the pandemic, government data and guidance and other information are being politicized and questioned – some valuably, some politically, and some deliberately by those who seek to cause confusion and harm via disinformation activities. Again, we encourage members to adhere to established best practices such as social distancing and mask wearing, and to make informed decisions based on observable data, not personal or political feelings.

    Beyond the explicit health threat, we have other security concerns, including:

    • Protests. On 01 June we assessed that “protests relating to the death of George Floyd and racial issues take on a political dimension, it is also possible extremists could choose to target predominantly African American places of worship.” In the ensuing months, we have seen that come to fruition and be further complicated by several additional incidents of excessive use of force resulting in death or serious injury as well as the 23 Sep Breonna Taylor decision. FBOs and people of faith have experienced acts of violence and vandalism from varied actors. Whether seen as supportive of protests – directly, logistically, or as sanctuaries or meeting places – or if seen as being opposed to protests, FBOs have been attacked from both sides. Given recent events, ongoing protests, a tense political election season, and other considerations, we continue to assess protests may pose direct and indirect risks to FBOs.
    • Hostile Events and the Targeting of African-American People and Facilities. As acts of violence, vandalism and arson are being reported regularly in the FB-ISAO Daily Journal, including hate crimes including spray-painting hate symbols and the destruction of statues, it is important to note there are often connections between other issues and events and actions that may be taken at FBOs. On 01 June we assessed that “protests relating to the death of George Floyd and racial issues take on a political dimension, it is also possible extremists could choose to target predominantly African American places of worship.” In the ensuing months, we have seen that come to fruition and be further complicated by several additional incidents of excessive use of force resulting in death or serious injury. Threats and hostile events have occurred at FBOs, to include predominantly African-American churches such as in Virginia and Kentucky. As Black Lives Matters broadly and Breonna Taylor decision-related and associated protests continue, this remains a concern. Underscoring these concerns, a 30 Aug arrest for attempted arson, burglary of a building and criminal mischief followed a Texas man’s suspected attempt to damage a predominantly African American church in Queen City, Texas. Other acts of vandalism and destruction have occurred at FBOs relating to racial issues.
    • Disgruntled Individuals. Individuals who do not agree with positions taken by an FBO during periods of closure and reopening may take action against those organizations or others. We have continued to see various protests and violent actions aimed at individuals enforcing safety procedures. On 24 Aug, the CDC released Limiting Workplace Violence Associated with COVID-19 Prevention Policies in Retail and Services Businesses. While not aimed at FBOs, the guidance may be useful for safety and security personnel to consider. As FBOs reopen and welcome back individuals, it is possible that some may have heightened sensitivities regarding these issues and may not respond well to personnel attempting to enforce safety actions. FBOs should prepare “frontline” staff and volunteers regarding how to engage personnel, when to ask for help from senior personnel, and other considerations to prepare them to effectively communicate and assist visitors.

    “Many… violent extremists, both domestic and international, are motivated and inspired by a mix of ideological, sociopolitical, and personal grievances against their targets, which recently have more and more included large public gatherings, houses of worship… Trends may shift, but the underlying drivers for domestic violent extremism—such as perceptions of government or law enforcement overreach, sociopolitical conditions, racism, anti-Semitism, Islamophobia, misogyny, and reactions to legislative actions—remain constant. As stated above, the FBI is most concerned about lone offender attacks, primarily shootings…” – FBI Director Wray, in remarks to the U.S. Senate in September 2020.

    • U.S. Elections and Events. Presidential elections, particularly during times of adversity, such as with the pandemic and associated economic impacts, or relating to other emotional topics, such as the removal of statues and monuments, can lead to a highly-charged atmosphere and pose associated risks to FBOs in the area which may not be directly targeted by indirectly implicated. During both the Democratic and Republican political conventions, the community of faith was one of significant attention. As election-related activities and rhetoric increase in the final weeks of the election season, it is possible that political rallies may see protests and counter-protests – aimed at politicians, groups, or places of worship where events may be held. Such concerns are not limited to any party or individual but are a possibility for any political event occurring at or near an FBO. Additionally, given the possibility of a prolonged period of time to identify winners from November’s elections, tensions may be elevated for some time, and after results are announced. FBOs should remain mindful of local events and tensions as they assess threats and security needs.
    • The Winter Holiday Season. As we move into fall, holidays and celebrations continue, with annual major events from Thanksgiving to December’s Hanukkah (10-18 Dec), Christmas Eve / Christmas Day (24, 25 Dec) and New Year’s events, the possibility of potential targeting of FBOs and people of faith may increase. At this point, it is difficult to anticipate how holiday events may be conducted, and what the political and protest environments may be like at those times.

    Regarding the Cyber Threat Level, FB-ISAO assess the current volume of coronavirus-related cyber attack campaigns continues to recede and the pre-pandemic frequency of non-coronavirus lures is consistent with a general “GUARDED” posture. While we assess remaining at “GUARDED” is reasonable, increased vigilance is still recommended due to the ongoing pandemic, continued widespread teleworking, abundance of information and updates from legitimate and less-established sources (including social media and unofficial expert blogs), and commensurate distractions in businesses and homes across the U.S., among other considerations.

    Comment on #BlueLeaks: While there is nothing significant to report, due to members’ close partnerships with all impacted entities, including FB-ISAO, fusion centers, and law enforcement, this incident still represents a threat from actors who may try to leverage those trusted relationships in the future to phish (email or phone) for more information. We continue to stress the need to exercise extreme vigilance when receiving communications purporting to come from any impacted organization, particularly ones in your region.

    Additional considerations for continued increased vigilance:

    • Ransomware running rampant. Municipalities, education institutions, healthcare, and mega-corporations are not the only organizations to experience ransomware infections. During the past two weeks, multiple houses of worship and other faith-based organizations have fallen victim – see FB-ISAO Cyber Advisory, 17 September 2020 for a discussion on two houses of worship that we became aware of at that time. The scope of the attacks has included the encryption (file/system locking) component and the data breach/leak component, as has become commonplace in recent months. Prior to ransomware adopting the data breach paradigm, organizations likely only experienced a service impact while the third party victim recovered from the unfortunate incident. Nowadays, every organization carries a risk from a ransomware attack on a contracted third party. Data leaked from third parties could be used in spearphishing against all partners in the victim’s supply chain for a variety of goals, including distributing more ransomware. Members are encouraged to review ransomware and data breach playbooks, policies, and procedures with staff and MSPs, or at least discuss necessary actions should ransomware impact your organization or one of your third party partners. This Forrester report provides some salient points about dealing with ransomware.
    • Zoombombing. Faith-based organizations continue to experience “Zoombombing” incidents. While these incidents are indeed disturbing and often heart-wrenching, Zoom and other video-conferencing providers have made great strides to provide the settings, even default settings necessary to significantly reduce occurrences of such lewd and disrupting attacks. Many Zoombombing incidents occur due to public posting of meeting links and often deficient procedures when hosting such videoconferencing events. A spokesman involved in an incident over the weekend took onus by stating, “As a result we have increased our security and changed our processes and are confident that all future meetings can go ahead without any further issues.” Members are encouraged to review the security settings on their video-conferencing platforms and apply best practices and procedures to reduce the risk from this prevalent disturbance. Most vendors have published tips for maintaining secure meetings and FB-ISAO has previously shared tips for securing online events. Please contact our team with questions.
    • Mis/disinformation is still a concern. Mis/disinformation continues to spread regarding coronavirus related and other highly charged matters, including elections. Disinformation is being increasingly spread by various entities for disruption, deceit, and even to discredit legitimate government efforts, including the integrity of American elections. It is imperative to think critically and continue verifying everything. Visit CISA’s #Protect2020 resources, including the Disinformation Stops With You infographic to better understand the evolving threats to the election systems.
    • Emotet – Beating a Dead Trojan Horse. Despite the title, Emotet is far from dead. The title is meant to grab your attention because the persistence of this epoch of everybody’s everlasting email enemy remains worthy of mention, again. There have been numerous reports from fusion centers, partner ISAC’s, and others reporting a notable increase in Emotet phishing activity during the past week. Emotet is a virulent email threat often used to spread additional malware, including ransomware. Emotet is complex in its functionality and crafty in its campaigns. One of the most notable behaviors is its ability to hide in plain sight by hijacking existing email threads and attachments to emulate something you expect to receive in your inbox. If you receive messages with attention grabbing subjects such as, “Termination list,” “Can’t call you,” “Annual bonus report is ready,” “Payment Remittance Advice” or similar invoice-themed, it might just be Emotet. If you are seeing those subjects or similar, please report what you are seeing to FB-ISAO. Likewise, members are reminded to keep staff and volunteers aware of this and similar phishing attacks. The NCSAM resources below are great tools to help with security awareness.
    • Zerologon/Microsoft Netlogon Remote Protocol Vulnerability. “Zerologon,” a vulnerability affecting Microsoft’s Netlogon Remote Protocol that Microsoft provided a patch for in August is getting a lot of attention from both the security community and attackers. Likewise, there has been significant exploit activity observed concerning this critical vulnerability. Multiple alerts, advisories, and research have been published urging administrators to “patch now.” This vulnerability is rather trivial to exploit and a successful compromise will take complete control over your network domain. Given the advisories, a CISA Emergency Directive 20-04 – “Mitigate Netlogon Elevation of Privilege Vulnerability from August 2020 Patch Tuesday,” and what some researchers consider the most dangerous bug revealed this year, members are urged to ensure their IT teams/managed service providers (MSPs) address this vulnerability now, if they have not already. Microsoft has published updated guidance on applying the patch.

    We offer a constant reminder that we are all targets of opportunity. Cyber tactics such as phishing, smishing (SMS phishing), vishing (voice phishing), disinformation/misinformation, and counterfeit websites leveraging current events represent a perpetual threat.

    • Continue enabling/encouraging remote staff to work securely. As organizations consider a prolonged or even permanent work from home model, it is important to deliberate on the best strategy to promote a secure remote work environment. Staff who continue working remotely may require procurement and configuration of new devices, network infrastructure, and services to securely support extended offsite working. To enable safe telecommuting, review CISA’s Telework Guidance and Resources page and StaySafeOnline’s COVID-19 Security Resource Library.
    • Continue providing threat awareness training to staff. There are many open source examples of emails, lures, images, and indicators of compromise being shared daily in the FB-ISAO Daily Journal. Consider appropriate ways to use that information to educate and better prepare staff. FB-ISAO is happy to help develop education and cybersecurity awareness materials for dissemination. Likewise, with October being National Cybersecurity Awareness Month (NCSAM), members are encouraged to check out associated NCSAM resources, “Do Your Part. #BeCyberSmart.”, and join FB-ISAO as an NCSAM 2020 Champion!

    Please contact our team with any questions, needs for information, assistance or any other concerns.

    • We encourage members to review the FB-ISAO Daily Journal for general threat awareness, updates and ideas on what other organizations are doing.
    • Join the #covid-19, #protest_awareness, #cybersecurity, #terrorism_us and other topical channels in FB-ISAO Slack to see more updates, reports, and conversation on threats, and to share your questions, ideas, and actions for others.

    This assessment has been developed by FB-ISAO and is our general, nationwide, cyber threat assessment for the U.S. community of faith. As always, for local threat information, members are encouraged to work closely with neighborhood partners, local law enforcement, state and local fusion centers, local FBI field offices, DHS Protective Security Advisors (PSAs), Cybersecurity Advisors (CSAs), and other local experts and responders.

  • September 2020: FB-ISAO Physical Threat Level Remains SEVERE; Cyber Threat Level Remains GUARDED

    September 2020: FB-ISAO Physical Threat Level Remains SEVERE; Cyber Threat Level Remains GUARDED

    This message is TLP:WHITE. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.

    The ongoing COVID-19 global pandemic is a complex and blended threat impacting members and the broader faith-based and charity community in numerous ways and that continues to impact security and response, both to manmade and natural threats. FB-ISAO’s Threat and Incident Response Group (TIG) continues to assess the ongoing threats and risks to our community and has made the following updates to our Threat Level Assessments:

    The TIG has determined to maintain the Physical Threat Level at “SEVERE.” SEVERE means an event is highly likely. The TIG will continue to assess the Physical Threat Level and provide updates accordingly. This determination is valid through sunset on 30 Sep 2020, and will be periodically re-evaluated, especially with respect to ongoing threats and developing federal, state, local, tribal, and territorial (FSLTT / SLTT) guidance and directives.

    The TIG has determined to maintain the Cyber Threat Level at “GUARDED.” GUARDED means FB-ISAO is unaware of any specific or targeted cyber attacks, but a general risk of cyber attacks exist. The TIG will continue to assess the Cyber Threat Level and provide updates accordingly. Likewise, the cyber threat landscape will be continuously monitored, but this Cyber Threat Level determination is valid until further notice.

    Reopening America. Across the country, many FBOs have reopened or are preparing to reopen, while others have elected to continue to suspend in-person activities (some determining to do that through at least the rest of 2020). As we continue in the process of reopening, with the possibility of having to move back to more stringent restrictions or delays in continued reopening based on events in our local communities, FB-ISAO continues to strongly encourage members “hold the line.” By hold the line, we mean continue to follow FSLTT guidance and directives and reopen, reenter and resume operations in accordance with, and not ahead of, such guidance and directives.

    While recent COVID-19 numbers are somewhat encouraging, there are many ways that minor progress can quickly evaporate as some return to work and places of worship and to the many that returning to schools across the country. As of 26 Aug, there are 5.75 million cases in the U.S. and nearly 178,000 deaths and as of 21 Aug, the CDC reports that the “national ensemble forecast predicts that 3,700 to 9,600 new COVID-19 deaths will be reported during the week ending September 12 and that 187,000 to 205,000 total COVID-19 deaths will be reported by that date.” While personally and organizationally, many are understandably feeling pandemic fatigue, the coronavirus remains an active health threat with the potential to lead to local outbreaks or broader flare-ups, particularly if established best practices such as social distancing and mask wearing are not followed. As leaders, we encourage members to fight complacency and fatigue. FBOs should not base policies or enforcement on personal feelings, politics, or other subjective considerations. While as individuals we may agree or disagree with specific measures, FB-ISAO continues to strongly discourage defying state and local guidance and directives and encourages members to reopen, reenter and resume operations in accordance with government guidance and directives.

    Regarding the Physical Threat Level, coronavirus remains a serious threat in the United States, with various states and local communities experiencing increasing infection numbers and with local outbreaks related to gatherings at FBOs in various areas around the country and observed internationally.

    A health threat poses a challenge in assessing a threat level. In accordance with FB-ISAO’s threat levels, in many respects we are still in a “CRITICAL” phase, given that the pandemic remains very active and that further outbreaks are expected as reopening continues. The likelihood of a broad second wave of COVID-19 remains very possible, particularly if individuals, organizations and communities fail to follow identified best practices to mitigate risks. This is further complicated by annual flu season, which has the potential to complicate and overwhelm healthcare professionals and facilities. Some have referred to this as a potential “twindemic” – meaning the continuation of the COVID-19 pandemic and the start of flu season.

    Beyond the explicit health threat, we have other security concerns, including:

    • As noted above, SEVERE means we believe an event is highly likely. With respect to our current environment and this assessment, we assess an event to be one of two types:
      • Local Outbreak. The possibility of local COVID-19 outbreaks remains very possible. FBOs in particular may experience rapid spread and infection if infected individuals are exposed to larger groups, as has been observed in various local outbreaks (see CDC case study, Arkansas, March 2020).
      • Hostile Events. In addition to routine threats, additional stressors may increase challenges for FBOs. That concern is raised in former CISA Assistant Director Harrell’s 08 Apr letter to the faith-based community. There are also other challenges that could lead to hostile events or provide opportunities for individuals or small groups to conduct acts of violence.
        • Protests & Targeting of African-American People and Facilities. On 01 June we assessed that “protests relating to the death of George Floyd and racial issues take on a political dimension, it is also possible extremists could choose to target predominantly African American places of worship.” In the ensuing months, we have seen that come to fruition and be further complicated by several additional incidents of excessive use of force resulting in death or serious injury. Threats and hostile events have occurred at FBOs, to include predominantly African-American churches such as in Virginia and Kentucky. As Black Lives Matters and associated protests continue, this remains a concern. Further, additional protests continue in parts of the country and may pose indirect threats and associated risks to FBOs.
        • Protests & Targeting Other People of Faith. As domestic protests demand law enforcement resources, some extremists have suggested using that as an opportunity for attacks against people of faith – and synagogues specifically. We have seen this occur internationally and remain concerned about the possibility of domestic incidents.
        • September’s Jewish High Holidays. September will see the major Jewish holidays of Rosh Hashanah (18-20 Sep) and Yom Kippur (27-28 Sep). As FBOs reopen and seek to conduct gatherings, many are considering holding large outdoor events. While this reduces risks associated with COVID-19, large outdoor mass gatherings present complex security events and potentially enticing targets for those that would seek to do harm. Major religious celebrations are easily identified and can be used to conduct media attention-getting attacks. Last year’s Poway Synagogue shooting (California) occurred on the last day of Passover. Members are encouraged to balance the desire for gatherings with their ability to effectively secure such events and are strongly encouraged to discuss plans with local law enforcement and fusion centers to gain local expertise regarding threats, security, and other considerations that may inform decisions and planning.
        • Disgruntled Individuals. Individuals who do not agree with positions taken by an FBO during periods of closure and reopening may take action against those organizations or others.  
        • Political Events. Presidential elections, particularly during times of adversity, such as with the pandemic and associated economic impacts, or relating to other emotional topics, such as the removal of statues and monuments, can lead to a highly-charged atmosphere and pose associated risks to FBOs in the area which may not be directly targeted by indirectly implicated. During both the Democratic and Republican political conventions, the community of faith was one of significant attention. As election-related activities increase in the months ahead, especially after the Labor Day weekend, it is possible that political rallies may see protests and counter-protests – aimed at politicians, groups, or places of worship where events may be held. Such concerns are not limited to any party or individual but are a possibility for any political event occurring at or near an FBO.
        • The Labor Day weekend holiday, as with the 4th of July, this year will see smaller and fewer events but nonetheless, mass gatherings – perhaps FBO picnic or other local community activities – may have high visibility. Combined with some of the additional challenges and complexities of our current environment, FBOs hosting events or in proximity to planned events, should consider threats and security to their people and places.
    • There continue to be varied incidents, attacks, and threats against retail establishments and personnel relating to enforcement of safety protocols such as required wearing of masks and maintaining adequate social distancing, or the wearing of masks that incite responses from others (such as KKK or Nazi masks). This has continued with regular frequency, though FB-ISAO is unaware of any known incidents that have occurred at FBOs. On 24 Aug, the CDC released Limiting Workplace Violence Associated with COVID-19 Prevention Policies in Retail and Services Businesses. While not aimed at FBOs, the guidance may be useful for safety and security personnel to consider. As FBOs reopen and welcome back individuals, it is possible that some may have heightened sensitivities regarding these issues and may not respond well to personnel attempting to enforce safety actions. FBOs should prepare “frontline” staff and volunteers regarding how to engage personnel, when to ask for help from senior personnel, and other considerations to prepare them to effectively communicate and assist visitors.
    • As we continue to reopen and reenter FBOs, recognize the potential for violence based on the stressors of COVID-19, the threats from violent extremists, and the longstanding issues that have resulted in previous acts of violence at houses of worship.
    • There continues to be extremist interest in conducting various attacks and hostile actions against people and places of faith (to include specific anti-Semitic rhetoric relating to exploiting COVID-19 and other extremist discussion and interest in places of worship and people of faith [see previous FB-ISAO and government partner reporting]).
    • Beyond the immediate challenges, while we have yet to emerge from the “first wave,” there is a very real possibility of second and third waves until a vaccine is developed and applied nationwide. Further, many countries around the world continue on an upward trajectory and it is expected that the number of cases in many areas will continue to increase in the coming weeks.

    Regarding the Cyber Threat Level, FB-ISAO assess the current volume of coronavirus-related cyber attack campaigns continues to recede and is consistent with a general “GUARDED” posture. While there is still no shortage of coronavirus-themed cyber attack campaigns, non-coronavirus lures have more or less returned to pre-pandemic frequency. While we assess remaining at “GUARDED” is reasonable, increased vigilance is still recommended due to the ongoing pandemic, continued widespread teleworking, abundance of information and updates from legitimate and less-established sources (including social media and unofficial expert blogs), and commensurate distractions in businesses and homes across the U.S., among other considerations.

    Comment on #BlueLeaks: While there have been no significant updates, due to members’ close partnerships with all impacted entities, including FB-ISAO, fusion centers, and law enforcement, this incident still represents a threat from actors who may try to leverage those trusted relationships in the future to phish (email or phone) for more information. We cannot stress enough the need to exercise extreme vigilance when receiving communications purporting to come from any impacted organization, particularly ones in your region. For members’ awareness, FB-ISAO has been contacted by the FBI Houston Division, who is investigating this matter.

    Additional considerations for continued increased vigilance:

    • Mis/disinformation is still a concern. Mis/disinformation continues to spread regarding coronavirus related and other highly charged matters, including elections. Disinformation is being increasingly spread by various entities for disruption, deceit, and even to discredit legitimate government efforts, including the integrity of American elections. It is imperative to think critically and continue verifying everything. Visit CISA’s #Protect2020 resources, including the Disinformation Stops With You infographic to better understand the evolving threats to the election systems.
    • Ransomware running rampant. From municipalities and education institutions to healthcare and mega-corporations, no organization is safe from ransomware. In recent months, more and more ransomware attacks are including a data breach component. Prior to ransomware adopting the data breach paradigm, partner organizations likely only experienced a service impact while the third party victim recovered from the unfortunate incident. Nowadays, every partner organization carries a risk from a ransomware attack on a third party. Data leaked from third parties could be used in spearphishing against all partners in the victim’s supply chain for a variety of goals, including distributing more ransomware. Members are encouraged to review ransomware and data breach playbooks, policies, and procedures with staff and MSPs, or at least discuss necessary actions should ransomware impact your organization or one of your third-party partners. This Forrester report provides some salient points about dealing with ransomware.

    We are all targets of opportunity. Cyber tactics such as phishing, smishing (SMS phishing), vishing (voice phishing), disinformation/misinformation, and counterfeit websites leveraging coronavirus themes will continue for the foreseeable future.

    • Continue enabling/encouraging remote staff to work securely. As organizations consider a prolonged, perpetual, or even permanent work from home model, it is important to deliberate on the best strategy to promote a secure remote work environment. Staff who continue working remotely may require procurement and configuration of new devices, network infrastructure, and services to securely support extended offsite working. To enable safe telecommuting, review CISA’s Telework Guidance and Resources page and StaySafeOnline’s COVID-19 Security Resource Library.
    • Continue providing threat awareness training to staff. There are many open source examples of emails, lures, images, and indicators of compromise being shared daily in the FB-ISAO Daily Journal. Consider appropriate ways to use that information to educate and better prepare staff. FB-ISAO is happy to help develop education and cybersecurity awareness materials for dissemination.

    As we periodically update these assessments, FB-ISAO’s Preparedness Group (PG) continues to support the efforts of our broader Pandemic Recovery Group with FB-ISAO staff, PG members, and other government and industry partners, and is also liaising with the venue community in collaboration with the International Association of Venue Managers. This group has developed and released the FB-ISAO Pandemic Reopening Reentry Checklist and continues in close collaboration as we assess appropriate needs for revisions and updates. Interested in helping? Contact our team to find out how!

    Please contact our team with any questions, needs for information, assistance or any other concerns.

    • We encourage members to review the FB-ISAO Daily Journal for general threat awareness, updates and ideas on what other organizations are doing.
    • Join the #covid-19, #protest_awareness, #cybersecurity and other topical channels in FB-ISAO Slack to see more updates, reports, and conversation on threats, and to share your questions, ideas, and actions for others.

    This assessment has been developed by FB-ISAO and is our general, nationwide, cyber threat assessment for the U.S. community of faith. As always, for local threat information, members are encouraged to work closely with neighborhood partners, local law enforcement, state and local fusion centers, local FBI field offices, DHS Protective Security Advisors (PSAs), Cybersecurity Advisors (CSAs), and other local experts and responders.

  • August 2020: FB-ISAO Physical Threat Level Remains SEVERE; Cyber Threat Level Remains GUARDED

    August 2020: FB-ISAO Physical Threat Level Remains SEVERE; Cyber Threat Level Remains GUARDED

    This message is TLP:WHITE. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.

    The COVID-19 global pandemic is a complex and blended threat impacting members and the broader faith-based and charity community in numerous ways. FB-ISAO’s Threat and Incident Response Group (TIG) continues to assess the ongoing threats and risks to our community and has made the following updates to our Threat Level Assessments:

    The TIG has determined to maintain the Physical Threat Level at “SEVERE.” SEVERE means an event is highly likely. The TIG will continue to assess the Physical Threat Level and provide updates accordingly. This determination is valid through sunset on 31 Aug 2020, and will be periodically re-evaluated, especially with respect to ongoing threats and developing federal, state, local, tribal, and territorial (FSLTT / SLTT) guidance and directives.

    The TIG has determined to maintain the Cyber Threat Level at “GUARDED.” GUARDED means FB-ISAO is unaware of any specific or targeted cyber attacks, but a general risk of cyber attacks exist. The TIG will continue to assess the Cyber Threat Level and provide updates accordingly. Likewise, the cyber threat landscape will be continuously monitored, but this Cyber Threat Level determination is valid until further notice.

    Reopening America. Across the country, many FBOs have reopened or are preparing to reopen, while others have elected to continue to suspend in-person activities (some determining to do that through at least the rest of 2020). As we continue in the process of reopening, with the possibility of having to move back to more stringent restrictions or delays in continued reopening based on events in our local communities, FB-ISAO continues to strongly encourage members “hold the line.” By hold the line, we mean continue to follow FSLTT guidance and directives and reopen, reenter and resume operations in accordance with, and not ahead of, such guidance and directives.

    Several states and local communities are continuing experience new highs, though some of “hotspots” seem to be leveling off, in identified infections and deaths and CDC expects the death rate to steadily continue to climb, stating (as of 20 Jul) that “there will likely be between 160,000 and 175,000 total reported COVID-19 deaths by August 15th.” While personally and organizationally, many are understandably feeling pandemic fatigue, the coronavirus remains an active health threat with the potential to lead to local outbreaks or broader flare-ups, particularly if established best practices such as social distancing and mask wearing are not followed. As leaders, we encourage members to fight complacency and fatigue. FBOs should not base policies or enforcement on personal feelings, politics, or other subjective considerations. While as individuals we may agree or disagree with specific measures, FB-ISAO strongly discourages defying state and local guidance and directives and encourages members to reopen, reenter and resume operations in accordance with government guidance and directives.

    Regarding the Physical Threat Level, coronavirus remains a serious threat in the United States, with various states and local communities experiencing increasing infection numbers and with several recent local outbreaks related to gatherings at FBOs, such as:

    A health threat poses a challenge in assessing a threat level. In accordance with FB-ISAO’s threat levels, in many respects we are still in a “CRITICAL” phase, given that the pandemic remains very active and that further outbreaks are expected as reopening continues. The likelihood of a broad second wave of COVID-19 remains very possible, particularly if individuals, organizations and communities fail to follow identified best practices to mitigate risks.

    Beyond the explicit health threat, we have other security concerns, including:

    • As noted above, SEVERE means we believe an event is highly likely. With respect to our current environment and this assessment, we assess an event to be one of two types:
      • Local Outbreak. The possibility of a local COVID-19 outbreak remains very possible. FBOs in particular may experience rapid spread and infection if infected individuals are exposed to larger groups.
      • Hostile Events. In addition to routine threats, additional stressors may increase challenges for FBOs. That concern is raised in Assistant Director Harrell’s 08 Apr letter to the faith-based community. There are also other challenges that could lead to hostile events or provide opportunities for individuals or small groups to conduct acts of violence.
        • Protests & Targeting of African-American People and Facilities. On 01 June we assessed that “protests relating to the death of George Floyd and racial issues take on a political dimension, it is also possible extremists could choose to target predominantly African American places of worship.” Sadly, that has come to fruition. Threats and hostile events have occurred at FBOs, to include predominantly African-American churches such as in Virginia and Kentucky. As Black Lives Matters and associated protests continue, this remains a concern.
        • Protests & Targeting Other People of Faith. As domestic protests demand law enforcement resources, some extremists have suggested using that as an opportunity for attacks against people of faith – and synagogues specifically. We have seen this occur internationally and remain concerned about the possibility of domestic incidents.
        • Disgruntled Individuals. Individuals who do not agree with positions taken by an FBO during periods of closure and reopening may take action against those organizations or others.  
        • Political Events. Presidential elections, particularly during times of adversity, such as with the pandemic and associated economic impacts, or relating to other emotional topics, such as the removal of statues and monuments, can lead to a highly-charged atmosphere and pose associated risks to FBOs in the area which may not be directly targeted by indirectly implicated. As election-related activities increase in the months ahead, it is possible rallies may see protests and counter-protests – aimed at politicians, groups, or places of worship where events may be held. Such concerns are not limited to any party or individual but are a possibility for any political event occurring at or near an FBO.
    • There continue to be varied incidents, attacks, and threats against retail establishments and personnel relating to enforcement of safety protocols such as required wearing of masks and maintaining adequate social distancing, or the wearing of masks that incite responses from others (such as KKK or Nazi masks). This has continued in recent weeks, though FB-ISAO is unaware of any known incidents that have occurred at FBOs. As FBOs reopen and welcome back individuals, it is possible that some may have heightened sensitivities regarding these issues and may not respond well to personnel attempting to enforce safety actions. FBOs should prepare “frontline” staff and volunteers regarding how to engage personnel, when to ask for help from senior personnel, and other considerations to prepare them to effectively communicate and assist visitors.
    • As we continue to reopen and reenter FBOs, recognize the potential for violence based on the stressors of COVID-19, the threats from violent extremists, and the longstanding issues that have resulted in previous acts of violence at houses of worship.
    • There continues to be extremist interest in conducting various attacks and hostile actions against people and places of faith (to include specific anti-Semitic rhetoric relating to exploiting COVID-19 and other extremist discussion and interest in places of worship and people of faith [see previous FB-ISAO and government partner reporting]).
    • Beyond the immediate challenges, while we have yet to emerge from the “first wave,” there is a very real possibility of second and third waves until a vaccine is developed and applied nationwide. Further, many countries around the world continue on an upward trajectory and it is expected that the number of cases in many areas will continue to increase in the coming weeks.

    Regarding the Cyber Threat Level, FB-ISAO assess the current volume of coronavirus-related cyber attack campaigns continues to recede and is consistent with a general “GUARDED” posture. While there is still no shortage of coronavirus-themed cyber attack campaigns, non-coronavirus lures also continue to populate the cyber threat landscape. While we assess remaining at “GUARDED” is still reasonable at this time, increased vigilance is recommended due to the ongoing pandemic, continued widespread teleworking, abundance of information and updates from legitimate and less-established sources (including social media and unofficial expert blogs), and commensurate distractions in businesses and homes across the U.S., among other considerations.

    Update on #BlueLeaks: The FBI office in Houston continues to investigate. There was a report earlier this month that German authorities seized the server containing the leaked data. Likewise, Netsential has provided stakeholders with a notification of measures it has implemented and plans to implement to better secure its systems. Otherwise, as previously reported the #BlueLeaks data breach incident directly affects FB-ISAO due to the compromise of Netsential’s systems that maintain our membership and content delivery portal. That fact, plus our own partnerships with the other impacted entities, and many member’s close relationships with the same impacted entities, including fusion centers and law enforcement, still represent a very real and present threat from actors who may try to leverage those trusted relationships to phish (email or phone) for more information. Additionally, as impacted entities report on their analysis of the stolen data, a commonly captured non-public data point used for verification/validation includes registrants’ supervisor’s name and contact information. Therefore, it is likely threat actors could leverage supervisor information to lend greater credibility to the guise or to use as an additional target set. We cannot stress enough the need to exercise extreme vigilance when receiving communications purporting to come from any impacted organization, particularly ones in your region.

    Additional considerations for continued increased vigilance:

    • Ransomware running rampant. From municipalities and education institutions to healthcare and mega-corporations, no organization is safe from ransomware. In addition to becoming a direct victim, faith-based organizations that outsource IT services to a managed service provider (MSP) can also become an indirect victim with direct impacts when the MSP is infected. Compromising MSPs to systemically infect multiple organizations has been an increasing trend over the past year. Members are encouraged to review ransomware and data breach playbooks/policies/procedures with staff and MSPs, or at least discuss necessary actions should ransomware impact your organization. This Forrester report provides some salient points about dealing with ransomware.
    • Cyberactivity spurred by ongoing #BlackLivesMatter protests. While most cyber activity surrounding protests have been targeting law enforcement and local government websites, FB-ISAO emphasizes the need for continued vigilance. Website defacements and denial-of-service (DoS) attacks have been the primary attack types thus far, but cyber threat actors are also known to aggrandize headlines to proliferate malware. Likewise, as #BlueLeaks represents, hacktivists are actively seeking to compromise organizations that are likely to contain troves of law enforcement sensitive documents for the purpose of public disclosure/dissemination.
    • Contact tracing scams. Scammers are pretending to be contact tracers and sending fake text messages. Keep in mind that legitimate contact tracing messages are intended to be factual and will not ask for personal information or include a link to click. Multiple federal agencies have partnered to alert the public on avoiding contract tracing scams, including the FTC and the Justice Department.
    • Mis/disinformation is still a concern. Dis/misinformation continues to spread regarding coronavirus related matters and protest activity. Disinformation is spread by various entities for disruption, deceit, and even to discredit legitimate government efforts. It is imperative to think critically and continue verifying everything. FB-ISAO continues to encourage members to treat every coronavirus-themed communication or protest related subject with suspicion.

    We are all targets of opportunity. Cyber tactics such as phishing, smishing (SMS phishing), vishing (voice phishing), disinformation/misinformation, and counterfeit websites leveraging coronavirus themes will continue for the foreseeable future.

    • Continue enabling/encouraging remote staff to work securely. As organizations consider a prolonged, perpetual, or even permanent work from home model, it is important to deliberate on the best strategy to promote a secure remote work environment. Many organizations and people were thrust into remote working. Those who continue working remotely may require procurement and configuration of new devices, network infrastructure, and services to securely support extended offsite working. StaySafeOnline maintains its COVID-19 Security Resource Library with an up-to-date compilation of resources to enable safe telecommuting.
    • Continue providing threat awareness training to staff. There are many open source examples of emails, lures, images, and indicators of compromise being shared daily in the FB-ISAO Daily Journal. Consider appropriate ways to use that information to educate and better prepare staff. FB-ISAO is happy to help develop education and cybersecurity awareness materials for dissemination.

    As we periodically update these assessments, FB-ISAO’s Preparedness Group (PG) continues to support the efforts of our broader Pandemic Recovery Group with FB-ISAO staff, PG members, and other government and industry partners, and is also liaising with the venue community in collaboration with the International Association of Venue Managers. This group has developed and released the FB-ISAO Pandemic Reopening Reentry Checklist and continues in close collaboration as we assess appropriate needs for revisions and updates. Interested in helping? Contact our team to find out how!

    Please contact our team with any questions, needs for information, assistance or any other concerns.

    • We encourage members to review the FB-ISAO Daily Journal for general threat awareness, updates and ideas on what other organizations are doing.
    • Join the #covid-19, #protest_awareness, #cybersecurity and other topical channels in FB-ISAO Slack to see more updates, reports, and conversation on threats, and to share your questions, ideas, and actions for others.

    This assessment has been developed by FB-ISAO and is our general, nationwide, cyber threat assessment for the U.S. community of faith. As always, for local threat information, members are encouraged to work closely with neighborhood partners, local law enforcement, state and local fusion centers, local FBI field offices, DHS Protective Security Advisors (PSAs), Cybersecurity Advisors (CSAs), and other local experts and responders.

  • FB-ISAO Newsletter, v2, Issue 7

    FB-ISAO Newsletter, v2, Issue 7

    TLP:WHITE| FB-ISAO Newsletter was distributed on July 09, and may be accessed below.

    FB-newsletter-July-2020Download
  • “If You See Something, Say Something®”

    “If You See Something, Say Something®”

    Resources for Faith-Based Organizations

    “If You See Something, Say Something™” is a national campaign that was developed and trademarked by the New York Metropolitan Transportation Authority (NYTA). The goal of the campaign is to minimize terrorist threats and increase public awareness of indicators of terrorism and terrorism-related crime. To learn more about the national campaign, visit the Department of Homeland Security (DHS) “If You See Something, Say Something®” website here.

    Faith-Based Organizations (FBOs) continue to be the targets of hostile events from extremists of all kinds. FBOs are responsible for combining the openness of their facilities and safeguarding their congregants. As such, FBOs are excellent candidates for active participation in any campaign that serves to minimize risk – this   includes the “If You See Something, Say Something™” campaign.

    Florida’s campaign began in 2011 and was relaunched in December of 2015. To address the need for education, Florida revealed the “If You See Something, Say Something™” toolkit at a press conference in October 2016. Th toolkit offers safety information for FBOs, businesses and citizens to help in the fight against terrorism. The toolkit also contains a one-page list of potential suspicious activity indicators downloadable posters that could be used in a breakroom or on a bulletin, and other valuable materials that may be useful for threat assessments, for training purposes, or for awareness. These materials can be found on the FlSeeSay.org website. Religious facilities may download a list of potential suspicious activity indicators developed by DHS and the Florida Department of Law Enforcement (FDLE) here.

    Indicators of suspicious activity may include things like unattended packages and bags, a suspicious person wearing bulky clothing that could conceal weapons, or damage to security devices like cameras, perimeter fencing or lighting. In the event that you suspect something, make note of suspicious statements, people, or vehicles, and notify law enforcement. After reporting suspected incidents to local law enforcement, Faith-Based Information Sharing & Analysis Organization (FB-ISAO) members are encouraged to use the Incident Reporting capability on FB-ISAO Slack to share information. FB-ISAO analysts use reported information to analyze trends and to communicate back with their members on potential threats as well as to provide resources for possible mitigation of those threats.

    This year, the campaign launched the first-ever DHS partnered and NYTA-approved Florida See Say app. This app allows users to access educational materials like PSA’s, posters, and suspicious indicators for businesses, schools, and more. These materials are also available online at FLSeeSay.org. Additionally, users can report suspicious activity, like an abandoned vehicle or a suspicious person, through the app to their local law enforcement. Citizens can still report suspicious activity by calling 855-FLASAFE or by submitting a tip online.

    In February 2020, FB-ISAO worked with FDLE’s Central Florida Intelligence Exchange (CFIX) to host its first workshop in Orlando, Florida. For those in the Central Florida region looking to network with likeminded individuals who prioritize their organization’s physical and cyber security and risk management, FB-ISAO has created an Information Sharing Community for Central Florida. This community helps members collaborate and share information with one another in addition to attending workshops and participating in working groups.

    If you are interested in more information about the Florida “If You See Something, Say Something®” campaign, feel free to contact the campaign at [email protected].  If you haven’t joined an FB-ISAO Information Sharing Community yet, write to [email protected].

    FB-ISAO is committed to working with our state and local partners, such as the FDLE, to improve the resilience of all Faith-Based Organizations.

  • FB-ISAO Physical Threat Level Remains SEVERE; Cyber Threat Level Remains GUARDED

    FB-ISAO Physical Threat Level Remains SEVERE; Cyber Threat Level Remains GUARDED

    This message is TLP:WHITE. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.

    The COVID-19 global pandemic is a complex and blended threat impacting members and the broader faith-based and charity community in numerous ways. FB-ISAO’s Threat and Incident Response Group (TIG) continues to assess the ongoing threats and risks to our community and has made the following updates to our Threat Level Assessments:

    The TIG has determined to maintain the Physical Threat Level to “SEVERE.” SEVERE means an event is highly likely. The TIG will continue to assess the Physical Threat Level and provide updates accordingly. This determination is valid through sunset on 31 July 2020, and will be periodically re-evaluated, especially with respect to ongoing threats and developing federal, state, local, tribal, and territorial (FSLTT / SLTT) guidance and directives.

    The TIG has determined to maintain the Cyber Threat Level at “GUARDED.” GUARDED means FB-ISAO is unaware of any specific or targeted cyber attacks, but a general risk of cyber attacks exist. The TIG will continue to assess the Cyber Threat Level and provide updates accordingly. Likewise, the cyber threat landscape will be continuously monitored, but this Cyber Threat Level determination is valid until further notice.

    Reopening America. Across the country, many FBOs are reopening or preparing to reopen, while many have elected to continue to suspend in-person activities. As we continue in the process of reopening, with the possibility of having to move back to more stringent restrictions or delays in continued reopening based on events in our local communities, FB-ISAO continues to strongly encourage members “hold the line.” By hold the line, we mean continue to follow FSLTT guidance and directives and reopen, reenter and resume operations in accordance with, and not ahead of, such guidance and directives.

    Many states are seeing their highest daily rates of infection and CDC expects the death rate to steadily continue to climb, with “between 130,000 and 150,000 total reported COVID-19 deaths by July 18th.” While personally and organizationally, many are understandably feeling pandemic fatigue, the coronavirus remains an active health threat with the potential to lead to local outbreaks or broader flare-ups. As leaders, we encourage members to fight complacency and fatigue. FBOs should not base policies or enforcement on personal feelings, politics, or other subjective considerations. While as individuals we may agree or disagree with specific measures, FB-ISAO strongly discourages defying state and local guidance and directives and encourages members to reopen, reenter and resume operations in accordance with government guidance and directives.

    Regarding the Physical Threat Level, as SLTT governments continue to “reopen” their communities and as FBOs are reopening and beginning to welcome back the public, coronavirus remains a serious threat in the United States, with many states experiencing increasing infection numbers and with several outbreaks related to gatherings at FBOs. A health threat poses a challenge in assessing a threat level. In accordance with FB-ISAO’s threat levels, in many respects we are still in a “CRITICAL” phase, given that the pandemic remains very active and that further outbreaks are expected as reopening continues. The likelihood of a broad second wave of COVID-19 remains very possible, particularly if individuals, organizations and communities fail to follow identified best practices to mitigate risks.

    Beyond the explicit health threat, we have other security concerns, including:

    • As noted above, SEVERE means we believe an event is highly likely. With respect to our current environment and this assessment, we assess an event to be one of two types:
      • Local Outbreak. The possibility of a local outbreak remains very possible. FBOs in particular may experience rapid spread and infection if infected individuals are exposed to larger groups. FBOs have been associated with several local outbreaks in recent weeks.
      • Hostile Events. In addition to routine threats, additional stressors may increase challenges for FBOs. That concern is raised in Assistant Director Harrell’s 08 Apr letter to the faith-based community. There are also other challenges that could lead to hostile events or provide opportunities for individuals or small groups to conduct acts of violence.
        • Protests & Targeting of African-American People and Facilities. On 01 June we assessed that “protests relating to the death of George Floyd and racial issues take on a political dimension, it is also possible extremists could choose to target predominantly African American places of worship.” Sadly, that has come to fruition. Threats and hostile events have occurred at FBOs, to include predominantly African-American churches such as in Virginia and Kentucky.
        • Protests & Targeting Other People of Faith. As domestic protests demand law enforcement resources, some extremists have suggested using that as an opportunity for attacks against people of faith – and synagogues specifically. Overseas, this has been observed, for example, in Turkey, where Christians and Christian facilities have been targeted.
        • Disgruntled Individuals. Individuals who do not agree with positions taken by an FBO during periods of closure and reopening may take action against those organizations or others.
        • Political Events. Presidential elections, particularly during times of adversity, such as with the pandemic and associated economic impacts, can lead to a highly-charged atmosphere. As election-related activities increase in the months ahead, it is possible rallies may see protests and counter-protests – aimed at politicians, groups, or places of worship where events may be held. Some of those challenges were observed at a June rally for President Trump in Arizona. Such concerns are not limited to any party or individual but are a possibility for any political event occurring at or near an FBO.
    • During reopening, there have been varied attacks and threats against retail establishments and personnel relating to enforcement of safety protocols such as required wearing of masks and maintaining adequate social distancing. This has continued in recent weeks, be it there have been less observed instances and known incidents at FBOs. As FBOs reopen and welcome back individuals, it is possible that some may have heightened sensitivities regarding these issues and may not respond well to personnel attempting to enforce safety actions. FBOs should prepare “frontline” staff and volunteers regarding how to engage personnel, when to ask for help from senior personnel, and other considerations to prepare them to effectively communicate and assist visitors.
    • As we reopen and reenter FBOs, recognize the potential for violence based on the stressors of COVID-19, the threats from violent extremists, and the longstanding issues that have resulted in previous acts of violence at houses of worship.
    • There continues to be extremist interest in conducting various attacks and hostile actions against people and places of faith (to include specific anti-Semitic rhetoric relating to exploiting COVID-19 and other extremist discussion and interest in places of worship and people of faith [see previous FB-ISAO and government partner reporting]).
    • Beyond the immediate challenges, there is a very real possibility of second and third waves until a vaccine is developed and applied nationwide. Further, many countries around the world – including very significant ongoing outbreaks in Brazil and other parts of Latin America – are on an upward trajectory and it is expected that the number of cases in many areas will continue to increase in the coming weeks.
    • The 4th of July holiday, while likely with smaller and fewer events this year, always has security concerns due to mass gatherings and high visibility. While events may be fewer and smaller, combined with some of the additional challenges and complexities of our current environment, FBOs hosting events or in proximity to planned events, should consider threats and security to their people and places.

    Regarding the Cyber Threat Level, FB-ISAO assess the current volume of coronavirus-related cyber attack campaigns continues to recede and is consistent with a general “GUARDED” posture. While there is still no shortage of coronavirus-themed cyber attack campaigns, non-coronavirus lures continue to populate the cyber threat landscape. While we assess remaining at “GUARDED” is still reasonable at this time, increased vigilance is recommended due to the ongoing pandemic, continued widespread teleworking, abundance of information and updates from legitimate and less-established sources (including social media and unofficial expert blogs), and commensurate distractions in businesses and homes across the U.S., among other considerations. In addition, as previously reported the recent #BlueLeaks data breach incident directly affects FB-ISAO due to the compromise of the technology service provider (Netsential) that manages our membership and content delivery portal. That fact, plus our own partnerships with the other impacted entities, and many member’s close relationships with the same impacted entities, including fusion centers and law enforcement, present a very real and present threat from actors who may try to leverage those trusted relationships to phish (email or phone) for more information. We cannot stress enough the need to exercise extreme vigilance when receiving communications purporting to come from any impacted organization, particularly ones in your region.

    Additional considerations for continued increased vigilance:

    • Cyberactivity spurred by ongoing protests over the death of George Floyd. While most cyber activity surrounding protests have been targeting law enforcement and local government websites, FB-ISAO emphasizes the need for vigilance. Website defacements and denial-of-service (DoS) attacks have been the primary attack types thus far, but cyber threat actors are also known to aggrandize headlines to proliferate malware. Likewise, as #BlueLeaks represents, hacktivists are actively seeking to compromise organizations that are likely to contain troves of law enforcement sensitive documents for the purpose of public disclosure/dissemination.
    • Contact tracing scams. Scammers are pretending to be contact tracers and sending fake text messages. Keep in mind that legitimate contact tracing messages are intended to be factual and will not ask for personal information or include a link to click. The FTC has updated guidance on avoiding fake contact tracers.
    • Mis/disinformation is still a concern. Dis/misinformation continues to spread regarding coronavirus related matters and protest activity. Disinformation is spread by various entities for disruption, deceit, and even to discredit legitimate government efforts. Social media organizations such as Twitter are striving to flag potentially harmful and misleading posts. Likewise, several states are working to fight the scourge. It is imperative to think critically and continue verifying everything. FB-ISAO continues to encourage members to treat every coronavirus-themed communication or protest related subject with suspicion.

    We are all targets of opportunity. Cyber tactics such as phishing, smishing (SMS phishing), vishing (voice phishing), disinformation/misinformation, and counterfeit websites leveraging coronavirus themes will continue for the foreseeable future.

    • Continue enabling/encouraging remote staff to work securely. As organizations consider a prolonged, perpetual, or even permanent work from home model, it is important to deliberate on the best strategy to promote a secure remote work environment. Many organizations and people were thrust into remote working. Those who continue working remotely may require procurement and configuration of new devices, network infrastructure, and services to securely support extended offsite working. StaySafeOnline maintains its COVID-19 Security Resource Library with an up-to-date compilation of resources to enable safe telecommuting.
    • Continue providing threat awareness training to staff. There are many open source examples of emails, lures, images, and indicators of compromise being shared daily in the FB-ISAO Daily Journal. Consider appropriate ways to use that information to educate and better prepare staff. FB-ISAO is happy to help develop education and cybersecurity awareness materials for dissemination.

    As we periodically update these assessments, FB-ISAO’s Preparedness Group (PG) continues to support the efforts of our broader Pandemic Recovery Group with FB-ISAO staff, PG members, and other government and industry partners, and is also liaising with the venue community in collaboration with the International Association of Venue Managers. This group has developed and released the FB-ISAO Pandemic Reopening Reentry Checklist and continues in close collaboration as we assess appropriate needs for revisions and updates. Interested in helping? Contact our team to find out how!

    Please contact our team with any questions, needs for information, assistance or any other concerns.

    • We encourage members to review the FB-ISAO Daily Journal for general threat awareness, updates and ideas on what other organizations are doing.
    • Join the #covid-19, #protest_awareness, #cybersecurity and other topical channels in FB-ISAO Slack to see more updates, reports, and conversation on threats, and to share your questions, ideas, and actions for others.

     This assessment has been developed by FB-ISAO and is our general, nationwide, cyber threat assessment for the U.S. community of faith. As always, for local threat information, members are encouraged to work closely with neighborhood partners, local law enforcement, state and local fusion centers, local FBI field offices, DHS Protective Security Advisors (PSAs), Cybersecurity Advisors (CSAs), and other local experts and responders.

  • FB-ISAO Physical Threat Level Returns to SEVERE; Cyber Threat Level Remains GUARDED

    FB-ISAO Physical Threat Level Returns to SEVERE; Cyber Threat Level Remains GUARDED

    This message is TLP:WHITE. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.

    The COVID-19 global pandemic is a complex and blended threat impacting members and the broader faith-based and charity community in numerous ways. FB-ISAO’s Threat and Incident Response Group (TIG) continues to assess the ongoing threats and risks to our community and has made the following updates to our Threat Level Assessments:

    The TIG has determined to lower the Physical Threat Level to “SEVERE.” SEVERE means an event is highly likely. The TIG will continue to assess the Physical Threat Level and provide updates accordingly. This determination is valid through sunset on 26 June 2020, and will be periodically re-evaluated, especially with respect to ongoing threats and developing federal, state, local, tribal, and territorial (FSLTT / SLTT) guidance and directives.

    The TIG has determined to maintain the Cyber Threat Level at “GUARDED.” GUARDED means FB-ISAO is unaware of any specific or targeted cyber attacks, but a general risk of cyber attacks exist. The TIG will continue to assess the Cyber Threat Level and provide updates accordingly. Likewise, the cyber threat landscape will be continuously monitored, but this Cyber Threat Level determination is valid until further notice.

    Reopening America. After many weeks of closures, many FBOs are reopening or preparing to reopen. This is an exciting transition but one that requires a deliberate, thoughtful and disciplined approach. As we continue in the process of reopening, with the possibility of having to move back to more stringent restrictions or delays in continued reopening based on events in our local communities, FB-ISAO continues to strongly encourage members “hold the line.” By hold the line, we mean continue to follow FSLTT guidance and directives and reopen, reenter and resume operations in accordance with, and not ahead of, such guidance and directives. FB-ISAO strongly discourages defying state and local guidance and directives and encourages members to reopen, reenter and resume operations in accordance with government guidance and directives.

    Regarding the Physical Threat Level, as SLTT governments continue to “reopen” their communities and as FBOs are reopening and beginning to welcome back the public, coronavirus remains a serious threat in the United States, with many areas experiencing increasing infection numbers as they begin phase one reentry/reopening. A health threat poses a challenge in assessing a threat level. In accordance with FB-ISAO’s threat levels, in many respects we are still in a “CRITICAL” phase, given that the pandemic us underway and that further outbreaks are expected as reopening continues. We have been reluctant to decrease the physical threat level but, assessing the broad, national threat, we felt it was appropriate to move to SEVERE at this time. The likelihood of a broad second wave of COVID-19 remains very possible, particularly if individuals, organizations and communities fail to follow identified best practices to mitigate risks.

    “The possibility of a local outbreak remains very possible. FBOs in particular may experience rapid spread and infection if infected individuals are exposed to larger groups.“

    Beyond the explicit health threat, we have other security concerns, including:

    • As noted above, SEVERE means we believe an event is highly likely. With respect to our current environment and this assessment, we assess an event to be one of two types:
      • Hostile Events. In addition to routine threats, additional stressors may increase challenges for FBOs. That concern is raised in Assistant Director Harrell’s 08 Apr letter to the faith-based community. Further, individuals who do not agree with positions taken by an FBO during periods of closure and reopening may take action against those organizations or others. That was evidenced in a recent arson attack that destroyed the destroyed the First Pentecostal Church in Holly Springs, Mississippi. FB-ISAO warned about such possibilities in our 14 May threat levels update; the arson attack occurred the following week.
        • As domestic protests demand law enforcement resources, some extremists have suggested using that as an opportunity for attacks against people of faith – and synagogues specifically.
        • As protests relating to the death of George Floyd and racial issues take on a political dimension, it is also possible extremists could choose to target predominantly African American places of worship. We have no specific knowledge of threats suggesting that is being discussed but feel the possibility exists and should be considered.

    “In addition to routine threats, additional stressors may increase challenges for FBOs.”

    • During reopening, there have been varied attacks and threats against retail establishments and personnel relating to enforcement of safety protocols such as required wearing of masks and maintaining adequate social distancing. As FBOs reopen and welcome back individuals, it is possible that some may have heightened sensitivities regarding these issues and may not respond well to personnel attempting to enforce safety actions. FBOs should prepare “frontline” staff and volunteers regarding how to engage personnel, when to ask for help from senior personnel, and other considerations to prepare them to effectively communicate and assist visitors.

    “FBOs should prepare ‘frontline’ staff and volunteers regarding how to engage personnel”

    • As we reopen and reenter FBOs, recognize the potential for violence based on the stressors of COVID-19, the threats from violent extremists, and the longstanding issues that have resulted in previous acts of violence at houses of worship.
    • There continues to be extremist interest in conducting various attacks and hostile actions against people and places of faith (to include specific anti-Semitic rhetoric relating to exploiting COVID-19 and other extremist discussion and interest in places of worship and people of faith [see previous FB-ISAO and government partner reporting]).
    • Beyond the immediate challenges, there is a very real possibility of second and third waves until a vaccine is developed and applied nationwide. Further, many countries around the world – including very significant ongoing outbreaks in Brazil and other parts of Latin America – are on an upward trajectory and it is expected that the number of cases in many areas will continue to increase in the coming weeks.

    Regarding the Cyber Threat Level, FB-ISAO assess the current volume of coronavirus-related cyber attack campaigns has remained stable and is consistent with a general “GUARDED” posture. While there is still no shortage of coronavirus-themed cyber attack campaigns, non-coronavirus lures continue to populate the cyber threat landscape. While we assess remaining at “GUARDED” is still reasonable at this time, increased vigilance is recommended due to the ongoing pandemic, continued widespread teleworking, abundance of information and updates from legitimate and less-established sources (including social media and unofficial expert blogs), and commensurate distractions in businesses and homes across the U.S., among other considerations.

    Additional considerations for continued increased vigilance:

    • Cyberactivity spurred by protests over the death of George Floyd. While most cyber activity surrounding protests are targeting law enforcement and local government websites, FB-ISAO emphasizes the need for vigilance. Website defacements and denial-of-service (DoS) attacks have been the primary attack types thus far, but cyber threat actors are also known to aggrandize headlines to proliferate malware.
    • Contact tracing scams. As if COVID-19 contact tracing doesn’t have enough challenges, the proliferation of fraudulent text messages from scammers pretending to be contact tracers adds to the issue. As iterated from the FTC, there’s no question contact tracing plays a vital role in helping stop the spread of COVID-19. But scammers are pretending to be contact tracers and taking advantage of how the process works by sending fake text messages. Also, given legitimate health department messages may vary from region to region, it may be difficult to determine a real message from a fake one. However, keep in mind that legitimate contact tracing messages are intended to be factual and will not ask for personal information or include a link to click. Visit the FTC for more tips on recognizing, avoiding, and reporting scam texts messages.
    • Mis/disinformation is still a concern. In addition to coronavirus related matters, recent protest activity surrounding the death of George Floyd have also sparked similar attempts at spreading disinformation, including social media posts stating various extremist groups were present at protests, in neighborhoods, etc. Disinformation is spread by various entities for disruption, deceit, and even to discredit legitimate government efforts. Social media organizations such as Twitter are striving to flag potentially harmful and misleading posts. Likewise, several states are working to fight the scourge. It is imperative to think critically and continue verifying everything. FB-ISAO continues to encourage members to treat every coronavirus-themed communication or protest related subject with suspicion.

    “In addition to coronavirus related matters, recent protest activity surrounding the death of George Floyd have also sparked similar attempts at spreading disinformation”

    We are all targets of opportunity, especially during this time. Cyber tactics such as phishing, smishing (SMS phishing), disinformation/misinformation, and counterfeit websites leveraging coronavirus themes will continue for the foreseeable future.

    • Continue enabling/encouraging remote staff to work securely. As organizations begin to consider a prolonged, perpetual, or even permanent work from home model, it is important to deliberate on the best strategy to promote a secure home working environment. Many organizations and people were thrust into remote working. However, those who continue to work remotely may require procurement and configuration of new devices, network infrastructure, and services to securely support extended offsite working. StaySafeOnline maintains its COVID-19 Security Resource Library with an up-to-date compilation of numerous trusted and verified resources to enable safe telecommuting.
    • Continue providing threat awareness training to staff. There are many open source examples of emails, lures, images, and indicators of compromise being shared daily in the FB-ISAO Daily Journal. Consider appropriate ways to use that information to educate and better prepare staff. FB-ISAO is happy to help members develop education and cybersecurity awareness materials for dissemination.

    As we periodically update these assessments, FB-ISAO’s Preparedness Group (PG) continues to support the efforts of our broader Pandemic Recovery Group with FB-ISAO staff, PG members, and other government and industry partners, and is also liaising with the venue community in collaboration with the International Association of Venue Managers. This group has developed and released the FB-ISAO Pandemic Reopening Reentry Checklist and continues in close collaboration as we assess appropriate needs for revisions and updates. Interested in helping? Contact our team to find out how!

    Please contact our team with any questions, needs for information, assistance or any other concerns.

    • We encourage members to review the FB-ISAO Daily Journal for general threat awareness, updates and ideas on what other organizations are doing.
    • Join the #covid-19 channel and #cybersecurity channel in FB-ISAO Slack to see more updates, reports, and conversation on this threat, and to share your questions, ideas, and actions for others.

    This assessment has been developed by FB-ISAO and is our general, nationwide, cyber threat assessment for the U.S. community of faith. As always, for local threat information, members are encouraged to work closely with neighborhood partners, local law enforcement, state and local fusion centers, local FBI field offices, DHS Protective Security Advisors (PSAs), Cybersecurity Advisors (CSAs), and other local experts and responders.

  • FB-ISAO Physical & Cyber Threat Level Updates

    FB-ISAO Physical & Cyber Threat Level Updates

    The COVID-19 global pandemic is a complex and blended threat impacting members and the broader faith-based and charity community in numerous ways. FB-ISAO’s Threat and Incident Response Group (TIG) continues to assess the ongoing threats and risks to our community and has made the following updates to our Threat Level Assessments:

    The TIG has determined to maintain the Physical Threat Level at “CRITICAL,” – our highest level of threat – as it has been since 31 March 2020. The TIG will continue to assess the Physical Threat Level and provide updates accordingly. This determination is valid through sunset on 14 May 2020, and will be periodically re-evaluated, especially with respect to ongoing threats and developing federal, state, local, tribal, and territorial (FSLTT / SLTT) guidance and directives.

    The TIG has determined to maintain the Cyber Threat Level at “ELEVATED,” as it has been since 20 March 2020. The TIG will continue to assess the Cyber Threat Level and provide updates accordingly. This determination is valid through sunset on 14 May 2020, and will be periodically re-evaluated, especially with respect to ongoing cyber threats.

    FB-ISAO continues to strongly encourage members “hold the line.” By hold the line, we mean continue to follow FSLTT guidance and directives and reopen, reenter and resume operations in accordance with, and not ahead of, such guidance and directives.

    Regarding the Cyber Threat Level, we do not assess a significant change from the 21 Mar assessment. However, we do consider a sustained higher level of cyber risk as threat actors pivot attack campaigns to leverage themes associated with “Opening Up America Again.” As organizations begin transitioning from strictly online activities back to gathering in person, cyber attackers will closely follow the messaging tone and cadence throughout each gating phase and adjust their lures accordingly.

    • The ploys are the same, but the deluge is unprecedented – Cyber tactics leveraging coronavirus themes will continue at a significant volume for the foreseeable future. Cyber attacks such as phishing, smishing (SMS phishing), disinformation/misinformation, and counterfeit websites purporting to have important or urgent updates will continue to dominate the threat landscape.
    • Think critically – Cyber attackers will continue their attacks to seek financial gain or sow seeds of rumors and disinformation to create chaos and confusion for their amusement.
    • Trust but verify – FB-ISAO members are encouraged to treat every coronavirus-themed, including “Opening Up America Again” communication or situational report with suspicion.

    Regarding the Physical Threat Level, as SLTT governments begin to “reopen” their communities, coronavirus remains a serious threat in the United States; beyond the immediate challenges, there is a very real possibility of second and third waves until a vaccine is developed and applied nationwide. Further, many countries around the world – including nations in the Western Hemisphere – are on an upward trajectory and it is expected that the number of cases in many countries will increase in the coming weeks. Based on the health threat alone, we continue to strongly urge members to follow FSLTT guidance and direction and, as directed, to limit the size of gatherings or to forgo physical assemblies, in accordance with that guidance. FB-ISAO strongly discourages defying state and local guidance and directives and encourages members to reopen, reenter and resume operations in accordance with government guidance and directives.

    Beyond the pandemic threat:

    • Ramadan continues and, since the first night of the annual Muslim holiday, there have been threats and incidents aimed at mosques and Muslim people (to include in the U.S. and Canada), as captured in recent FB-ISAO reports.
    • 27 April marked the one-year anniversary of the Poway synagogue attack. Such occasions can motivate and inspire like attacks.
    • Continued extremist interest in conducting various attacks and hostile actions against people and places of faith (to include specific anti-Semitic rhetoric relating to exploiting COVID-19 and other extremist discussion and interest in places of worship and people of faith [see previous FB-ISAO and government partner reporting]);
    • May Day / International Workers’ Day (01 May 2020). FB-ISAO is not aware of any credible threat or large scale, worldwide demonstrations during May Day, however, personnel with physical security interests should maintain awareness of locally planned events and take appropriate preparedness actions.

    As with April, we assess the month of May to continue to be a CRITICAL threat period.

    Recent and upcoming reports and public posts speak to ideas elaborating on these various threats and on mitigation, including the public posts listed above, and recent weekly reports on maintaining preparedness for non-health threats during this pandemic and on upcoming threats. Please contact our team with any questions, needs for information, assistance or any other concerns.

    • We encourage members to review the FB-ISAO Daily Journal for general threat awareness, updates and ideas on what other organizations are doing.
    • Join the #covid-19 channel in FB-ISAO Slack to see more updates, details and conversation on this threat, and share your questions, ideas and actions for others.

    As we periodically update these assessments, FB-ISAO’s Preparedness Group (PG) has launched a Pandemic Recovery Group with FB-ISAO staff, PG members, and other government and industry partners, and is also liaising with the venue community in collaboration with the International Association of Venue Managers. This group is developing information which may help inform FBO’s reopening and reentry operations. Interested in helping; contact our team to find out how!

    This assessment has been developed by FB-ISAO and is our general, nationwide, cyber threat assessment for the U.S. community of faith. As always, for local threat information, members are encouraged to work closely with neighborhood partners, local law enforcement, state and local fusion centers, local FBI field offices, DHS Protective Security Advisors (PSAs), Cybersecurity Advisors (CSAs), and other local experts and responders.

Show Buttons
Hide Buttons