Anti-Phishing SOW _7-29-11

U.S. Nuclear Regulatory Commission

Statement of Work for Anti-Phishing Requirement

CSO-11-134

1. BACKGROUND

The U.S. Nuclear Regulatory Commission’s (NRC) Computer Security Office (CSO) proposes to purchase a training mechanism or service for one year with four (4) one year options to address the threat of social engineering, and phishing in particular. Social engineering has been identified by the Office of Management and Budget (OMB), Department of Homeland Security (DHS), and the US Computer Emergency Response Team (US-CERT), as a growing threat against the security of government sensitive information and information systems. In a social engineering attack, an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems. Phishing is a form of social engineering and uses email or malicious websites to solicit personal information by posing as a trustworthy organization. NRC system users have shown the need for additional awareness training and reinforcement of such training to better safeguard NRC information and information systems. The effect of this requirement is to provide specific awareness training in the recognition of phishing expeditions to better safeguard NRC information and information technology (IT) systems.

OMB M-06-16 and OMB M-07-16 require the NRC to safeguard data including Personally Identifiable Information (PII) and agency-sensitive information. The CSO is responsible for computer security training and for reducing risks and eliminating concerns about data loss, theft, inappropriate access, and use of information. The NRC handles sensitive and PII data as part of its daily operations. Educating employees on how social engineering and phishing works is a key requirement for the successful implementation of anti-phishing training at the NRC to maintain mission effectiveness and meet emerging security requirements. To meet these challenges, the agency is seeking a well-educated workforce capable of recognizing varying styles of social engineering to enhance the NRC security posture and resistance to data loss, threats, and common risks.

2. REQUIREMENTS

In today's Internet-dependent government environment, organizations must link their systems across enterprise-wide and virtual private networks as well as connect mobile users. Each connection increases exposure to the public, foreign espionage and hackers, magnifying vulnerability to attack. NRC personnel must be educated about phishing tactics and how to recognize them so as to not engage the attack.

The NRC’s current need is for an interactive means of engaging the employee to put into practice what is learned in annual computer security awareness training with regards to social engineering and phishing. The methodology that sends an emulated phishing email and then provides immediate feedback to anyone that falls victim to the exercises would better train and reinforce currently provided security awareness.

The contractor shall provide training that:

a. Supplies built-in templates and WYSIWYG functionality to emulate real phishing attacks

b. Presents immediate and memorable information displayed to employees that are most susceptible to phishing attacks

i. provide immediate feedback to anyone who falls victim

c. Provides the ability to provide a daily “test” question/attack on an enterprise level

i. This daily test question/emulated attack would be presented when the employee logs in for the first time each day

d. Measure user awareness

i. Allows for the ability to select metrics level to show results at various levels (office, division, region) and various ways (falling victim, proper action) The Course shall provides a software-as-a-service (SaaS) solution enterprise solution for approximately 5000 users designed to help prevent damage, theft and loss caused by targeted (spear) phishing attacks. This solution shall provide effective and secure user awareness training to better protect an organization's critical assets as well as customers' identities. This solution shall provide the following functionality:

· Built-in templates and WYSIWYG functionality to emulate real phishing attacks against employees within minutes.

· Targeted training to create and send real spear phishing emails to your employees and contractors as a means to educate them about phishing threats.

· Targeted training focusing training efforts on the most susceptible employees by providing immediate feedback to anyone that falls victim to the exercises. The emphasis of the enterprise edition is a planned program that teaches employees, over the course of a year, about common spear phishing attacks

· Real metrics to show user awareness before an attack can compromise their information