RFI_CISA CSD CB Threat Intelligence Enterprise Services 12.7.22 .pdf

Request for Information – Threat Intelligence Enterprise Services (TIES)

Agency: Cybersecurity and Infrastructure Security Agency / Cybersecurity Division / Capacity Building

Market Research Agency: CISA CSD Capacity Building/GSA

Notice Type: Request for Information (RFI)

NAICS: 541512 Computer Systems Design Services

GSA Reference: 47QFRA23K0002 Posted Date: November 16, 2022 Amended Date: December 7, 2022

I. GENERAL INFORMATION

This Request for Information (RFI) is being issued on behalf of the Cybersecurity and Infrastructure Security Agency’s (CISA) Cybersecurity Division (CSD) and Capacity Building (CB) sub-division for the development of Cyber Threat Intelligence (CTI) capabilities to be offered as a compendium of enterprise services to Federal, Intelligence Community, State and Law enforcement customers.

II. RFI OBJECTIVE

The purpose of this RFI is to assist the Government in conducting market research focused on identifying potential offerors as well as to gain feedback from industry partners who can develop or configure a Cyber Threat Intelligence Exchange Platform and provide integration to customized CISA applications and commercial threat feed. These integrations, services and solutions include but are not limited to what is outlined below in Section IV.

The information provided as response to this RFI will be used for market research only. The Government is not obligated to release a future solicitation based on this market research.

III. BACKGROUND

CISA leads the national effort to defend critical infrastructure against the threats of today, while working with partners across all levels of government and in the private sector to secure against the evolving risks of tomorrow. CISA's mission includes protecting the Federal Government's networks and physical infrastructure, helping entities in the public and private sectors manage potential risk and enhancing public safety communications at all levels of government.

Capacity Building serves as CISA’s enterprise cybersecurity services management arm for national stakeholders and the lead for federal enterprise cybersecurity governance. CB enables its customers to manage cybersecurity risk by building their capacity to implement effective cybersecurity policies, tools, and procedures. CB helps stakeholders better manage cybersecurity risk by defining expectations for stakeholder cybersecurity; leading implementation and enforcement of cybersecurity requirements;

managing CISA’s cybersecurity services portfolio; building capacity; and enhancing collective defense and readiness. Specifically, CB enhances stakeholder cybersecurity readiness, bolsters enterprise capabilities and protections, and increases the community’s capacity to adequately manage cyber risk by:

1. Defining critical requirements, needs, and performance expectations.

2. Overseeing and guiding the implementation of key cybersecurity initiatives and urgent actions, including federal cybersecurity policy, leading practices, cyber directives and operational guidance.

DianaEZoppi Highlight

DianaEZoppi Highlight

3. Managing CISA’s cybersecurity services portfolio; evolving shared services, capabilities and delivery models; and delivering tailored services and assistance based on customer needs.

CB’s Threat Intelligence Enterprise Services

Members of the Federal cyber ecosystem face barriers through all stages of the CTI lifecycle.

Fragmented information about critical cyber threats reduces analysts’ abilities to effectively generate, use, and share CTI to make timely and informed decisions to support their missions. Critical CTI is spread across disparate feeds and exists in inconsistent data formats, which limits the collaboration needed to develop an accurate, shared threat picture. Further, the cyber maturity levels of participants in the CTI ecosystem vary widely. Specifically, the Federal cyber ecosystem lacks:

• Efficient procurement of CTI and CTI tools and services

• Effective tools, services, and capabilities for CTI collaboration and processing

• Assessments to assess maturity or create a roadmap to build and grow CTI capabilities

• Guidance to effectively use purchased CTI services and tools for network defense

• Awareness and centralization of CTI requirements

To solve this, the CB Cybersecurity Shared Services Office (CSSO) is working to establish Threat Information Enterprise Services (TIES).1 TIES will offer customers a suite of complementary CTI Services, Standards, and Guidance to improve their CTI production, utilization, and sharing capabilities.

TIES will also allow customers to easily determine their needs (via self-assessments), research offerings, and procure and effectively use CTI services and tools. The TIES objectives are:

• CTI Generation: Improve CTI generation capabilities, i.e., collection, processing and analysis.

• CTI Use: Improve capabilities to use CTI for cybersecurity decisions and actions.

• CTI Sharing: Improve capabilities to collaborate with partners and the broader security ecosystem.

IV. OPERATIONAL AND FUNCTIONAL OVERVIEW OF TIES SOLUTION

CISA intends to offer FCEB, SLTT and other stakeholders a streamlined CTI ingestion and sharing capability. The CB CTI exchange platform will be a one stop integration point for analysts and infrastructure to receive, share and collaborate on relevant and timely CTI, enabling teams to protect their environments and others. The platform’s collaboration capabilities allow analysts to work with others to further enrich CTI. Customers will have access to a centralized interoperable CTI platform to efficiently exchange, enrich, and analyze CTI to better reduce cyber risk.

A comprehensive cyber threat intelligence solution will enable collection and analysis of data from a range of feeds/channels, including social, mobile, and web sources. Third party threat intelligence data helps CISA and other agencies continually monitor their networks to detect breaches, domain and social media spoofing, and other threats associated with their vendors and suppliers. These feeds enable quick remediation for vulnerabilities, exposed assets and accounts. Common information required includes IoC management and history, network compliance, and TTPs observed in the sector.

Among many anticipated requirements for this cyber threat intelligence offering, the solution must support the STIX data exchange format, as well as the TAXI data transfer mechanism. Additionally, the solution should have a REST API that would allow external clients automated access to data and workflows in the

1 (CSSO is dedicated to enhancing cybersecurity through sharing of accurate, actionable, timely, and relevant cyber threat information to enhance the security posture of the computer network defense community) platform. The solution must provide for the ingestion, tagging and correlation of multiple threat related data sets. The solution must support native data types for all STIX Domain Objects (SDOs), with the ability to index and query all SDOs.

The below overarching diagram highlights the notional solution operational construct. It is important to note that this RFI is focused solely on the CTI Exchange Platform component and integrations to commercial feeds and Automated Indicator Sharing (AIS) (note the components of Figure 1 outlined in red).

CISA intends for the CTI Exchange platform to:

• Serve as one stop integration point for analysts and infrastructure to receive and share relevant and timely CTI.

• Offer collaboration and analysis capabilities for analysts to work with others to further enrich

CTI.

• Ingest and aggregate CTI from Automated Indicator Sharing (AIS), commercial threat intelligence feeds, and other sources.

Figure 1. TIES Notional Portfolio

Figure 2 below displays the notional operational view of TIES

Figure 2. TIES Notional Operational Architecture

V. INDUSTRY MEETINGS

Based on responses provided by industry additional information may be requested. As a result, the General Services Administration with CISA, at the Government’s discretion, may schedule meetings with industry to discuss responses to this RFI. If a follow-up meeting is required, the Government will reach out directly to the industry partner point of contact.

VI. RFI RESPONSE

Interested parties should respond to this RFI outlining their capabilities (as guided by the below comments/questions and the overview listed above) as well as any recommendations to providing integration, services and solutions associated with the broad scope outlined above the Government should consider. Responses may include references to examples of consulting and/or implementation support that align with capabilities or services currently provided by the responder.

CONTENTS

The RFI response shall be split into two Sections.

“Section 1” of the response is for administrative information and shall include the following as a minimum:

A. Contractor name and facility address (list all relevant or significant office locations) B. UIE number, Cage code, and NAICS code C. Socio-economic status (HUBZone, Service-Disabled-Veteran-Owned, Woman-Owned, 8(a), Small Business, Large Business)

D. Facility clearance level E. POC name, phone, and email F. Website URL

The number of pages in “Section 1” of the response shall be no longer than one (1) page in length.

“Section 2” of the submissions shall answer/address the below questions/requests as they relate to the consulting areas listed above.

Information requested:

Business Performance

1. Does your company have experience designing tools that enable cyber threat intelligence (CTI) sharing and collaboration, and/or building and managing CTI platform infrastructure and services that provide similar outcomes to those described in this RFI’s objectives?

2. Please describe your current licensing model for similar capabilities, including examples of itemized bundles of licenses or product subscriptions.

• Please identify available historical or commercially available pricing for bundled itemized product offerings, including deployment and implementation services, professional support services and infrastructure costs.

• How should CISA estimate data volume and cost for a long-term data warehouse that houses CTI data and makes it available on-demand for analysis? Are there any challenges that CISA should consider when estimating data volume and cost?

3. Identify any relevant certifications for your technology (e.g., FEDRAMP).

4. What are the ways a CTI solution can enable and promote CTI sharing within an ecosystem of users with varying levels of sophistication? What are some recommended approaches and why?

5. How would you propose to address CISA-specific operational and technical platform needs and requirements separate from non-CISA users?

6. Describe your company’s support service capabilities associated with development and management of the platform (including dedicated help desk, training staff and materials, capacity, limitations, etc.)

7. Identify any existing Government contract vehicle (GWAC, Federal Supply Schedules, BPA, etc.)

your company currently holds that could support the threat intelligence platform.

User Functionality

8. What are the best ways to provide or enable end-users to create static, dynamic, and interactive visualizations in a CTI platform?

9. What is the best approach to enable system-based and user-based tagging in a CTI platform, including: multi-tags, rule-based tagging, hierarchical tagging?

10. What is the best approach to support search and filtering management (e.g., create, read, update, delete, share) of data, metadata (including user tags and system tags), and actions performed (e.g., user actions or system actions)?

11. What standards and considerations should be incorporated into a CTI platform to ensure user accessibility, usability, and inclusion needs are addressed?

12. Within a CTI platform, what are the best ways to represent the general categories of threat intelligence: tactical, operational, and strategic?

13. What are the different ways that alerting and notification (e.g., in application, push) can be implemented within a CTI platform? Of those approaches, which have you implemented, or would you implement, and why, keeping in mind user experience, needs and limits (e.g., analyst fatigue)?

Architecture

14. How should a commercial provider design a CTI solution that ensures confidentiality, integrity, authenticity, and availability of FCEB data, FCEB users, and commercial data? What are the preferred approaches to data handling and access control (e.g., usage, access, further sharing) for systems that communicate data across different federal government domains (i.e., civilian, defense, and intelligence community), across different public sector domains (i.e., federal government and SLTT), and across public and private sector domains?

15. What architectural solutions exist (e.g., cloud, on-prem, hybrid) that will enable the CTI solution to grow and scale, without reducing performance?

16. What are the most popular CTI analyst workflows today? What are the different ways that analyst workflows can be implemented within a CTI solution? Of those implementation approaches, which have you implemented, or would you implement, and why?

17. What trends in research and development and/or the commercial space will impact how CTI is consumed, used, or shared over the next 2-5 years?

18. What are the different ways that a threat intelligence solution can handle generation (i.e., by FCEB departments and agencies) and ingestion (i.e., by CISA) of incident reporting? Of those implementation approaches, which have you implemented, or would you implement, and why?

Data Pipeline, Provenance, and Analytics

19. The CTI solution will need to accommodate a dynamically shifting set of integration and data needs (including unstructured and binary data) and must include the ability to translate between different data formats at different scales of data ingestion. Ingested data must be indexed and stored to enable querying of the data by analysts. What overall architecture would fit these needs? How much data could be kept over time?

20. Describe how the concepts of sourcing, chain of custody and/or traceability can be applied to data within a threat intelligence platform.

21. Describe the applications for Artificial Intelligence and/or Machine Learning (AI/ML) within a threat intelligence platform. Please explain the Technical Readiness Level of any capability described.

Integrations

22. What integrations can be supported by a threat intelligence solution, including but not limited to:

other host and network security tools (e.g., firewalls, endpoint tools), ticketing systems, data visualization tools, analytic and forensic tools (e.g., TIPs), communications (e.g., Slack, MS Teams), and cloud services (e.g., AWS, Azure)?

23. What solutions or approaches are best for providing API support to all human and machine functions of a system?

24. What methods for application-to-application data exchange (e.g., messaging protocols, APIs) should the solution leverage to ensure use of best technology and interoperability with other systems?

25. What CTI standards and formats (e.g., STIX, MISP) should be supported to ensure expressiveness of content with context and interoperability with other systems? What solutions can help orchestrate and automate CTI workflows?

26. What metrics exist about the use of and users of a threat intelligence solution, and how can those metrics be derived? Identify any recommended technical performance standards relevant to a threat intelligence solution.

27. What are the different ways that collaboration (both among analysts within an organization and among analysts from multiple organizations) can be implemented within a threat intelligence solution? Of those approaches, which have you implemented, or would you implement, and why?

28. What are the different ways that tipping and queuing (automated or manual) can be implemented using a CTI solution? Of those approaches, which have you implemented, or would you implement, and why?

Conclusion

29. What capabilities or characteristics should a CTI solution possess to have and maintain a competitive advantage over other CTI solutions, including threat intelligence platforms (TIPs) and other CTI services, over the next 2-5 years?

VII. CONTRACTOR NOTIFICATION AND SUBMITTAL INSTRUCTIONS

This RFI is for information and planning purposes only and does not constitute a Request for Quote; it is not to be construed as a commitment by the U.S. Government. No award will be made from this RFI. All information is to be submitted at no cost or obligation to the Government. Any information that the contractor considers proprietary should be clearly marked as such. All submissions become Government property and will not be returned, including any proprietary information. Contractors who do not respond to this RFI are not excluded from any resulting solicitation(s).

The Government may consider additional communications with submitting companies using the contact information provided in the “Corporate Overview” to further the Government’s market research for the email security services support.

• All responses are to use 11-point Times New Roman font and one-inch margins, single spaced in all sections in Microsoft Word.

• Contractor Information section (Section 1) shall be no longer than one (1) page in length.

• Response to questions (Section 2) should be no longer than nine (9) pages in length.

• All information submitted shall be UNCLASSIFIED.

• Any information that the contractor considers proprietary should be clearly marked as such.

• All submissions become Government property and will not be returned (including any proprietary information).

Questions pertaining to this RFI should be submitted no later than 2:00 pm EST on Nov 23, 2022, to Diana Zoppi at diana.zoppi@gsa.gov and Daniel Hu at daniel.hu@gsa.gov.

All questions and answers will be added to this RFI announcement no later than COB Dec 07, 2022.

RFI responses shall be submitted no later than 02:00 pm EST on Dec 16, 2022, via email to Diana Zoppi at diana.zoppi@gsa.gov and Daniel Hu at daniel.hu@gsa.gov mailto:diana.zoppi@gsa.gov mailto:daniel.hu@gsa.gov mailto:diana.zoppi@gsa.gov mailto:daniel.hu@gsa.gov

VII. CONTRACTOR NOTIFICATION and submittal instructions