EXCHANGE_SIEM_RFI.pdf

ARMY & AIR FORCE EXCHANGE SERVICE

P.O.BOX 660202

Dallas, Texas 75266-0202 214-312-2011

IT-Z

09 August 2013

Dear Sir or Madam:

This letter is a Request for Information (RFI) only. The Army and Air Force Exchange

Service (Exchange) is seeking information from industry for a new Security Information and

Event Management (SIEM) Solution to improve efficiencies by implementing advance technical features for faster security information management and security event manager.

The Exchange needs SIEM Technology for real-time correlation and anomaly detection across a scalable repository of security information with faster deployment and better visibility of large amounts of data across a multiple-platform environment. The Exchange requires this technology to handle high volumes of events per second while identifying, correlating and remediating threats quickly across a global network. The solution should meet all requirements for compliance monitoring and policy enforcement related to Payment

Card Industry (PCI) data security and DoD Information Assurance Certification and

Accreditation Process (DIACAP) standards.

The Exchange is a joint military activity providing quality merchandise and services to active duty military personnel, guard and reserve members, retired military, and their families at competitively low prices. The Exchange is a retail organization with annual sales of $10.3 billion dollars, including $1.6 billion in “concessionaire” sales. Traditionally in the commercial real estate industry the term “concessionaire” refers to “mall tenant”. Our services include retail, food, eCommerce, catalogs, and health care services worldwide.

The Exchange is responsible for more than 3,700 facilities worldwide in more than 30 countries, 50 states and five U.S territories. The Exchange operates 157 main stores, 182

Military Clothing facilities, over 1,000 specialty stores (gas stations, bookstores, etc.) and more than 120 theaters. Plus the Exchange has more than 2,100 fast food restaurants, such as Taco Bell, Burger King and Subway. Concession operations overseen by the

Exchange add nearly 6,000 more activities.

The intent of this RFI is to gather information about potential vendors and each company’s ability to meet the desired requirements outlined below and in Attachment 1. The Exchange may use the information gathered to further evaluate and/or refine our requirement for a future multiple source solicitation.

What do we want you to submit? The following may be used to further evaluate and/or refine our requirement. If you are interested in this potential upcoming procurement, you must provide:

1. A general overview of your company’s products, services and capabilities.

2. A brief overview on your company’s history, size, market share, growth, core competencies, and major corporate milestones.

3. Please provide a brief summary of your company including:

a. How long you have been in business and providing this technology/product/services.

SOLICITATION # EXCH-ITZ-08-013-13-005

b. A white paper describing your technology/product/services.

c. List of major customers using this technology/product/service and how long they have been using it.

d. Typical implementation plan and timeline.

4. Responses to the desired requirements (Attachment 1) and how you meet these.

a. Please address each topic listed in the attachment; explaining how your available products and/or services can provide a solution that will meet our requirements.

To assist us in our response analysis, comparisons, and further clarification, please use the same numbering scheme in your responses.

b. You may provide additional questions, comments, suggestions or recommendations concerning this request to assist our further consideration and planning.

5. If the Exchange should issue a Request For Proposal on this effort, would your company be interested in receiving it? If so, please provide contact information for your company.

Please feel free to add any additional information that the Exchange needs to consider for a solution. Your responses may be used to further evaluate and/or refine our requirements.

Again, this is a Request for Information only. The Exchange is not seeking a firm price quote. However, the Exchange does want to understand how the industry prices these solutions. Please provide your standard list pricing information with your response. DO

NOT INCLUDE A PRICE QUOTE. In the event the Exchange solicits, price quotes will be requested at that time.

All questions regarding this RFI are due to the Contracting Officer listed below by 2:00 PM

Friday, 16August2013 via email to pottkotterk@aafes.com. All questions and answers will be available to all sources and posted on our portal by 2:00 PM on Friday, 23August2013.

Responses to this RFI are required by 2:00 PM on Tuesday, 03SEP2013 via email to pottkotterk@aafes.com. The solicitation will be issued only to those companies that respond to this request.

ENCL: Attachment 1

Sincerely, //signed//

Kathleen J. Pottkotter

Contracting Officer

SOLICITATION # EXCH-ITZ-08-013-13-005

mailto:pottkotterk@aafes.com mailto:pottkotterk@aafes.com

SECURITY INFORMATION AND EVENT MANAGEMENT SOLUTION REQUIREMENTS

1. The SIEM will provide real-time security monitoring capabilities such as dynamic event base lining for anomaly detection, rules-based and risk-based event correlation, behavioral analysis and network flow analysis for all security devices, network switches and routers, and all Windows servers and Unix servers.

2. All SIEM system management and security tools are accessible through a single Graphical User Interface.

3. The SIEM solution must support a minimum of 6000 Events per Second (EPS) with spikes in EPS of 25000 or more.

4. The SIEM must have an integrated relational database in each SIEM system component.

5. The solution meets the requirement of having a hardened appliance system with Common Criteria EAL3 and FIPS 140-2 Level 2 certifications and provides the requisite security event correlation from all existing vendor IT systems within an integrated and embedded relational database.

6. The SIEM must NOT require the use of collection agents, end-points or 3rd party software.

7. The SIEM must provide optional agents for log collection from Microsoft and UNIX servers, but at no additional cost.

8. The SIEM inter-device communications must be encrypted using AES-256.

9. The SIEM must be capable of forensic analysis and able to store one (1) year of events for immediate access.

10.The SIEM must be able to leverage NAS and SAN storage systems for data archival and long-term compliance log retention.

11.The SIEM must provide notifications via email, SNMP and SMS. Notifications must be based upon multiple conditions including alert rate (number of events within a specific amount of time) and configurable deviation from baseline

12.The SIEM must provide and maintain dynamic baselines for all IP addresses, users, hosts, domains, ports and protocols.

13.The SIEM must be IPv6 compliant and network addressable.

14.The SIEM must provide the ability to create custom parsing rules using standard regular expressions.

ATTACHMENT 1

15.The SIEM must include a graphical Report editor tool.

16.The SIEM must include standard FISMA reporting templates.

17.The SIEM must include network discovery and network topology capabilities.

18.The SIEM must provide geolocation services and IP address database for both log/event and network flow data.

19.The SIEM must be capable of receiving netflow, sflow, jflow and IPFIX data.

20.The SIEM must be capable of detecting network-wide anomalies and provide user profiling across disparate devices.

21.The SIEM must be capable of monitoring network device configurations and provide auditing and alerting of configuration changes.

22.The SIEM must be able to communicate with (e.g.; disable ports or change VLAN assignments) network devices (e.g.; LAN Switches) directly from the management console using SNMP.

23.The SIEM must provide an embedded relational data management system which is both self-maintaining and self-pruning.

24.The SIEM database must process over 25 concurrent database table indices.

25.The SIEM must be appliance based and not require professional services or code development for any required customization.

26.The SIEM must be capable of interfacing with vulnerability assessment scanning tools.

27.The SIEM must include a rules-based correlation engine and graphical correlation rules editor.

28.The SIEM must provide a web-based user interface accessible through standard web browser applications to include Microsoft Internet Explorer, Firefox Mozilla, Apple Safari and Google Chrome.

29.The SIEM must be able to integrate with Microsoft Active Directory (AD) authentication and map user groups to user permissions.

30.The SIEM must be able to receive audit logs from database applications

(e.g.; Oracle).

31.The SIEM must be Common Criteria EAL3 certified.

32.The SIEM must be FIPS 140-2 Level 2 validated.

33.The SIEM must be able to support a high-availability (redundant) architecture for the central management system.

34.The SIEM must support a distributed architecture, to include but not be limited to hierarchical management systems.

35.The SIEM must provide IP address zone capability to support possible overlapping IP addresses.

36.The SIEM must provide a user-friendly and intuitive graphical user interface

(GUI).

37.The SIEM must have role-based access to allow different privilege levels access to different data sets.

38.The SIEM must be able to manage all security system configuration and policy updates from a single console.

39.The SIEM must provide an integrated case tracking system.

40.The SIEM maintenance must provide for all system hardware and software support to include software patches, updates and new releases.

41.The SIEM must provide an optional VM-ware based log collection capability.

42.The SIEM must provide an optionally integrated sensor appliance that is both configurable and manageable from the central system SIEM console.

43.The SIEM must provide an optional integrated Database Access Monitoring capability that is configurable and manageable from the central system console.

44.The SIEM must provide an optional integrated Content Inspection capability that can monitor (actively decode) both Local Area Network application and protocol traffic and apply content triggers to rules-based correlation alerting.

45.The SIEM appliance hardware appliances must be manufactured in the USA.

46.The SIEM vendor must provide a Network Threat Analysis Center (NTAC) capability with dedicated engineers for security threat research and signature development. The NTAC must be located in the USA.

47.The solution must be able to integrate with McAfee E-Policy Orchestrator (ePO) including Policy Auditor and Risk Advisor (MRA) to create risk scores.

48.The solution must be able to receive logs directly from the HBSS agent without access to the EPO server.

49.The solution must be able to dynamically create a topology and allow for drilldown to the port level for each switch and router.

50.The solution must be able to interact with switches and routers to allow for disabling ports or moving them into a quarantine VLAN.

51.The solution must support anomaly baselines for every field available for log parsing.

52.The solution must have integrated and seamless log management that includes access to the unmodified, original logs from the parsed data.

53.The solution must include score-based correlation on a per object basis.

54.The solution must provide access to an existing IP address reputation database and allow for all IP addresses from all events to be cross referenced against the database.

55.The solution must include a historical correlation function that does not impact the operational status of the solution or reloading of the log data.

56.The solution must support the Unified Compliance Framework (UCF) for standard compliance reporting.

57.The solution must be able to import asset information in from vulnerability scanners, Nessus, Retina and MVM.

58.The solution must support CAC authentication.