Author Archives: David Pollock

2020-21 NYS DHSES Virtual Workshops for grantees and applicants

Please see the offerings from NYS DHSES below. Note that most of the sessions are for current grantees.

  • There will be a session on the nonprofit programs on Thursday, February 11th@ 1PM. Click here to register. Here is more information.
  • The Community Security Initiative and NYS DHSES will present at Rep. Grace Meng’s Nonprofit Security Program Grant Workshop on Wednesday, February 10, 2020 from 6PM to 7:30PM. To RSVP and receive the Zoom link email: MENG.RSVP@MAIL.HOUSE.GOV.
  • Organizations planning to submit a NSGP application must include an assessment. Click here to apply for a professional assessment from the Community Security Initiative at no charge to your organization.

Here is more information from NYS DHSES:

The New York State Division of Homeland Security and Emergency Services (DSHES) Grants Regional Workshops are an annual event which have historically been held at multiple locations statewide every fall. Being unable to hold these events in person for 2020, we have announced the 2020 DHSES Grants Virtual Workshops and the 2020 DHSES Grants Virtual Workshops – Nonprofit Series, which will be delivered via WebEx on multiple key dates between December 2020 and March 2021. The purpose of the Workshops is to provide critical updates on homeland security grant funding, provide technical assistance on meeting the various grant requirements and to obtain feedback as well as answer your questions on these key issues.

We have set up this page to be able to share important information and documents regarding the Virtual Workshops, including presentation recordings and slides, which will be posted following the delivery of each presentation. Please note that the Virtual Workshops are for informational purposes and may not address your questions directly, however you can always reach out to your Contract Representative for further clarification.

Grants Program Administration: Who We Are / What We Do – Delivered Friday, December 11, 2020
Target Audience: Government sector subrecipients, Nonprofit organizations

Tutorial on Minority and Women Owned Business Enterprises (MWBE) Requirements – Delivered Tuesday, January 12, 2021
Target Audience: Government sector subrecipients

Navigating E-Grants and Quarterly Reporting – Delivered Thursday, January 28, 2021
Target Audience: Government sector subrecipients, Nonprofit organizations

Any questions or comments about the content herein or the Virtual Workshops can be directed to the Grants Info box: Grant.Info@dhses.ny.gov

Inauguration & MLK Days | What to know

Cybersecurity: Protecting your people and your systems

Click on the graphic to download the presentation

As cybersecurity concerns heightened, both worldwide and in the Jewish community, the Community Security Initiative and CISA offered a cybersecurity webinar on December 17, 2020. R. S. Richard Jr., CISM, CCISO, Cybersecurity Advisor, Region II of the Cybersecurity and Infrastructure Security Agency (CISA) offered explained about important cybersecurity measures that organizations should consider adopting and the resources that CISA makes available. View the video here and the presentation here.

CISA recently released its Cyber Essentials Toolkit, a set of modules designed to break down the CISA Cyber Essentials into bite-sized actions for technical staff and organizational leadership to work toward full implementation of each Cyber Essential. Each chapter focuses on recommended actions to build cyber readiness into the six interrelated aspects of an organizational culture of cyber readiness. We urge you to download and review these valuable tools.

Chapter 1: Yourself, The Leader – Drive Cybersecurity Strategy, Investment, and Culture

This chapter focuses on providing leaders with an understanding of what it takes from the top to drive a culture of cyber readiness within their organizations. Topic areas include, leading investment in basic cybersecurity; determining how much of the business’ critical operations are dependent on IT; how to approach cyber as a business risk; leading the development of cybersecurity policies; and building networks of trusted sector partners and government agencies for information sharing.

Chapter 2: Your Staff – Develop Security Awareness and Vigilance

This chapter focuses on an organizational approach to cybersecurity by educating employees and providing training resources that encourage cyber awareness and vigilance. Topic areas include: leveraging basic cybersecurity training; developing a culture of awareness; learning about phishing and other risks; identifying available training resources; and maintaining awareness of current cyber events.

Chapter 3: Your Systems – Protect Critical Assets and Applications

This chapter focuses on an organizational approach to cybersecurity by securing network assets and information. Topic areas include: learning what is on your network; leveraging automatic updates; implementing secure configurations; removing unauthorized hardware and software; leveraging email and browser security setting; and creating approved software polices.

Chapter 4: Your Surroundings – The Digital Workplace

This chapter focuses on an organizational approach to cybersecurity by ensuring only those who belong on your digital workplace have access. Topic areas include: learning who is on your network; leveraging multi-factor authentication; granting appropriate access and admin permissions; leveraging unique passwords; and developing IT polices to address user statuses.

Chapter 5: Your Data – Make Backups and Avoid the Loss of Information Critical to Operations

This chapter focuses on providing leaders with an understanding of what it takes to ensure their organization’s data is secure and recoverable. Topic areas include: learning what information resides on the organization’s network; learning what is happing on the network; domain name system protection; learning how the organization’s data is protected; leveraging malware protection capabilities; establishing regular automated backups and redundancies of key systems; and leveraging protections for backups.

Chapter 6: Your Crisis Response – Limit Damage and Quicken Restoration of Normal Operations

This chapter focuses on responding to and recovering from a cyber attack. Topic areas include: developing an incident response plan and disaster recovery plan; using business impact assessments to prioritize resources and identify systems to be recovered; knowing who to call for help in the event of a cyber incident; developing an internal reporting structure to communicate to stakeholder.

Posted in Common

New CISA resource for Screening: The Power of Hello

When is a “hello” not merely a “hello”?

Remember: only “approved” individuals should be able to enter your facility. The right greeting can be a critical component of your security protocols, and help you to balance the need to be warm and welcoming, while making sure that everyone who comes through our doors is safe and secure. Security goes beyond just having solid doors. In the real world someone has the responsibility to observe, evaluate suspicious behaviors — and ultimately — decide who to admit?

Technology offers many solutions (ID cards, fobs, facial recognition, biometrics and more) to verify those who we know, but what about those we don’t?  It all comes down to screening. A screener can be an employee or a volunteer. What’s important is that they know your people.

Who shows up at our doors?

Three types of people show up at our doors

  1. The vast majority of the people who attend religious services are regulars. It is best practice to have someone at the door who knows most of the attendees and will welcome them upon arrival. They fill the largest bucket.
  2. A warm, simple greeting (Welcome, is this your first time here? Are you looking for someone in particular?) will usually elicit a response (e.g., I’m here for the Cohen bar mitzvah). Take the time to ask the Cohen’s for their guest list. Your screener can readily check that the visitor is on the list. These visitors fit into the smaller, second bucket.
  3. That leaves the Unknowns. What steps should be taken when an unknown is at the door. How can the screener decide whether an Unknown is a threat or a potential member of your congregation or facility?

DHS CISA‘s new guide

Simply saying “Hello” can prompt a casual conversation with a new person, providing an opportunity to observe and establish a connection. CISA calls it the “OHNO approach–Observe, Initiate a Hello, Navigate the Risk, and Obtain Help” developed to enable screeners to observe and evaluate suspicious behaviors, and to empower them to lower the risk and obtain help when necessary.

This guide promotes employee vigilance for our houses of worship stakeholders. Alert personnel can spot suspicious activity and report it. Keeping houses of worship facilities secure while sustaining the open and welcoming environment necessary for peaceful congregation requires a holistic approach to security.

Download these materials and think about how this guidance can make your facility safe and secure, without undermining your wish to be warm and welcoming. As always, institutions in New York City, Long Island and Westchester can reach out to their Community Security Initiative (CSI) regional security manager for assistance. Click here to send an email. Check out the new CSI video here.

Download links

Power of Hello Slicksheet (272.54 KB)
Power Hello Placemat (313.91 KB)
The Power of Hello Houses of Worship guide (2.1 MB)

Posted in Common

Shifted to telework? Make sure you are secure.

Today, the Department of Homeland Security-CISA released the Telework Essentials Toolkit providing organization leaders, their IT staff, and employees recommendations for a more permanent telework solution beyond what may have been implemented as a quick fix or temporary solution.

The Toolkit provides three personalized modules outlining distinctive security considerations appropriate for each role:

  • Actions for executive leaders that drive cybersecurity strategy, investment and culture
  • Actions for IT professionals that develop security awareness and vigilance
  • Actions for teleworkers to develop their home network security awareness and vigilance

It is more important than ever that our partners like you are aware of cyber risks endemic to this new environment and are prepared with the tools to mitigate them. We encourage you to forward this notification and toolkit widely to other partners. With your support we can continue to develop a stronger, more resilient culture of cyber readiness from the c-suite to the end user.

This toolkit is available at cisa.gov/telework, a webpage CISA established as a one-stop shop for telework cybersecurity guidance for critical infrastructure, government, and citizens. Since it was launched, several new products have been added for a variety of sectors. Here are just a few of the varied resources you will find.

  1.  DHS-CISA partners with CYBER.ORG, to focus on cybersecurity for K-12 educators and students, including a series of cyber safety videos. Located in the “Additional Telework Resources” section, the inaugural videos address video conferencing safety and how to avoid being duped by a suspicious email or phishing attack. The videos in this series are applicable to any work or business environment, not just the education audience.
  2. Many state and local 9-1-1 agencies shifted staff to remote working environments. Through our consistent and close collaboration with state and local governments, CISA published information to help this important first responder community manage this transition. Located in our “General Telework Guidance”, you can read about the best practices used by the Arlington County Public Safety Communications and Emergency Management.

The COVID-19 pandemic forced organizations to rapidly stand-up telework procedures. Since then, we have seen entities across industries have servers forced temporarily offline because of ransomware attacks, poorly configured remote working tools, or unpatched vulnerabilities on their networks. Not only are these attacks costly (i.e. the cost in time and energy of responding IT staff, downtime costs etc.) but the hit to customer and worker confidence and trust can be equally steep.

Posted in Common