1.1.4 SOW MAFA v2.docx

Malware and Memory Analysis Framework and Application Statement of Work

1.1 Introduction:

This Statement of Work (SOW) outlines the requirements and expectations for the development of a comprehensive malware/memory analysis framework and application, as well as curriculum, to assist state, local, tribal, and territorial (SLTT) partners in identification, mitigation, and attribution of potential security threats within a victim’s digital infrastructure. This need was identified in a previous government research effort (project) to further develop an incident response framework, investigative assistant, and training curriculum for SLTT partners. The overarching purpose is to enhance the cyber-security posture as well as the cyber-investigative capabilities of SLTT partners.

1.2 Background

Established in 2008, through a partnership initiative between the Department of Homeland Security (DHS), the U.S. Secret Service, the State of Alabama, and the City of Hoover, the National Computer Forensics Institute (NCFI) is the nation’s premier federally funded training center dedicated to the instruction of state and local law enforcement officers, prosecutors, and judges in cybercrime investigations. The NCFI empowers state and local law enforcement through the provision of representative, hands-on training in network intrusion response, digital evidence processing, and applicable case law for high-tech crime prosecution and adjudication. State and local task force members work alongside other federal agencies and private sector entities to thwart cybercrimes targeting both private citizens and our nation’s financial and critical infrastructure.

The mission of the NCFI as directed under Federal law 6 USC 383, is to train law enforcement to: conduct cyber and electronic crime investigations; conduct computer and mobile device forensics examinations and respond to and investigate network intrusion incidents.

The NCFI recognizes the critical importance of cyber-security and cyber-investigations in safeguarding stakeholder digital assets, sensitive information, and operations. As part of its ongoing commitment to enhancing cyber-security resilience and cyber-investigative expertise for state, local, tribal, and territorial (SLTT) law enforcement officers, the NCFI seeks to engage Jacksonville State University (JSU) to provide a comprehensive malware/memory analysis framework and application.

1.3 Objectives:

Develop and improve tools, processes and curriculum, as it applies to:

· Recognize and identify malicious activity

· Determine the impact of malware on various systems

· Recommendation to mitigate security risks

2.1 Scope of Work

The project includes the development of a comprehensive malware / memory analysis framework, application and curriculum to assist SLTT partners in the identification, mitigation and attribution of potential security threats within a victim’s digital infrastructure. The “investigative assistant” application shall focus on both static and dynamic aspects of a malware investigation, as well as memory forensics to ensure a thorough investigative methodology is attained.

Jacksonville State University (JSU), Center for Best Practices in Law Enforcement shall perform the following tasks:

· Identify and analyze malware threats within the victim's network and systems.

· Identify attribution artifacts based on the malware detected.

· Detect and analyze malicious activities in volatile memory in order to attribute the malware to a threat actor.

· Provide actionable recommendations for mitigating identified security threats.

· Focus on the art of attribution of malware and within dynamic memory along with the indicators of compromise.

· Provide a methodology and toolset so that SLTT partners have the capacity for identifying indicators of compromise (IOCs) and then submit those IOCs to a terminal investigative authority.

Sub-tasks include but are not limited to:

· Determine the location suspicious files and executables.

· Conduct static analysis to identify known malware signatures and patterns.

· Identify and document malware behavior, capabilities, and communication channels.

· Determine the impact of malware on system integrity, confidentiality, and availability.

· Provide detailed reports on malware findings, including indicators of compromise (IOCs).

· Provide a “how to guide” for the capture of volatile memory data from relevant systems.

· Identify and extract artifacts related to malicious activities from memory dumps.

· Investigate and document evidence of code injection, rootkits, and other memory-based attacks.

· Correlate memory analysis findings with malware analysis results.

· Provide a comprehensive report on memory analysis, detailing identified threats and associated IOCs.

Recommendations from JSU shall include the following:

· Propose mitigation strategies and best practices based on the analysis results.

· Provide guidance on improving security controls and policies to prevent future incidents.

· Collaborate with the victim's IT and security teams to implement recommended measures to assist in the attribution of malware within a dynamic memory environment.

2.2 Deliverables:

The following deliverables are expected from the JSU – Center for Best Practices in Law Enforcement and / or the provider the JSU chooses:

· Deliverables shall be in the form of hardware, software, or documentation.

· An easy-to-use application for SLTT Law Enforcement Officers which can be installed on a mobile device for use during an active investigation. This might include aspects of augmented reality to assist the SLTT investigator in attributing the malicious event to a suspect.

· Detailed reports on malware analysis, including static and dynamic findings.

· Comprehensive memory analysis reports with identified threats and IOCs.

· Actionable recommendations for mitigating identified security threats.

· Actionable recommendations for the attribution of identified security threats.

· Documentation of methodologies and tools used during the analysis.

· The JSU representative(s) and the Government Contracting Officer’s Representative are encouraged to meet monthly at the place(s) of performance to discuss performance and the deliverables.

· All documentation, photography, and electronic data and information collected by the contractor and entered into or generated in support of this contract shall be considered government property and shall be returned to the government at the end of the contract performance period.

· The Government Contracting Officer’s Representative will provide written rejection and rationale for all deliverables within 30 days of receipt, or the deliverable will be deemed accepted.

2.3 Contractor Personnel:

· Contractor shall provide one or more personnel necessary to accomplish the various tasks and supplementary tasks that may arise.

· While in government facilities, contractor employees are required to adhere to USSS IT Rules of Behavior, Privacy Policies as well as comply with other reasonable security-related requirements as may arise from time to time.

· When in government facilities, contractor employees shall present a professional appearance at all times and their conduct shall not reflect discredit upon the United States and the Department of Homeland Security.

· Contractor shall not employ any person who is an employee of the United States government if that employment would or would appear to cause a conflict of interest.

· All proposed substitutes shall possess qualifications equal to or superior to those as described in the following labor category description/profile.

· Government may, at its sole discretion, direct the contractor to remove any contractor employee from the government facilities for misconduct or security reasons. Removal does not relieve the contractor of the responsibility to continue providing the services required under any contract. The Contracting Officer will provide the contractor with a written explanation to support any request to remove an employee.

· Minimum Qualifications:

· High school diploma (or the equivalent) and not less than one year of experience with hardware and Windows-based software applications.

· Experience with designing and implementing network access controls.

· Experience in technical writing.

2.4 Place of Performance: All design, development and testing work on the project will occur at the contractor facility or facilities, the facilities of the respective partners, the NCFI, the NCFI Lab or places as needed for the supplementary tasks. For final delivery, the contractor may be required to travel to the government facility (to be determined by the NCFI COR and the University Programs ATSAIC. Meetings and reviews will be attended virtually, or in-person as required by the appropriate contractor team personnel at the contractor’s location.

3.0 Period of Performance: The period of performance for this effort is a base period of 12 months, with 4, 12-month options. Options shall be exercised IAW FAR 52.217-9, Option to Extend the Term of the Contract.

3.1 Schedule:

The development of a comprehensive malware/memory analysis framework and application, as well as curriculum, is expected to commence on 09/30/2024. The schedule for training delivery, including specific dates for each course/module, will be mutually agreed upon by the NCFI and JSU.

3.2 Terms and Conditions:

This SOW is subject to the terms and conditions outlined in the contract between the NCFI and JSU. Any modifications or amendments to this SOW must be negotiated between the parties and approved and signed by the government Contracting Officer through issuance of a Standard Form 30, formal modification. No other government official has the authority to obligate the government.

3.2.1 Privacy Act: Personnel who have access to Privacy Information shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

3.2.2 Physical Security: The contractor shall be responsible for safeguarding all Government equipment, information and property provided for contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured.

3.2.3 Key Personnel: The contractor shall provide a Project Manager who shall be responsible for the performance of the work. The Project Manager shall be the primary point of contact for the Contracting Officer (CO) and Contracting Officer’s Representative (COR). The Project Manager shall be responsible for providing quotes to the COR within 48 hours of request and for keeping the COR abreast of changes made in estimates and/or services. The Project Manager or designee shall be available to the COR or designated representative via telephone during normal business hours and shall respond within 1 hour of notification for discussion and resolution of technical problems. The name of this person and an alternate who shall act for the contractor when the Project Manager is absent shall be designated in writing to the contracting officer. The Project Manager or alternate shall have full authority to act for the contractor on all contract matters. The Project Manager or alternate shall be available during normal business hours, Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

3.2.4. Contracting Officer Representative (COR): The Government (COR) is listed in section 4 of this document. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer’s Representative and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of appointment issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

3.2.5 Data Rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

3.2.6 Payment for Unauthorized Work. The Contractor will not be paid for the performance of work that is not authorized under the contract. No payments will be made for any unauthorized services or for any unauthorized changes to the work specified herein. This includes any services performed by the Contractor on their own volition or at the request of an individual other than a11duly appointed PM or COR. Only a duly appointed CO is authorized to change the specifications, terms, or conditions under this effort.

3.2.7 USSS/ NCFI-Furnished Information: USSS / NCFI will provide certain USSS / NCFI information, materials, and forms unique to USSS / NCFI to the contractor to support certain tasks under this SOW. The USSS / NCFI COR and the NCFI University Programs ATSAIC or designee identified in this SOW shall be the point of contact (POC) for identification of any required information to be supplied by USSS / NCFI. The contractor shall prepare any documentation according to the guidelines provided by USSS / NCFI.

3.2.8 Technical Direction: Performance of work under this contract shall be subject to the technical direction of the University Programs ATSAIC or his designee. The term “Technical Direction” is defined to include, without limitation, the following: (a) Directions to the contractor which redirect the contract effort, shift work emphasis between work areas of tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish contractual statement of work. (b) Provision of information to the contractor that assists in the interpretation of drawings, specifications, or technical portions of the work description. (c) Review and, where required by the contract, approval of technical reports, drawings, specifications, and technical information to be delivered by the contractor to the Government under the contract. Technical direction must be within the general scope of work stated in the contract. The COR does not have authority to and may not issue any technical direction which (i) constitutes an assignment of additional work outside the general scope of the contract; (ii) constitutes a change as defined in the contract clause entitled “Changes” (FAR 52.243-1); (iii) in any manner cause an increase or decrease in the total contract cost or price, the fixed fee or the time required for contract performance; or (iv) changes any of the expressed terms, conditions, or specifications of the contract. All technical direction shall be issued in writing by the COR or shall be confirmed in writing within five (5) working days after issuance. The contractor shall proceed promptly with the performance of technical directions duly issued by the COR in the manner prescribed by this article. If, in the opinion of the contractor, any instruction or direction issued by the COR is within one of the categories and defined in (i) through (iv) above, the contractor shall not proceed but shall notify the CO in writing within five (5) working days after the receipt of any instruction or direction and shall request the CO to modify the contract accordingly. Upon receiving such notification from the contractor, the CO shall issue an appropriate contract modification or advise the contractor in writing that, in his/her opinion, the technical direction is within the scope of the contract. The contractor shall thereupon proceed immediately with the direction given. A failure of the parties to agree upon the nature of the instruction or direction or upon the contract action to be taken with respect thereto shall be subject to the provisions of the contract clause titled, “Disputes” (FAR 52.233-1.).

3.2.9 Inspection and Acceptance: In the absence of other agreements outlined and/or negotiated with respect to time provided for government review, deliverables will be considered accepted if no comments are made within 30 days of deliverable due date.

3.2.10 Deliverables: The contractor shall provide all deliverables identified in this SOW, paragraph 2.2, directly to the USSS COR or the University Programs ATSAIC or designee with a copy of the transmittal letter to the Financial Analyst.

3.2.11 Monthly Status Report: The contractor shall deliver a monthly status report (MSR) to the Component POC on the 10th day of every month containing metrics pertaining to financial, schedule, scope, risk, and performance assessment information in the provided template. This MSR will describe the previous 30 calendar days’ activity, technical progress achieved against goals, difficulties encountered, recovery plans (if needed), plans for the next 30 calendar day period, and financial status (see Invoices below). The MSR template will be provided by the USSS / NCFI S&T COR to the Contractor at program kickoff. The final report in electronic format is due within 10 days of end of each contract year.

· Invoices JSU shall follow the IPP payment procedures listed within Attachment 2, Contract Clauses, of the contract. In addition, JSU shall deliver a monthly invoice to sbaskerville@usss.dhs.gov. Invoices shall contain the following details for both the month invoiced and cumulative: labor hours/person/task, labor cost, travel cost (very unlikely), indirect costs, material costs, other direct costs, and fee, if applicable. The invoice shall include cost per subtask (for the reporting period and the cumulative). Material costs for all hardware and software purchased as part of this contract shall be itemized in the invoice.

· Government Property Contractor personnel working off-site shall be expected to furnish any required property necessary to perform the contract, unless expressly provided otherwise in the contract.

3.2.12 Security Requirements: The contractor shall adhere to all applicable government laws, regulations, orders, guides, and directives pertaining to classified, Sensitive but Unclassified (SBU), FOUO, or personally identifiable information. The contractor shall safeguard SBU, FOUO information specifically in accordance with USSS / NCFI Management Directive 11042.1 and in compliance with HSAR Class Deviation 15-01 Safeguarding of Sensitive Information.

3.2.13 Access to USSS/ NCFI Facilities and Resources: USSS / NCFI may exercise full control over granting, denying, withholding, or terminating unescorted access to USSS / NCFI facilities, USSS / NCFI systems, and/or sensitive USSS / NCFI information for government/contract employees. Access will be based upon the results of a USSS / NCFI fitness/suitability investigation. USSS / NCFI may, as appropriate, make favorable entry of duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the government/contract employee to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full USSS / NCFI fitness/suitability authorization will follow. The granting of a favorable EOD decision or a full USSS / NCFI fitness/suitability authorization determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by USSS / NCFI, at any time during the term of the contract/task order. No employee of the government/contractor shall be allowed unescorted access to a USSS / NCFI facility, access to any sensitive USSS / NCFI information, or access to USSS / NCFI Systems without a favorable EOD decision or USSS / NCFI fitness/suitability determination by the USSS / NCFI HQ Office of Security. Government/contract employees assigned to the contract/task order not needing access to sensitive USSS / NCFI information, USSS / NCFI systems, or access to USSS / NCFI facilities will not be subject to USSS / NCFI fitness/suitability screening.

· Government/contract employees waiting on an EOD decision may not begin work on the task order. Limited access to USSS / NCFI facilities is allowable prior to the EOD decision if the government/contract employee is escorted by an approved USSS / NCFI employee. This limited access is to allow government/contract employees to attend briefings, nonrecurring meetings, and begin transition work. During one’s limited access the government/contract employee will not have access to sensitive or classified USSS / NCFI information.

· Classified information is government information which requires protection in accordance with Executive Order 13526, National Security Information (NSI) as amended and supplemental directives. If the government/contract employee has access to classified information at a USSS / NCFI owned or leased facility, it shall comply with the security requirements of USSS / NCFI and the facility. If the government/contract employee is required to have access to classified information at another Government Facility, it shall abide by the requirements set forth by the agency.

4.1 Points of Contact:

For all matters related to this SOW, the following individuals shall serve as the primary points of contact:

USSS / NCFI Lab NCFI University Programs ATSAIC Contracting Officer Representative Steven Baskerville e-mail: sbaskerville@usss.dhs.gov Phone: 918-728-7290

PRO/INV

Contract Specialist Donna Heinz Email: donna.heinz@associates.usss.dhs.gov

PRO/INV

Contracting Officer Matthew Sutton Email: matthew.sutton@usss.dhs.gov

Jacksonville State University – Center for Best Practices in Law Enforcement Director, Center for Best Practices in Law Enforcement at JSU Kaleb Littlejohn klittlejohn@jsu.edu

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.2. CONTRACTING OFFICER (C.O.). A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

2.1.3. CONTRACTING OFFICER’S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of the authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

2.1.4. DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.5. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the SOW. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.6. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.2. ACRONYMS: