SPECIFICATIONS.pdf

This is a combined synopsis/solicitation for commercial items prepared in accordance with format in FAR subpart 12.6, as supplemented with additional information included in this notice.

This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.

F9XH0S6155A001 is hereby issued as a Request for Quote (RFQ). Incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-89, 14 Jul 16 and the Defense Federal Acquisition Regulation Supplement (DFARS) change notice 20160802. It is the contractor’s responsibility to become familiar with applicable clauses and provisions.

Description of Requirement:

The 143 IOS at Camp Murray, WA has a requirement for various online cyber security training classes and certification testing.

**Course delivery / vendor accreditation requirements**

Vendor must deliver course through web based application that track student progress, provide lab exercises, quizzes, SME support and allow 24/7 access.

Online course delivery must include instructor speaking to corresponding presentation material.

Vendor must provide a forum to answer student questions by certified technical assistance.

Vendor must provide a hard-copy course material that includes slides and full descriptive paragraphs on slide content.

Content depth must be appropriate for six, eight-hour days of instruction.

Vendor has documented peer review process for course development and feedback.

Vendor must have pre-built training environment that is packaged with all necessary tools for course requirements.

Vendor has successfully delivered and refined course for at least 6 months demonstrated through advertisement of course on internet.

Vendor must provide at least 10 reviews from previous contracts and/or students that are publically accessible online.

Vendor must provide official certification and testing to demonstrate student comprehension and knowledge.

Proctored exam must be available in multiple locations within the United States throughout various dates and times based on student’s needs.

CLIN 0001 - QTY 1 Each. SEC501 - Advanced Security Essentials - Enterprise Defender.

SANS Institute. Testing and Certification required for each individual. This is a Brand Name or Equal requirement.

As a minimum course content must provide these learning topics:

• Introduction to network security infrastructure as the target for attacks

• Impact of compromised routers and switches

• Escalating privileges at Layers 2 and 3

• Weaknesses in Cisco router and switch architecture

• Integrating and understanding existing network devices to defend against attacks

• Implementing the Cisco Gold Standard to improve security

• CISecurity Levels 1 and 2 benchmarks for routers

• Switch configuration

• Implementing security on an existing network and rolling out new devices

• Advanced Layer 2 and 3 Controls

• Filtering with access control lists

• DHCP, ARP snooping, and port security

• Introduction to network admission control and 802.1x

• Architecture design and preparing filters

• Building intrusion detection capability into a network

• Understanding the components currently in place

• Detection techniques and measures

• Understanding various types of traffic occurring on a network

• Knowing how normal traffic works

• Differentiating between attacks and normal users on a network

• Advanced IP packet analysis

• Performing deep packet inspection and understanding usage of key fields

• Event correlation and analysis

• Analyzing an entire network instead of a single device

• Building advanced snort rules

• Intrusion detection tools

• Installing and using analysis software

• Wireshark

• Building custom filters

• Variety of penetration testing methods

• Frequency and use of vulnerability analysis, penetration testing, and security assessment

• Vulnerability analysis

• How to perform vulnerability analysis

• Key areas to identify and ways to fix potential problems

• Key tools and techniques

• Tools, techniques, and methods used in testing

• Basic penetration testing

• Methods and means of performing a penetration test

• Focus, requirements, and outputs of a successful test

• Prioritizing and remediation of issues

• Advanced penetration testing

• Understanding and mapping to an organization's infrastructure

• Application testing and system analysis

• Incident handling process and analysis

• Preparing for an incident

• Identifying and responding

• Containing a problem to preserve mission resilience

• Identifying and eradicating the problem

• Recovery system data, including restoring to normal operation

• Lessons learned and follow-up reporting

• Forensics and incident response

• Windows response skills

• Windows forensics tool chest

• Linux/Unix response and analysis

• Linux/Unix tools and system analysis

• Types of malware and corresponding behavior

• Dealing with malware

• Tying malware into intrusion analysis and incident response

• Windows malware

• Using Microsoft Windows basic built-in CLI tools

• Using Microsoft Windows advanced built-in CLI tools

• Using Microsoft Windows built-in GUI tools

• External tools and analysis

• Using external tools to fight BHO

• Fighting rootkits with basic and advanced tools

• Inspecting active processes

CLIN 0002 - QTY 4 Each. SEC503 Fundamentals of Traffic Analysis. SANS Institute.

Testing and Certification required for each individual. This is a Brand Name or Equal requirement.

As a minimum course content must provide these learning topics:

• Concepts of TCP/IP o TCP/IP communications model o Data encapsulation/de-encapsulation o Discussion of bits, bytes, binary, and hex

• Introduction to Wireshark o Navigating around Wireshark o Examination of Wireshark statistics o Stream reassembly o Finding content in packets

• Network Access/Link Layer: Layer 2 o Navigating around Wireshark o Examination of Wireshark statistics o Stream reassembly o Finding content in packets

• IP Layer: Layer 3 o IPv4 o Examination of fields in theory and practice o Checksums and their importance, especially for an IDS/IPS o Fragmentation: IP header fields involved in fragmentation, composition of the fragments, fragmentation attacks o IPv6 o Comparison with IPv4 o IPv6 addresses o Neighbor discovery protocol o Extension headers o IPv6 in transition

• Wireshark Display Filters o Examination of some of the many ways that Wireshark facilitates creating display filters o Composition of display filters

• Writing tcpdump Filters o Format of tcpdump filters o Use of bit masking

• TCP

o Examination of fields in theory and practice o Packet dissection o Checksums o Normal and abnormal TCP stimulus and response o Importance of TCP reassembly for IDS/IPS

• UDP

o Examination of fields in theory and practice o UDP stimulus and response

• ICMP

o Examination of fields in theory and practice o When ICMP messages should not be sent o Use in mapping and reconnaissance o Normal ICMP o Malicious ICMP

• Advanced Wireshark o Exporting web objects o Extracting SMTP attachment content o Sample Wireshark investigation of an incident o Tshark

• Detection Methods for Application Protocols o Pattern matching, protocol decode, and anomaly detection o Detection challenges

• Microsoft Protocols o SMB/CIFS o MSRPC o Detection challenges

• HTTP

o Protocol format o Sample of attacks o Detection challenges

• SMTP

o Protocol format o Sample of attacks o Detection challenges

• DNS

o Its vital role in the Internet o The resolution process o Caching o DNSSEC o Malicious DNS, including Cache poisoning

• IDS/IPS Evasion Theory o Theory and implications of evasions at different protocol layers o Sampling of evasions o Necessity for target-based detection

• Real-World Traffic Analysis o Client attacks o DDoS attacks o Four-way handshake o TCP reset attack o Malformed DNS DoS

• Operational Lifecycle of Open-Source IDS o Planning, installation, configuration, running, customization, auditing, refinement, and updating o Function of an IDS o The analyst's role in detection o Flow process for Snort and Bro o Similarities and differences between Snort and Bro

• Snort o Introduction to Snort o Planning, including deployment scenarios o Running

Modes of operation: sniffer, packet logger, NIDS Plug-ins o Customization Writing Snort rules o Refining o Solutions for dealing with false negatives and positives o Writing a rule for a vulnerability o Tips for writing efficient rules

• Bro o Introduction to Bro o Planning o Operational modes o Standalone on a single host o Cluster on multiple hosts/cores o Running

BroControl to manage Bro Running in standalone mode Running in cluster mode o Customization Understanding and deploying Bro's policy neutral features Bro scripting Signatures

• Comparing Snort and Bro to Analyze Same Traffic o Examination of output from each - Snort alerts and Bro logs o Tips for performing Bro log correlation o Customizing Bro to add a new signature and raise a notice about malicious traffic

• Analyst Toolkit o Ngrep, tcpflow, p0f, Chaosreader, tcpreplay

• SiLK o Introduction of concept of network flow o Understand the uses for flow

• Packet Crafting o Using Scapy to craft, read/write from to pcaps, alter, and send packets

• Command and Control (C2) o Discussion of two common C2 methods, Tor and dnscat2

Introduce theory behind the methods Examine traffic generated by them Learn detection strategies

• Network Forensics o Learn what it is o Become aware of indicators of network issues o Learn to investigate incidents using some sample traffic of:

o Exploited host o Phishing attack

• Network Architecture for Monitoring o Become familiar with hardware used with and for monitoring

• Correlation of Indicators o Examination of log files o OSSEC o Understand different methods of correlation

CLIN 0003 - QTY 1 Each. SEC505 Securing Windows with PowerShell and the Critical Security Controls. SANS Institute. Testing and Certification required for each individual.

This is a Brand Name or Equal requirement.

• Overview and Security o What is PowerShell?

o Why should we learn it?

o PowerShell security and execution policy o Digitally signing scripts o Profile scripts

• Getting Around Inside PowerShell o Built-in help system o Built-in graphical editor o Aliases for CMD and bash users o Running cmdlets, functions, and scripts o Piping objects instead of text o Using properties and methods of objects

• Example Commands o Capturing the output of Windows tools o Parsing text files o PowerShell remoting o Searching event logs o Parsing nmap XML output

• Write Your Own Scripts o Writing your own functions o Function parameters and returning output o Flow control: if-then, do-while, foreach, switch o Accessing COM objects like in VBScript o The .NET Framework class library o How to pipe data in/out of scripts o Overall script design

• PowerShell and Windows Management Instrumentation (WMI) o What is WMI and why is it so powerful?

o WMI queries and remote command execution o Searching remote event logs faster o Inventory installed software o Sample scripts to walk through together

• Going Beyond Just Anti-Virus Scanning o How your AV scanners can fail you o Application whitelisting o AppLocker o Script and executable signing o Controlling USB devices o Benevolent Microsoft rootkit: EMET o Virtual Desktop Infrastructure (VDI)

• OS Hardening with Security Templates o INF versus XML security templates o How to edit and apply templates o Security configuration and analysis o SECEDIT.EXE o Security Configuration Wizard (SCW) o Auditing with templates

• Hardening with Group Policy o Microsoft Security Compliance Manager o Group Policy Objects (GPOs) o Third-party GPO enhancements o Pushing out PowerShell scripts o GPO remote command execution o GPO troubleshooting tools

• Compromise of Administrative Powers o Why hackers and malware love administrative users o Partially limiting pass-the-hash and token abuse o How to get users out of the administrators group o Limiting the power of administrative users o Limiting privileges, logon rights, and permissions o User Account Control (making it less annoying) o Authentication policies o Using PowerShell to manage admin password updates o Picture password and PIN logons o Windows Hello biometric logons o Password managers for administrators o Credential Guard for hash protection

• PowerShell for Active Directory o PowerShell scripting of Active Directory o Managing users, computers, and groups o Searching Active Directory with PowerShell o Active Directory Administrative Center

• Active Directory Permissions and Delegation o Active Directory permissions o Active Directory auditing o Delegating authority at the OU level o Why domains are not security boundaries o Logging attribute content changes

• Why Have Public Key Infrastructure?

o Strong authentication and encryption o Passwords are dead and obsolete o Smart cards, IPSec, wireless, SSL/TLS, S/MIME, etc.

o Mobile and BYOD computers o Code and document signing

• How to Install the Windows PKI o Root versus subordinate certification authorities o Should you be your own root CA?

o Custom certificate templates o Controlling certificate enrollment

• How to Manage Your PKI o PowerShell access to certificates o PowerShell script to audit trusted root CAs o Group Policy deployment of certificates o Group Policy PKI settings o How to revoke certificates o Automatic private key backup o Credential roaming of keys o Delegation of authority o Disable SSL and only use TLS o Optimizing TLS cipher suites

• Deploying Smart Cards o Everything you need is built in o TPM virtual smart cards o Smart card enrollment station o Group policy deployment o Smart cards on a limited budget

• Creating IPSec Policies o IPSec is not just for VPNs!

o Require versus prefer IPSec o Share permissions on TCP ports o IDS/IPS compatibility options o IPSec-based encrypted VLANs o Group Policy management o PowerShell and NETSH.EXE

• Windows Firewall o Group Policy management o PowerShell management o Metro app and service awareness o Roaming and VPN compatibility o Deep IPSec integration

• Dangerous Server Protocols o RDP man-in-the-middle attacks o SMBv3 native encryption o SMB downgrade attacks o NTLM, NTLMv2, and Kerberos o Kerberos armoring o Hardening the protocol stack o What about IPv6?

• Server Hardening o Server Manager and PowerShell o Server Nano/Core/Minimal/Full o Security templates and Group Policy o Preparing for incidents: doing pre-forensics o Service account security

• Dynamic Access Control (DAC) o Claims-based access control and auditing o DAC does not require Windows 8/10 o DAC conditional expressions o DAC and complying with regulations o Automatic file classification infrastructure o User and device identity restrictions o Auditing without managing SACLs o Central access policy deployment o PowerShell scripts to manage DAC

• Hardening DNS o DNSSEC o IPSec for DNS o Secure dynamic updates o Sinkholing unwanted DNS names with PowerShell o The hosts file on mobile devices o PowerShell scripting of the hosts file

CLIN 0004 - QTY 2 Each. SEC506 Hardening Linux/Unix Systems. SANS Institute.

Testing and Certification required for each individual. This is a Brand Name or Equal requirement.

As a minimum course content must provide these learning topics:

Memory Attacks and Overflows

• Stack and Heap Overflows

• Format String Attacks

• Stack Protection

Vulnerability Minimization

• Minimization vs. Patching

• OS Minimization

• Patching Strategies

Boot-Time Configuration

• Reducing Services

• systemd vs init

• Email Configuration

• Legacy Services

Encrypted Access

• Session Hijacking Exploits

• The Argument For Encryption

• SSH Configuration

Host-Based Firewalls

• IP Tables and Other Alternatives

• Simple Single-Host Firewalls

• Managing and Automating Rule Updates Rootkits and Malicious Software

• Backdoors and Rootkits

• Kernel Rootkits

• chkrootkit and rkhunter

File Integrity Assessment

• Overview of AIDE

• Basic Configuration

• Typical Usage

Physical Attacks and Defenses

• Known Attacks

• Single User Mode Security

• Boot Loader Passwords

User Access Controls

• Password Threats and Defenses

• User Access Controls

• Environment Settings

Root Access Control With Sudo

• Features and Common Uses

• Configuration

• Known Issues and Work-Arounds

Warning Banners

• Why?

• Suggested Content

• Implementation Issues

Kernel Tuning For Security

• Network Tuning

• System Resource Limits

• Restricting Core Files

Automating Tasks With SSH

• Why and How

• Public Key Authentication

• ssh-agent and Agent Forwarding

AIDE Via SSH

• Conceptual Overview

• SSH Configuration

• Tools and Scripts

Linux/Unix Logging Overview

• Syslog Configuration

• System Accounting

• Process Accounting

• Kernel-Level Auditing

SSH Tunneling

• X11 Forwarding

• TCP Forwarding

• Reverse Tunneling Issues

Centralized Logging With Syslog-NG

• Why You Care

• Basic Configuration

• Hints and Hacks for Tunneling Log Data

• Log Analysis Tools and Strategies chroot() for Application Security

• What is chroot()?

• How Do You chroot()?

• Known Security Issues

The SCP-Only Shell

• What It Is and How It Works

• Configuring chroot() directory

• Automounter Hacks for Large-Scale Deployments

SELinux Basics

• Overview of Functionality

• Navigation and Command Interface

• Troubleshooting Common Issues

SELinux and the Reference Policy

• Tools and Prerequisites

• Creating and Loading an Initial Policy

• Testing and Refining Your Policy

• Deploying Policy Files

BIND

• Common Security Issues

• Split-horizon DNS

• Configuration for Security

• Running BIND chroot()ed

DNSSEC

• Implementation Issues

• Generating Keys and Signing Zones

• Key "Rollover"

• Automation Tools

Apache

• Secure Directory Configuration

• Configuration/Installation Choices

• User Authentication

• SSL Setup

Web Application Firewalls with mod_security

• Introduction to Common Configurations

• Dependencies and Prerequisites

• Core Rules

• Installation and Debugging

Tools Throughout

• The Sleuth Kit

• Foremost

• chkrootkit

• lsof and Other Critical OS Commands Forensic Preparation and Best Practices

• Basic Forensic Principles

• Importance of Policy

• Forensic Infrastructure

• Building a Desktop Analysis Laboratory

Incident Response and Evidence Acquisition

• Incident Response Process

• Vital Investigation Tools

• Taking a Live System Snapshot

• Creating Bit Images

Media Analysis

• File System Basics

• MAC Times and Timeline Analysis

• Recovering Deleted Files

• Searching Unallocated Space

• String Searches

Incident Reporting

• Critical Elements of a Report

• Lessons Learned

• Calculating Costs

CLIN 0005 - QTY 6 Each. MGT512 Managing the Enterprise, Planning, Network, and Physical Plant. SANS Institute. Testing and Certification required for each individual. This is a Brand Name or Equal requirement.

• Budget Awareness and Project Management

• The Network Infrastructure; Computer and Network Addressing

• IP Terminology and Concepts

• Vulnerability Management

• Managing Physical Safety, Security & the Procurement Process

• Attacks Against the Enterprise

• Defense in Depth

• Managing Security Policy

• Access Control and Password Management

• Cryptography

• Wireless Network Security

• Steganography

• Managing Privacy

• Web Communications and Security

• Operations Security, Defensive and Offensive Methods

• Managing Intellectual Property

• Incident Handling Foundations

• Information Warfare

• Disaster Recovery/Contingency Planning

• Managing Ethics

• IT Risk Management

• Globalization

• IT Business and Program Growth

• Security and Organizational Structure

• The Total Cost of Ownership

• Negotiations

• Fraud

• Legal Liability

• Technical People

The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate offers:

-Technical capability -Price -Past performance (see FAR 15.304) Technical and past performance, when combined, are approximately equal compared to price.

This is a best value decision.

Delivery requirement: N/A. Product is available as online class. Individual students will take classes at their convenience or scheduled time with contractor.

Quote Information:

Quotes must be submitted and received no later than 2:00 PM Pacific Time 16 Aug 1206.

Quotes must be e-mailed to the attention of P.O.C.s listed below.

Please include Cage Code, DUNS and Tax ID information with all quotes.

Contact Information:

Buyer: MSgt Matthew Berube Email: matthew.j.berube2.mil@mail.mil

Financing Information:

A Firm-Fixed Price award will be issued in writing. Telephone quotes will not be accepted.

Award will only be made to contractors who have registered with System for Award Management (SAM) with the NAICS code 611310. Vendors may register at:

http://www.sam.gov.

PROVISIONS AND CLAUSES

Clauses may be accessed electronically in full text through http://farsite.hill.af.mil. Contractors must be actively registered with www.SAM.gov and Wide Area Work Flow (WAWF) at http://wawf.eb.mil.

FAR 52.204-7, System for Award Management Registration FAR 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards FAR 52.204-16, Commercial and Government Entity Code Reporting FAR 52.204-18, Commercial and Government Entity Code Maintenance FAR 52.209-6, Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment FAR 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations FAR 52.211-6, Brand Name or Equal

FAR 52.212-1, Instructions to Offerors-Commercial Items

FAR 52.212-2, Evaluation-Commercial Items Evaluation. The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate offers:

-Technical capability -Price -Past performance http://www.sam.gov/ http://farsite.hill.af.mil/

Technical and past performance, when combined, are approximately equal compared to price.

This is a best value decision.

FAR 52.212-3 ALT I, Offerors Representation and Certifications Commercial Item or complete electronic annual representations and certifications at http//orca.bpn.gov FAR 52.212-4, Contract Terms and Condition-Commercial Items FAR 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders-Commercial Item are incorporated by reference, however, for paragraphs (b) and (c) the following clauses apply FAR 52.222-3, Convict Labor FAR 52.222-19, Child Labor—Cooperation with Authorities and Remedies FAR 52.222-21, Prohibition of Segregated Facilities FAR 52.222-26, Equal Opportunity FAR 52.222-36, Affirmative Action for Workers with Disabilities FAR 52.222-50, Combating Trafficking in Persons FAR 52.223-18, Encouraging Contractor Policy to Ban Text Messaging While Driving FAR 52.225-13, Restrictions on Certain Foreign Purchases FAR 52.232-33, Payment by Electronic Funds Transfer—System for Award Management FAR 52.232-39, Unenforceability of Unauthorized Obligations FAR 52.232-40, Providing Accelerated Payments to Small Business Subcontractors FAR 52.233-3, Protest After Award FAR 52.233-4, Applicable Law for Breach of Contract Claim FAR 52.252-2, Clauses Incorporated by Reference – SEE http://farsite.hill.af.mil FAR, 52.252-6, Authorized Deviations in Clauses DFARS 252.203-7000, Requirements Relating to Compensation of Former DoD Officials DFARS 252.203-7005, Representation Relating to Compensation of Former DoD Officials DFARS 252.203-7996, Prohibition on Contracting with Entities that Require Certain Internal Confidentiality Agreements-Representations DFARS 252.203-7997, Prohibition on Contracting with Entities that Require Certain Internal Confidentiality Agreements DFARS 252.204-7008, Compliance with Safeguarding Covered Defense Information Controls DFARS 252.204-7012, Safeguarding of Unclassified Controlled Technical Information DFARS 252.204-7015, Disclosure of Information to Litigation Support Contractors DFARS 252.211-7003, Item Unique Identification and Valuation DFARS 252.213-7000, Notice to Prospective Suppliers on the Use of Past Performance Information Retrieval Systems—Statistical Reporting in Past Performance Evaluations DFARS 252.225-7035 Alt IV, Buy American—Free Trade Agreements—Balance of Payments Program Certificate (Alternate IV) DFARS 252.225-7036 Alt II, Buy American—Free Trade Agreements—Balance of Payments Program (Alternate II)

DFARS 252.232-7003, Electronic Submission of Payment Requests (WAWF instructions provided at time of award) http://farsite.hill.af.mil/

DFARS 252.232-7006, Wide Area Workflow Payment Instructions DFARS 252.232-7010, Levies on Contract Payments DFARS 252.244-7000, Subcontracts for Commercial Items

Submission of Invoices In accordance with FAR clause 52.212-4(g) the contractor shall submit all invoices electronically utilizing Wide Area Workflow (WAWF). Procedures for using WAWF are found in DFARS clause 252.232-7003 Electronic Submission of Payment Requests.