Attach_4_Technical_Scenario__3_16-223-SOL-00019.pdf

RFP# 16-223-SOL-00019

ATTACHMENT 4

Scientific Computing Technical Scenario #3

Scientific Workstation Scenario

Describe a response to an alert from the Security Operations Center (SOC) regarding 3 computer assets potentially infected with a virus. Use the tools available to respond appropriately and meet requirements of the SOC, Scientific Workstation management environment, FDA scientists and laboratory management. FDA first response, investigation, remediation and reporting will be performed by the contractor (you). Describe how the response including investigation and communication of findings would proceed. Consider two separate outcomes: a.) the detection is a false positive – show how this could be proven and communicated to the SOC for closure, b) the detection is valid – show how the assets could be dealt with, the infection removed and scientific work continue. The technical approach, steps followed, why and how are important and will be factors used in the evaluation in lieu of a “correct” answer.

Specifics of the detection:

1) The alert is sent from the SOC via email to the federal contract officer’s representative

(COR) for the contract at 9:00 AM ET and forwarded to the information systems security officer (ISSO), contract PM and technical lead at 9:05 AM.

2) According to the SOC’s alert Nessus scans show the 3 assets on the FDA network are listening for connections on port 1080 which is characteristic of the

“W32.BugsBunny@mm” virus.

3) The computer assets are in 3 separate locations: i) the laboratories of the Office Of Colors

Certification in College Park, MD, ii) the Office of Food Safety laboratories in Summit

Argo, IL and iii) the Center for Biologics laboratories in White Oak, MD.

4) The Nessus findings were compiled from scans of the FDA network the day before.

Scans are run on roughly a monthly basis.

5) “BugsBunny” type viruses were common on unprotected computers in ca.~2006 however not in 2015 almost 10 years since the virus was discovered.

Specifics of the scientific workstation environment:

1) All FDA scientific workstations are joined to Active Directory, support PIV card authentication and are on the FDA network (a.k.a. business network, regulatory network).

2) The standard FDA security applications for scientific workstations include centrally controlled antivirus and likewise antimalware applications both managed by scientific computing contractors and COR. Alerts triggered by detections of both clients are sent to e central database as described in #5 below.

3) Definitions for both antivirus and antimalware clients are updated from the vendor automatically a minimum of 4 times per day. Scans are performed every other day in an alternating cycle so on each day a full disk scan has been performed by one of the two security clients.

4) There are in-house developed and maintained tools for all operating system and

“middleware” updates. These provide continuous monitoring and remote

RFP# 16-223-SOL-00019

ATTACHMENT 4

Scientific Computing Technical Scenario #3 control/access capabilities but do not force a reboot to complete installation of packages.

5) Auditing of Windows patches is performed by the same in-house tools described in

#4. Auditing of installed software and services is performed by the in-house tool and compared with a commercial off the shelf (COTS) tool.

6) All auditing records for updates, software, services and alerts generated by the antivirus/antimalware are compiled and compared through a database with queries available through a user interface to show compliance and gaps, inventory software, services running, location, workstation name, operating system, principal user. This information is available to the federal COR, ISSO and scientific computing contractors.

7) Scientific workstation infrastructure engineers have remote access capabilities to all workstations.

8) There are on-site hands-on engineers (not infrastructure engineers) at College Park and White Oak Maryland locations. Scientific computing infrastructure engineers who run patching and antivirus/antimalware are only at White Flint, MD. There are no on-site scientific computing engineers or engineers of any kind at the Summit

Argo, IL facility.

Requirements for communication with the SOC:

1) Notification from the SOC has to be acknowledged within 15 minutes.

2) Conclusive evidence of successful remediation or confirmation of false positive with supporting evidence must be communicated back within 3 hours of initial contact.

3) Computers confirmed infected get removed from the network and rebuilt.

4) Failure to meet the above results in the network port for the asset(s) identified being turned off after the 3 hour clock starts or sooner if confirmed as infected.

Requirements for scientific workstations:

1) NO arbitrary reboots. The scientist selects the time for rebooting according to work schedule.

2) The Office of Colors Certification laboratory computers in addition to the no reboot requirement above, must be available to be in operation 24/7/52 with very minimal down time as their approval program impacts a large part of the US economy. These laboratory workstations must stay in operation and on the FDA network so data can be acquired and processed to support the certification of colorants used in cosmetics, foods, pharmaceuticals and medical devices in the US.

3) The contractor is required, as described in the SOW, to meet BOTH the business needs of the FDA scientists and agency IT security.