19AQMM20Q0128 QandAs.pdf

SBU - CONTRACTING AND ACQUISITIONS

Due to system unavailability, an amended SF1449 will be posted on or about August 3, 2020.

The purpose of this posting is to provide responses to questions.

Question

Technical or

Price

Solicitation Section #, Title & Page # Question or Recommendation

DOS Reponses

1 General

Is there an incumbent contract that is currently fulfilling this requirement? If so, would you be able to provide me with the

Contract ID number and the vendor name?

Or would this be considered a new requirement?

This is a new requirement.

2 Technical

Addendum to FAR

52.212-2, Factor 3 Past

Performance, Page 44

In accordance with FAR

15.305(a)(2)(ii) and (iv), please provide the approach to be used for evaluating past performance including offerors with no relevant performance history

In the case of an offeror without a record of relevant past performance or for whom information on past performance is not available or so sparse that no meaningful past performance rating can be reasonably assigned, the offeror may not be evaluated favorably or unfavorably on past performance (see FAR 15.305

(a) (2) (iv)). Therefore, the offeror shall be determined to have unknown past performance. In the context of acceptability/unacceptability, “Unknown” shall be considered “Acceptable.”

3 Technical Current Environment, PWS Page 1, Items 1 &

Are the existing Security

Information and Event

Management System (SIEM) and

Log Aggregation Systems both based on Splunk? If not, who are the vendors for those two systems?

The SIEM and Log Aggregation solution are both

Splunk. Additionally, we leverage multiple syslog collection nodes for regional event collection forwarding.

4 Technical Summary of

Requirements, PWS

Page 2, Item 4

Is classification of packets a hard requirement or is flow metadata an acceptable method for classifying network traffic?

The solution should classify all packets belonging to the same flow and then utilize meta data to break out attributes of interest within that session.

5 Technical Current Environment, PWS Page 1, Item 2 &

Summary of

Requirements, PWS

Page 2, Item 7

The Performance Work Statement

(PWS) document states that alerting is currently done within the existing SIEM and Log

Aggregation solutions (PWS Page

1, Current Environment, Item 2).

Per Item 7 in the Summary of

Requirements on page 2 of the

PWS, is it expected that the new

DPCI solution be the initial entity to generate alerts prior to alerts being generated in the existing

SIEM and Log Aggregation solutions?

It is expected that the solution will allow for the analyst to query collected packet data and create custom alerts out of the box based on unique session attributes. The solution should also allow for the transmission of these alerts to the customer

SIEM and Log Aggregation solution (Splunk).

6 Technical Architecture, PWS

Page 4, Item 16

What types of queries will be run within the "75 automated, continuously running custom scripted queries" (i.e. packets, metadata, or both)?

Example, regularly scheduled query of customer

IP space interfacing with known bad URLs, malicious email addresses, or executing DNS queries against known bad domains.

7 Technical Additional Architecture

Features, PWS Page 4, Item 2

What types of 3rd party security tools in use at Department of State would be targets for integration with the new DPCI solution?

Log aggregator, Network Intrusion Protection

Systems, Endpoint Detection and Response, Malware information sharing platforms, Static and dynamic file analysis platforms, and SOAR technologies.

8 Technical Additional Architecture

Features, PWS Page 4, Item 11

Does the Government utilize asymmetric routing via the PoP's?

No we do not.

9 Technical Analyst Functions, PWS Page 6 in relation to Items 1-3 in

Engineering and

Performance instead

What are typical traffic loads (i.e.

peak, average, and daily) at the

POPs on the DoS Network?

Solution should be designed to support traffic requirements outlined in the PWS. Please reference Page 6 item #3

10 Technical Analyst Functions, PWS Page 6, Item 19

Per the example for the

"Customizable 'store packets' function", where does the

Government anticipate the medium, high, and critical security alerts would be generated?

Solution reputation services, solution capture and detection of known malicious connections, and in the creation of custom alerts.

11 Technical Architecture, PWS

Page 4, Item 12

Is the current solution that is used to intercept and decrypt SSL/TLS packets integrated within the

Packet Broker or network TAP technology?

CMO/CO utilizes Gigamon network TAPs.

12 Technical Analyst Functions, PWS Page 5, Multiple

Items

Will the new DPCI solution have the ability to ingest public Threat

Intelligence Indicators, rules, events, and classifier updates directly from the vendor/Internet once implemented?

Yes

13 Technical Analyst Functions, PWS Page 6, Item 16

Is NetFlow the only format that can be used for anomaly analysis or can other flow formats be utilized that are more effective?

Any alternative flow format must demonstrate

NetFlow’s format capabilities. Any additional capabilities to perform anomaly analysis would be evaluated per the governments evaluation criteria.

14 Technical Analyst Functions, PWS Page 5, Item 11

Will stored data have to be classified by some indication of priority and privacy or secrecy to limit user access?

No

15 Technical Analyst Functions, PWS Page 5, Item 7

Which protocols are expected to be parsed for metadata?

Example of protocols: ARP, BGP, DHCP, DHCPv6, DNS, FTP, HTTP, HTTPS, iBGP, ICMP, IMAP, IRC, KERBEROS, KPOP, MAIL, NETBIOS, NFS, NTP, PBP, POP3, RIP, RLOGON, RTP, SCCP, SCP, SFTP, SIP, SMB, SMIME, SMTP, SNMP, SQL, SSH, SYSLOG, TACACS, TDS, TELNET, TFTP, TNS, etc...

16 Technical Architecture, PWS

Page 3 (Change to:

Analyst Functions, PWS Page 6, Item 11

Is there a requirement to restrict or control access for analysts to specific types or classes of data, including Alerts, Metadata and

PCAP?

No

17 Technical Engineering and

Performance, PWS

Page 7, Item 8

Is the management interface expected to be out-of-band or just on a different subnet for management of components? How is this management interface different than the single console/interface described in PWS Architecture, Page 3, Item 4?

The physical management interface needs to be separate from the collection interface. The single console references a single pain of glass for administration of all solution components.

Typically a software solution or Web GUI including all components.

18 Technical Engineering and

Performance, PWS

Page 7, Item 6

Item 6 on page 7 of the PWS indicates that all internal and external traffic be monitored at the

2 POPs, however Item 2 on Page 3 of the PWS and Item 3 on Page 2 of the PWS both state the DPCI solution must capture all packets traversing the network borders at the POPs and have no reference to internal traffic. Can the

Government provide clarification that the new DPCI Solution will monitor only ingress-egress traffic at the PoPs and not be responsible

The intent is for the solution to interface into a network aggregation solution (TAP – Gigamon) collecting traffic traversing the POP security solution. The DPCI solution will be leveraged to monitor traffic traversing the POP security stack.

This includes both inbound and outbound traffic.

There is no intent to capture internal lateral enterprise communication.

for internal traffic at enterprise level?

19 Technical CLIN 001/002 page 3, CLIN 003 and remaining page 3

Delivery date states 10/30/2020 and then under installation and support services states delivery date 9/30/2020. Is this a typo? Is the Government expecting hardware on site by that time or what specifically is required for delivery?

Delivery date updated to 10/30/2020

20 Technical Engineering and

Performance, PWS

Page 7, Item 9

The requirement listed in Item 9 on Page 7 of the PWS in the

Engineering and Performance

Section seems to indicate that any equipment or component used in the DPCI solution must not be added to any end-of-sale list for at least 5 years. If that is the intent of the requirement, will the government instead accept equipment/components that even if they do go end-of-sale within 5 years after award, will not go end-of-maintenance or end-of-support for at least 5 years after the date it goes end-of-sale?

The government will accept equipment that will not go end-of-maintenance and end-of-support for at least 5 years after the date it goes end-of-sale.

Technical PWS Engineering &

Performance, Page 6

Do the specified traffic rates of 20, 30 & 40 Gbps reflect an average bandwidth?

The 20, 30, and 40 Gbps technical capability attributes described in the PWS reflect a sustained capture rate by the solution and technical requirement to be met by the solution.

Technical PWS Architecture, Should the solution provide the capability to tier to a more cost-effective tier after a designated number of days, would the same requirement to permit extraction of packet captures from those packets in 15 minutes or less still apply or be more lenient for the data existing on the lower data storage tier?

A cost effective model to long term cold and/or warm storage of POP meta and packet data would align with the Departments goal of a cost effective and best value approach to full packet capture.

With a demonstration of a cost effective solution including a tiered approach to storage, the

Department would not hold lower tier storage to the 15 minute requirement.

23 Technical Attachment A PWS –

Can you provide the make, model, and version of the existing Deep

Packet (also called full packet)

Capture and Inspection solution that is being replaced?

The government is declining to provide this information.

24 Technical Attachment A PWS –

Will DS/CTS/CMO/CO be open to solutions where the packet capture & storage hardware is hosted separately from the deep packet inspection software, both within the DOS network architecture?

Conceptually, it is not required that the packet inspection engine and storage are one physical unit. The Department is able to host the inspection engine, storage, and management solution separately.

25 Technical Attachment A PWS –

Will DS/CTS/CMO/CO be open to Prototype or Developmental solutions which enables DOS

Security Analysts to create and deploy Artificial Intelligence and

Machine Learning algorithms to provide additional network insights such as adaptative anomaly detection, IoT/SCADA discovery, left of SIEM behavior-

In general, the Department would be interested in seeing additional capabilities to our written requirements that include AI and Machine

Learning. However, all solutions will be evaluated per the evaluation criteria.

based event creation, building occupancy and usage, etc.?

26 Technical Attachment A PWS

What SIEM and Log Aggregation tools are in place today for operation in DS/CTS/CMO/CO?

CMO/CO utilizes Splunk, Syslog Clusters.

27 Technical

Attachment A PWS

What TAP system is

DS/CTS/CMO/CO currently using?

CMO/CO currently utilizes Gigamon TAPs

28 Technical

What routing systems is using?

We use 802.1Q network standard routing.

29 Technical

What security tools is using?

Log aggregator, Network Intrusion Protection

Systems, Endpoint Detection and Response, Malware information sharing platforms, Static and dynamic file analysis platforms, and SOAR technologies.

30 Technical

Attachment A PWS –

On Page 1, DoS states: "Among the critical capabilities required by

CTS is the ability to record every packet of traffic traversing the

DOS’ network border for later analysis and reconstruction, while incurring the least impact on network bandwidth to SBU network services "

What is the network bandwidth

Solution bandwidth and support requirements are identified in the PWS section Engineering &

Performance, Page 6 today that is allocated to support this operation?

31 Technical

Attachment A PWS –

On Page 2, DS/CTS/CMO/CO requires the following: “2. Option to increase the quantities of listed requirements due to growth in order to ensure continuity of service throughout the prospective contract period of performance.”

Please elaborate/clarify this statement, "option to increase the quantities of listed requirements due to growth".

PWS Engineering & Performance section Page 6-

7 items 2,3,and 7 identify solution scalability requirements.

32 Technical

Please provide the following metrics regarding the DOS network to help industry develop the correct level of effort and a cost-effective price.

a. How many Flows Per Minute?

b. How many Events Per Second?

c. How many servers

(physical/virtual) do you have in your environment?

d. What is the size of the log storage required to support daily across the network?

A) an average of 1,000,000 flows per minute per location.

B) N/A

C) ~20,000 servers in the environment

D) Currently ~7TB of ingestion per day.

33 Technical General Does DOS have up to 42U contiguous rack-space available?

Or should the solution include a rack system?

DOS has sufficient rack space to support a 42U solution and can also support a “rack included” solution.

34 Technical General Please confirm that site UPS, Power and HVAC systems will be used and do not need to be included as part of the solution.

Site UPS, Power, and HVAC are provided.

35 Technical General Indications are that DOS will be providing network connections to existing TCP/IP environment for proposed packet capture solution to capture data. If this is correct please provide the type (1Gbit, 10Gbit) and number of connections to be accessible. In addition, please provide the manufacturer and model number of the network switches to be connected into, to include the connection type.

Data feeds will be provided through Gigamon

GigaVUE TAP infrastructure (1/10/40GB).

Management connectivity will be through Cisco

9300 1 or 10G SFP based interfaces.

36 Technical General Would DOS have the capability to store on-site depot kit parts? A depot kit normally consists of those items (fans, power supplies, hard drives, DIMMs) that are items that are easily replaced but kept on-site to facilitate response times.

Yes

37 Technical General Please confirm that, due to the environment, all items that can store data, DiMMs and hard drives, and following

Correct, vendor should assume and accept that

DOS will not return hard drives as part of the

RMA process. Hard drives would be kept and destroyed by DOS.

replacements (in case of failure) will be permanently kept on-site and destroyed by DOS.

38 Technical General Will a combination of active and connected network interfaces, for example four (4) 10Gbit Network interfaces, meet the requirement for a 40 Gps traffic rate?

A combination of connected network interfaces is acceptable as given in the example, in addition single 40GB interface connections are desirable if possible.

39 Technical General Outside of connecting via solution provided server interfaces, will all networking configuration requirements (setting up LANS, assigning IP’s, subnets, etc.) be conducted by the DOS personnel?

Configuration of DOS networking equipment will be configured by DOS.

40 Technical General Does the current network infrastructure include

Intelligent/Smart Active or

Passive Terminal Access Points

(TAPs)? And if so, does it have the capability to distribute capture data to multiple devices? What is the maximum supported quantity of TAP distribution?

CMO/CO is utilizing Gigamon smart TAPs. CO does have the capability to distribute capture data to multiple devices with ~70 10GB and ~30 40GB interfaces.

41 Technical Attachment A-PWS;

Section: Analyst

Functions; Page 6, #16

‘NetFlow protocol anomaly analysis’

NetFlow anomaly analysis has different meanings, does the government mean network

NetFlow usage or connectivity anomaly detection?

Protocol anomaly detection

42 Technical Attachment A-PWS;

Section: Analyst

Functions; Page 6, #17

‘Include 80% of the

The “DPCI Functional-Operations

Requirements” spreadsheet was not attached to the procurement notice 19AQMM20Q0128. Will

The “DPCI Functional-Operations” was listed as a typo. That attachment is “Evaluation Criteria”.

metadata requirements listed in the “DPCI

Functional-Operations

Requirements” spreadsheet.’

the government provide the

“DPCI Functional-Operations

Requirements” spreadsheet attachment?

43 Technical Attachment B-

Evaluation Criteria;

Section 4, Services and

Support; Page 3, #1

‘Contractor must provide US- based support accessible 24 hours a day x 7 days a week, by phone, web, email and a dedicated account subject matter expert (SME) for DoS, as well as a clearly defined escalation and resolution process included within the solution. (PWS Service and Support 1)’

Can you clarify the duration of on-site SME support desired?

PWS Page 2 – Item 9; The contractor will provide on-site support with project management, engineering, integration, documentation, and implementation of the solution into the DOS network.

PWS Page 9 – SME Requirements Items 1 – 9

44 Technical Attachment B-

Evaluation Criteria;

Section 1, Architecture

Requirements; Page 1, #10 ‘Have the ability to queue up data when a network line is down;

the Contractor’s solution shall state explicitly the time

Would the government provide the network link outages scenario for the contractor solution requiring a time range or storage capacity?

In the event that a network outage impacting solution connectivity between critical components the solution shall have the ability to repopulate historical data based at restoration. A scenario for example may include the creation of meta data based on packet data within the last hour after network services are restored and the meta data engine is reintroduced to the past hour of packet data.

range or storage capacity for this scenario. (PWS

Architecture 10)’