ATTACHMENT_1_SOW.pdf

Statement of Work (SOW) for

BRAND –NAME or EQUAL SANS Training Courses SEC503, SEC504, SEC505. SEC542

1.0 BACKGROUND

1.1 This Statement of Work includes four BRAND-NAME or EQUAL courses: SANS SEC503:

Intrusion Detection In-Depth; SANS SEC504: Hacker Techniques Training/Incident Handling;

SEC505: Securing Windows and PowerShell Automation; SANS SEC542: Web App Penetration

Testing and Ethical Hacking. Each course is instruction geared towards teaching and qualifying

United States’ Government personnel to be proficient in computer networking operation and maintenance and information technology security.

1.2 The requires these courses in order to effectively execute our mission to secure and defend the Air Force Network (AFNet). These course are designed to provide foundational knowledge required to harden specific network assets and ensure that operators are able to detect and respond to possible intrusion attempts and attacks.

2.0 OBJECTIVES

2.1 The seeks to purchase each BRAND-NAME or EQUAL training course (SANS SEC

503, SANS SEC 504, SANS SEC 505, SANS SEC 542) to provide instruction for approximately

(5) students per course (20 students in total); as well as, to include the certification cost, exam voucher, and administration. The courses will be hosted online via the contractor’s institute virtual training platform with an online instructor. The training shall be focused on enhancing foundational cyber security abilities required of each operator belonging to the .

2.2 (5) Students shall be sent to BRAND-NAME or EQUAL course SANS SEC 503 (Intrusion

Detection In-Depth) and leave the training with a voucher and the skills required to pass and earn the GIAC Certified Intrusion Analyst (GCIA) Certification. These skills are required to ensure that operators are able to identify when there may be a possible intrusion attempt on our network and proper steps in handling the incident.

2.3 (5) Students shall be sent to BRAND-NAME or EQUAL course SANS SEC 504 (Hacker

Techniques Training/Incident Handling) and leave the training with a voucher and the skills required to pass and earn the GIAC Certified Incident Handler (GCIH) Certification. These skills are required to ensure that operators are able to appropriately respond to the various types of incidents covered by the certification.

2.4 (5) Students shall be sent to BRAND-NAME or EQUAL course SANS SEC 505 (Securing

Windows and PowerShell Automation) and leave the training with a voucher and the skills required to pass and earn the GIAC Certified Windows Security Administrator (GCWN)

Certification. These skills are required to ensure that operators are able to effectively configure and manage the security of Microsoft operating systems including PKI, IPSec, Group

Policy, DNSSEC, PowerShell, and general hardening of Windows systems.

2.5 (5) Students shall be sent to BRAND-NAME or EQUAL course SANS SEC 542 (Web App

Penetration Testing and Ethical Hacking) and leave the training with a voucher and the skills required to pass and earn the GIAC Web Application Penetration Tester (GWAPT) Certification.

These skills are required to ensure that operators are able to secure and assess the security of web servers which are some of the most vulnerable portions of a network and securing them can greatly bolster the security of our network.

3.0 SCOPE

3.1 The contractor shall provide online virtual training, including certification cost, exam voucher, and administration, for the following SANS training courses: SANS SEC 503, SANS SEC 504, SANS

SEC 505, and SANS SEC 542. Each class will have five (5) students and shall be instructed by an institute online instructor. Each class will have a start date no later than 30 September, 2018.

4.0 REQUIREMENTS AND PERFORMANCE STANDARDS

4.1 The contractor shall arrange access to the virtual classroom for all students 7 days prior to the start of the course.

4.2 The contractor shall provide the most current course publications 7 days prior to the course start date. This includes but is not limited to:

4.2.1 Course book

4.2.2 Workbook with hands-on exercises and question

4.2.3 DVD with Linux/VMWare

4.2.4 Helpful handouts/cheat-sheets as applicable

4.2.5 Audio files for lecture

4.2.6 Tools

4.2.7 PowerPoint slides

4.2.8 Lab kits

4.3 The instructor shall cover the course material and perform knowledge checks to gauge the class’ understanding of the material. This will ensure a high percentage of class members can retain knowledge on the course material, in preparation for passing the end of course certification exam.

4.4 The course instructor shall meet all requirements for the course they will be instructing - this includes holding the same certification that students can earn from the course(s), prior experience teaching the course(s), other requirements listed in this statement of work, any other requirements specified by the company providing training, and any additional applicable training requirements for teaching the assigned course.

4.5 The course must include simulation/hands on exercises that give operators experience on the concepts taught in this course. The exercises must include the following at a minimum:

4.5.1 SQL Injection

4.5.2 Backdoors

4.5.3 Windows Command Line/PowerShell

4.5.4 Linux attack detection

4.5.5 Detecting Denial of Service attacks

4.5.6 Wireshark

4.5.7 Snort

4.5.8 IDS/IPS

4.5.9 Capture the Flag event

4.5.10 TCPDump

4.5.11 Heartbleed exploits

4.5.12 Session Hijacking

4.5.13 HTML Injection

4.5.14 Python

4.5.15 Penetration Testing

4.6 The contractor shall provide Certification exam vouchers for each student for BRAND-NAME or

EQUAL SANS SEC 503, SANS SEC 504, SANS SEC 505, SANS SEC 542 (5 vouchers for each course).