Persistent BIOS Attacks

Researchers unveil persistent BIOS attack methods (via threatpost)

Yeah, this is just lovely. So what's the fix here, a hammer?

Bored Coders

From XKCD.

No. This is not reflective of me at all. Honest. I would *never* enable Gopher.

Escambia County Exercise, Part II

I was planning on writing this as we drove home from the exercise... but I was pretty much brain dead, and it felt a little too much like work.

Overall, things went very smoothly. It wasn't a large or complex event, which helped, but there is always the potential for these things to go off the rails. The airport folks had rounded up 120 victim volunteers from NAS Pensacola - a bunch of young enlisted to play the roles of the airline passengers. I swear, I am going to get my victims from the military at every opportunity in the future; these kids were great. They were enthusiastic, followed directions, and were self organizing.

Since we were there working for the county, but the county was participating as a 'junior' partner to the airport and City of Pensacola, we had to be cautious not to offend or overstep ourselves. In many ways, this made the day fairly easy for us, since most of the prep and set up was done by the airport folks.

The 'crash' site was basic, consisting of a debris field located at the approach end of runway 8. The scenario involved the crash of a commuter airliner with 85 souls on board, resulting in a mass casualty incident. The city/county coordination was going to be key simply because even though the accident occurred on city property, and the primary response agency was Pensacola Fire Rescue, the city does not have any Emergency Medical Service (EMS) assets.

In addition to the city fire department, county fire department, county EMS, and law enforcement, a goal from the county standpoint was to test procedures for asking for and deploying mutual aid assets from outside the county. In events such as these, emergency managers need to be able to move resources into the area quickly and efficiently. Also being tested was hospital surge capacity. Many of the victims were loaded onto ambulances and buses and actually transported to four area hospitals. This allowed local emergency rooms to practice handling a sudden influx of patients requiring immediate critical care.

In the end, everything came off fine from an exercise standpoint. That's not to say that the participating agencies didn't learn some lessons (that's the point) but it all ran smoothly. I even got to facilitate the 'hot wash', the after exercise discussion between all the participants where they discuss what went well, and what went wrong. Fun stuff.

I'll get some more photos posted up somewhere soon.

Escambia County Exercise, Part I

We are headed over to Pensacola today to set up for the Escambia County Airline Crash Exercise. My center (http://cdrp.net) is worked with Escambia County Public Safety to develop the exercise, and tomorrow we will assist them in putting it on. The exercise is a interesting blend between the Escambia Regional Airport exercise and an HSEEP (Homeland Security Exercise Evaluation Protocol) compliant exercise being conducted by Escambia County Emergency Management. We facilitated the County side development process and we are going to act as exercise controllers and exercise evaluators tomorrow, which is always my favorite part. I will be acting as a controller during the exercise, which means I will basically stand around and make sure that everything stays on track. Since exercises, particularly multi-jurisdictional, multi-agency exercises like this one, try their best to go off the rails, my job can call for some creative thinking to keep everyone pointing in the correct direction.

Today is set up at the airport, and we will get our final look at how the coordination for the city/airport side of the exercise is shaping up. Since we don't control that, it's not that big a deal to us, but it will prove interesting nonetheless.

I'll be posting more as things develop.
---
Sent from my BlackBerry Smartphone

So he doesn't forget it, and for you to read it

Once of my friends and co-workers has finally joined the twenty-first century and created a blog. Let's all give him a big hand for taking his first step into a larger world.

So head over to So I don't forget it... and have a read.