Attachment H_NDR Solution Functionality_S-10700-00010923.xlsx
XLSX spreadsheet 49 KB Posted
- Attached to
- Network Detection and Response (NDR) Solution
- Solicitation number
- S-10700-00010923
- Issued by
- Marion County, Oregon
About this file
This document is related to a Network Detection and Response (NDR) solution being procured by the Department of Administrative Services Procurement Services (DAS PS) for the State of Oregon. DAS PS is seeking to procure a SaaS, IaaS or COTS NDR solution, including all required equipment, configurations, licenses, portals, training, integrations with current security systems, and maintenance and operations support. The state prefers a unified solution that can provide enhanced visibility, faster incident detection and response, reduced false positives, comprehensive forensic analysis, improved scalability, and streamlined compliance management. The solution should also offer features such as behavioral analysis, asset grouping and management, machine learning, and AI-enhanced threat hunting.
The solution must meet various functional, technical, and customer support requirements outlined in the document. Offerors must provide at least three customer references, have at least 5 years of experience in providing NDR solutions, and demonstrate their capabilities in developing network detection and response software. Pricing terms, set asides, and funding sources are not explicitly mentioned, but the state is seeking a comprehensive solution to address their enterprise security needs.
View the file
Other files
Show all 22
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
| RFQ CSS - 031721 |EXHIBIT NO. 3 - SOLUTION FUNCTIONALITY |
| Instructions |
| Explanation of Solution Functionality Worksheet Tabs | |
| Problem List | Brief descriptions of enterprise problems list and benefit statement |
| Instructions Tab | Instructions: Detailed instructions regarding how Offeror is to respond to the functionalities document |
| All Solution Functionalities Tab | This is the list of mandated and desirable functionalities |
| Worksheet Completion Instructions | |
| Enter Offeror name in cell C2 in the All Solution Functionalities tab | |
| Mandatatory and Desirable Functionalities Tabs Columns | |
| Column C | Detailed description of the functionality |
| Column D | Agency has already indiciated if functionality is mandatory or desired |
| Column E | Agency has already indicated the priority of functionality |
| Column F | Offeror's response per the Code Table (see Code Table below for coding options) - Complete Column E using the drop-down list. The codes in the drop-down list correspond to the codes desribed in the Code Table below |
| Column G | Offeror's comment on how functionality will be met |
| Column F Response options | |
| Currently exists out of the box | Functionality exists "out of the box" – no modification required |
| Requires Customization | Functionality is not available "out of the box", but Offeror states the functionality can be included through customization. |
| Requires third-party | Functionality cannot be met "out of the box" or through customization. Functionality not available from Offeror and requires a third-party. |
| Not available | Functionality cannot be met "out of the box", through customization, or from a third-party. Functionality is not available from Offeror. |
All System Functionalities
| RFP #S-10700-00010923 - |Attachment H - SOLUTION FUNCTIONALITY | ||||
| Offeror Name: | ||||
| Functionalities | NO INPUT IN COLUMNS L through P- AGENCY USE ONLY | |||
| Mandatory/ Desireable | Priority Rating |
High= 3 Medium = 2 Low = 1 Offeror Response (Please select from
| drop-down menu) | Offeror comments on how functionality will be met | Auto Calculated Response Selection Points | Maximum Points | |||||||
| (Response "Currently Exists" x Priority Rating) | Auto Calculated Points | |||||||||
| (Response x Priority Rating) | Response Options | Response Points | ||||||||
| Functionalities key: | Deep Packet Inspection (DPI): The solution is capable of analyzing network traffic at the packet level to detect and understand the details of communication. | M | 3 | [Enter Comments] | 9 | 3 - Currently Exists | 3 | |||
| M = Mandatory | The solution can analyze raw network packet traffic or traffic flows (for example, IP flow information export [IPFIX] or NetFlow records) in real time or near real time. | M | 3 | [Enter Comments] | 9 | 2 - In development and available in the next 12 months. | 2 | |||
| D = Desireable | Data/Network Source Requirements: A Mirror or SPAN should be sufficient to provide flow/packet/frame requirements. A mirror should be sufficient - not also including additional forwarding. The state does not want forwarding. | M | 3 | [Enter Comments] | 9 | 1 - On future roadmap but not in current development. | 1 | |||
| The solution is capable of monitoring and analyzing north/south traffic (as it crosses the perimeter), as well as east/west traffic (as it moves laterally throughout the network). | M | 3 | [Enter Comments] | 9 | 0 - Not Available | 0 | ||||
| The solution is capable of providing behavioral analysis: Implement behavioral analytics to identify deviations from normal network behavior, helping to detect anomalies and potential security threats. Explain role of behavioral analysis in identifying anomalies or potential security threats. How is behavior analysis used in your solution? | M | 3 | [Enter Comments] | 9 | 3 - Yes. It's included in the cost | 3 | ||||
| The solution is capable of asset grouping and management | D | 2 | [Enter Comments] | 6 | 2 - Yes, but it costs extra | 2 | ||||
| The solution supports signature-based detection: Utilizing signature-based detection mechanisms to identify known threats and patterns of malicious activity. | D | 2 | [Enter Comments] | 6 | 0 - Not Available | 0 | ||||
| The solution is capable of machine learning: Incorporates machine learning algorithms to continuously improve threat detection capabilities, adapt to new attack methods, reduce false positives, and to baseline normal activity and detect abnormal behaviors. | D | 3 | [Enter Comments] | 9 | 3 - Yes | 3 | ||||
| The solution is capable of using artificial intelligence (AI) to enhance threat hunting and threat identification: Incorporates artificial intelligence to continuously improve threat detection capabilities, adapt to new attack methods, and reduce false positives. How is AI used in your solution? Does it support natural language queries? Is the AI feature included in the pricing or a separate charge? How does the Solution integrate with the Offeror's AI infrastructure (natively, connectors, customizeable API)? (NOTE SEE ROW 41 in the Compliance with State of Oregon Requirement section) | D | 3 | [Enter Comments] | 9 | 0 - No | 0 | ||||
| The solution is capable of modeling normal network traffic and highlight suspicious traffic that falls outside the normal range for north/south and east/west traffic patterns. What is the typical baseline period? What is the baseline process? Is it automatic or guided? What support will be provided by the Offeror for baselining? Is baselining support included in pricing or additional? | M | 3 | [Enter Comments] | 9 | ||||||
| Protocol Analysis: Support for the analysis of various network protocols to detect anomalies and malicious behavior across different communication channels. | M | 3 | [Enter Comments] | 9 | ||||||
| Results from (both network environments and incident detection) are comprehensible and comprehendible. Describe how the Solution provides results in easily understandable and comprehensive formats. | M | 2 | [Enter Comments] | 6 | ||||||
| Real-time Monitoring: Provide real-time monitoring and alerting capabilities to quickly respond to and mitigate security incidents as they occur. Provide use cases how this is achieved through the Solution - e.g. Detecting threats, Assisting with triage/analysis, and/or threat containment and interruption. | M | 3 | [Enter Comments] | 9 | ||||||
| Ability for alert aggregation into logical security incidents based on multiple factors - not only alert ID and repeated alerts. How is this achieved by the Solution? | M | 2 | [Enter Comments] | 6 | ||||||
| Scalability: The Solution should be scalable to handle the increasing volume of network traffic in the state's large and growing networks, without compromising performance. | M | 3 | [Enter Comments] | 9 | ||||||
| Integration with SOAR: Works with SOAR to automate incident data and tracking. Provide a list of SOAR products. Does the Solution support a one-way or two-way connection? Are there native connectors or is API-development required? | D | 3 | [Enter Comments] | 9 | ||||||
| Able to separate traffic for integration with 8 separate SIEMs (Security Information and Event Management): Seamless integration with 8 instances of Microsoft Sentinel, to provide a comprehensive view of security events across the organization. | D | 3 | [Enter Comments] | 9 | ||||||
| Guided Threat Hunting: Enables SOC Analysts to take provided intelligence and move forward to hunt for threats based on what the NDR provides within a templated/guided framework. Describe how the Solution provides guided threat hunting. | D | 3 | [Enter Comments] | 9 | ||||||
| Forensic Capabilities: Enable the capture and analysis of historical network data for incident response and forensic investigations. What is required for the Solution to capture and analyze historical network data? How much data can be captured? Is it based upon events? How long can it be retained? | D | 3 | [Enter Comments] | 9 | ||||||
| SSL/TLS Decryption: Support for decrypting and inspecting encrypted traffic to identify threats hidden within encrypted communication channels. | M | 2 | [Enter Comments] | 6 | ||||||
| User and Entity Behavior Analytics (UEBA): Incorporate UEBA to analyze the behavior of users and entities within the network, identifying potential insider threats or compromised accounts. | D | 3 | [Enter Comments] | 9 | ||||||
| Customizable Policies and Rules: Allow administrators to define and customize security policies and rules based on the specific needs and risk profile of the organization. | M | 3 | [Enter Comments] | 9 | ||||||
| Automated responses, such as host containment (through integration) or traffic blocking | D | 3 | [Enter Comments] | 9 | ||||||
| Threat Intelligence Integration: Integrate with threat intelligence feeds to enhance the detection capabilities by leveraging up-to-date information on known threats. | D | 2 | [Enter Comments] | 6 | ||||||
| The solution has the capability to be tuned to minimize false positives - to ensure that security teams can focus on genuine threats without being overwhelmed by irrelevant alerts. How does the Solution help minimize false positives? e.g. Filter, Prioritize or identify matches, to improve triage and analysis. | M | 3 | [Enter Comments] | 9 | ||||||
| Ease of Deployment and Management: The NDR Solution is easy to deploy, configure, and manage to streamline the operational processes for security teams. | M | 2 | [Enter Comments] | 6 | ||||||
| Continuous Monitoring: Provide continuous monitoring and analysis of network traffic, ensuring that security teams have real-time visibility into the network activities. | M | 2 | [Enter Comments] | 6 | ||||||
| IaaS Cloud Visibility: the solution can provide visibility into multiple cloud environments. | M | 2 | [Enter Comments] | 6 | ||||||
| Solution deployment is compatible with the state's on-premises and cloud networks | M | 3 | [Enter Comments] | 9 | ||||||
| In addition to layer 3 & 4 detection and monitoring, solution also monitors layer 7 traffic. | M | 3 | [Enter Comments] | 9 | ||||||
| Deception Technology: Solution has the ability to proactively and reactively deploy realistic and dynamic decoys to mislead, detect, and defeat sophisticated cyber attacks. | D | 1 | [Enter Comments] | 3 | ||||||
| Reporting | ||||||||||
| Compliance Support: Support regulatory compliance requirements by providing features and reports that aid in meeting industry-specific security standards. | M | 2 | [Enter Comments] | 6 | ||||||
| Reporting and Visualization: Provide comprehensive reporting and visualization tools to help security teams understand the network security posture and communicate findings to stakeholders. | M | 2 | [Enter Comments] | 6 | ||||||
| Compliance with State of Oregon Requirements | ||||||||||
| Does the State of Oregon data that is processed, stored, or transmitted by the solution provider's cloud features, remain within the continental US? | M | 3 | [Enter Comments] | 9 | ||||||
| If question #13 describes the Solution connecting to Offeror's cloud for AI support and if the Offeror is providing cloud features that store, process, or transmits State of Oregon data - does the NDR Solution meet FedRamp, StateRamp, or the Oregon Statewide IT Security Standards? | M | 3 | [Enter Comments] | 9 | ||||||
| Customer Support | ||||||||||
| Customer Support - The Offeror "Help Desk" must have a technician response within 8 hours. | M | 2 | [Enter Comments] | 6 | ||||||
| The Offeror must provide support in the continental United States in English. Because support may involve remote interaction or viewing of the system and its data (which may included regulated data, e.g. CJI), continental US support is required. | D | 2 | [Enter Comments] | 6 | ||||||
| The Offeror must respond via email or phone to incident or interruption service request within 4 hours. | M | 3 | [Enter Comments] | 9 | ||||||
| The Offeror must have a US-based customer success team and must allocate at least one customer success manager to support the State of Oregon in planning, execution, and support of its network detection and response program. | M | 3 | [Enter Comments] | 9 | ||||||
| The Offeror must provide training on the solution. Is the training free or is a purchase required? How many people can be trained? What levels of training are provided (intro, admin, advanced)? Is a certifiction included? How often can training be taken? (e.g. only once or annual for X people? | M | 3 | [Enter Comments] | 9 | ||||||
| Offeror must provide integration support services. Are integration services included with the purchase? Or is it an additional cost? | M | 2 | [Enter Comments] | 6 | ||||||
| References and Experience | ||||||||||
| The Offeror must provide at least three customer references. Customer references from the State or Federal space is preferred. See paragraph 3.2.5 of the RFP. | M | 3 | [Enter Comments] | 9 | ||||||
| The NDR Solution provider must have at least 5 years’ experience in providing netword detection and response solutions. | M | 3 | [Enter Comments] | 9 | ||||||
| The NDR Solution provider should be in the business of developing network detection and response software and solutions. | D | 3 | [Enter Comments] | 9 | ||||||
| 348 | 0 |
Problem List
| Enterprise Problem | Benefit Statement |
| A hybrid-network NDR (on-premises/cloud) solution will enable the enterprise to expand deeper into existing on-premises networks as well as new cloud environments, adding new detection techniques that will help the enterprise expand capabilities by adding other types of detection, such as security posture anomalies for cloud infrastructure. | |
| NDR will contribute to the State's XDR by bringing network event analytics into the mix. NDR technology can contribute to XDR by detecting network-based anomalies and by adding and correlating these events in the centralized dashboard | |
| Limited Visibility: Without integration, there is a risk of limited visibility into network-level threats, making it difficult to detect and respond to incidents effectively. | Enhanced Visibility: Integration provides a unified view of both network-level and broader security events, offering security teams enhanced visibility into the organization's overall security posture. |
| Delayed Incident Response: Without real-time correlation between network events and broader security events, incident response may be delayed, allowing threats to persist and potentially cause more damage. | Faster Incident Detection and Response: The combined capabilities enable faster detection of security incidents, allowing security teams to respond promptly and mitigate threats before they escalate. |
| Inefficient Investigation: Security analysts may need to manually correlate network data with other security events, leading to a time-consuming and inefficient investigation process. | Real-time Correlation: SIEM systems can correlate network-level events with other security events in real-time, enabling quicker and more accurate identification of potential security incidents. |
| Difficulty in Threat Hunting: The lack of a unified view hampers proactive threat hunting efforts, making it challenging for security teams to identify hidden or advanced threats within the network. | Proactive Threat Hunting: The integrated solution facilitates proactive threat hunting by providing security teams with a unified platform for exploring and analyzing security data, making it easier to identify hidden or emerging threats. |
| Increased False Positives: Without the context provided by network data, SIEM systems may generate more false positives, leading to alert fatigue and potentially diverting attention from genuine security incidents. | Reduced False Positives: The integration allows for more context-rich analysis, reducing the likelihood of false positives and minimizing alert fatigue for security analysts. |
| Incomplete Forensic Analysis: Forensic analysis becomes incomplete when network data is not seamlessly integrated with other security event data, limiting the ability to reconstruct the timeline of an incident. | Comprehensive Forensic Analysis: Security incidents can be reconstructed more comprehensively with the integration of network data, aiding in forensic analysis and helping organizations understand the full scope of an incident. |
| Failure to Capture Network Context: SIEM systems may lack the ability to capture detailed network context, such as traffic patterns, communication flows, and anomalies, which are critical for understanding the nature of security incidents. | Efficient Investigation: Security analysts can conduct more efficient and effective investigations by correlating network data with other security events, helping to determine the root cause of incidents and the extent of the impact. |
| Reduced Scalability: The lack of integration may result in scalability issues, especially in large and complex networks, where managing and correlating diverse security data sources manually becomes impractical. | Improved Scalability: The integrated solution can scale more effectively to handle the increasing volume and complexity of security data in large and growing networks. |
| Ineffective Threat Intelligence Integration: SIEM systems may struggle to integrate network-level threat intelligence effectively, hindering the ability to stay updated on the latest threats and vulnerabilities. | Effective Threat Intelligence Integration: SIEM systems can leverage network-level threat intelligence seamlessly, ensuring that security teams stay informed about the latest threats and vulnerabilities. |
| Compromised Compliance: Compliance requirements often necessitate comprehensive monitoring and reporting of network activities. Without NDR integration, achieving and demonstrating compliance becomes more challenging. | Streamlined Compliance Management: Integration supports compliance requirements by providing a more complete and centralized view of security events and activities across the network. |
| Incomplete User and Entity Behavior Analysis: The absence of network data in user and entity behavior analytics (UEBA) limits the ability to detect abnormal behavior patterns that may indicate insider threats or compromised accounts. | Enriched User and Entity Behavior Analysis (UEBA): Integration enables a more comprehensive analysis of user and entity behavior by incorporating network context, improving the detection of insider threats and compromised accounts. |
| Limited Incident Context: Lack of integration may result in incomplete incident context, making it difficult to understand the scope and impact of security incidents on the organization. | Context-rich Incident Context: Security incidents are better understood with the inclusion of network context, allowing security teams to assess the scope and impact of incidents more accurately. |
| Difficulty in Prioritizing Alerts: Security analysts may find it challenging to prioritize alerts without comprehensive network context, potentially leading to delays in addressing critical threats. | Prioritized Alerting: With a holistic view of security events, security analysts can prioritize alerts more effectively, focusing on the most critical threats first. |
| Increased Dwell Time: The time it takes to detect and respond to threats (dwell time) may increase due to the absence of real-time network insights, allowing attackers more time to move laterally within the network. | Reduced Dwell Time: Integration helps minimize dwell time by providing timely insights into network activities, allowing organizations to detect and respond to threats more quickly. |
File details come from the government source that posted it. Updated .