GSA - Application Security Testing - Market Research MRAS.pdf

8/31/22, 4:17 PM GSA - Application Security Testing - Market Research MRAS https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 1/19

Q1. GSA - Application Security Testing - Market Research

The U.S. government is focused on increasing the depth, rigor, and creativity of its approach to application security testing, so that it sees and analyzes its applications as its adversaries do.

GSA is seeking information to determine the availability of Application Security Testing (AST) capabilities in the marketplace that analyze the security of new or existing information communications technology applications, software, or specialized utility programs and provide actionable results.

Responses Due: 09/30/2022

GSA invites respondents to answer some or all of the questions below. One of the primary goals of this effort is to build an understanding of the complexity and diversity of this marketplace, ensuring federal agencies can make the greatest use of the services, technologies, and toolsets available. Not all questions listed below are appropriate for all solutions, and niche services may add significant value considering the unique nature of many federal systems.

Responses Due: 09/30/2022

To view the RFI Questions prior to completing, please click here.

Q2. Draft Requirements Document

Q3. References:

1. SP 800-115, Technical Guide to Information Security Testing and Assessment | CSRC (nist.gov)

2. SP 800-218, Secure Software Development Framework (SSDF) Version 1.1:

Recommendations for Mitigating the Risk of Software Vulnerabilities

Link To Draft Requirements Document https://feedback.gsa.gov/CP/File.php?F=F_bqnrgbvZtH32ZUO https://feedback.gsa.gov/WRQualtricsSurveyEngine/File.php?F=F_1GZf54CsRCZT51o&download=1 https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 2/19

3. NISTIR 7316, Assessment of Access Control Systems | CSRC

4. INCITS: INCITS 359-2012: Information technology - Role Based Access Control

5. Mobile Application Security Exercise Final Report (nist.gov)

6. Out-of-Band vulnerabilities: What are they and how can be prevented? (gb-advisors.com)

7. How to Do Security Testing Manually: 12 Effective Ways | Cypress Data Defense

8. WSTG - v4.2 | OWASP Foundation

Q4. Market Research Notices

For Schedules Only: Based on the responses submitted to this RFI, the Government reserves the right to issue all future requests for quotes directly to identified sources via email in accordance with FAR 8.405-3(b)(1)(ii)(B)(2) and/or FAR 8.405-2(c)(3)(iii) (B).

Q5. Would your firm submit an offer if this requirement is issued under your GSA Contract?

undefined. Please identify all GSA Contracts your company holds and are relevant to this requirement. If you selected "Other GSA Contract or BPA" please explain in the Optional Feedback section.

undefined. Please indicate all SINS, Pools or Constellations that are applicable to this i t If l t d "Oth " l l i i th O ti l F db k ti

Market Research Notice - Click to Download

Yes

No, please provide the reason in the optional feedback section below

Multiple Award Schedule (MAS)

Alliant 2

8A STARS 3

VETS 2

EIS

Other GSA Contract or BPA https://feedback.gsa.gov/WRQualtricsSurveyEngine/File.php?F=F_7ZDOdOMjRQt0U3H&download=1 https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 3/19 requirement. If you selected "Other" please explain in the Optional Feedback section.

Q8. Company Information:

Please complete the information below to the best of your ability. If you have questions about your contract information, you can find your information on the GSA eLibrary page.

Where the Government asks for URLs, please only provide URLs, non URLs will be deleted.

If an email is not provided, your company will not receive a receipt of your response or the Agency POC once this RFI closes.

54151HACS

517312

517410

ALL 2

STARS3

VETS 2

EISCONTRACTS

Other

Company Name:

Contract Number

First Name:

Last Name:

POC Email:

POC Phone #:

Company Website URL:

Unique Entity Identifier (UEI) CAGE Code:

https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 4/19 undefined. Please select the NAICS code you believe is most appropriate for this requirement. If you selected "Other" please explain in the Optional Feedback section.

Q10.

Please indicate the size of your business.

Size Description Key:

s - small business o - other than small business

Q11.

Please select all socio-economic categories that apply to your business.

Please note, your company must be recognized as 1 or more of these designations under your GSA Contract for you to select it. Data is validated prior to reports being issued.

Socio-economic description Key:

w - Woman Owned business.

wo - Women Owned Small business (WOSB) ew - Economically Disadvantaged Women Owned Small business v - Veteran Owned Small business dv - Service Disabled Veteran Owned Small business d - SBA Certified Small Disadvantaged business 8a - SBA Certified 8(a) Firm

541511

517312

517410

541512

517311

Other s - small o - other than small https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 5/19 h - SBA Certified HUBZone Firm

Q12. Do you provide this service or product commercially?

Q13. Technical Yes/No Questions - In the Past 5 years does your firm have relevant experience providing the following:

You can explain your response in the PDF capability document below.

Q14. Technical Questions - Multiple Choice

Do you provide an Application Security Testing (AST):

Q15 Technical Questions - Short Answer w wo ew v dv d 8a h N/A

Yes

No

Yes

1. Do your AST service offerings have the ability to detect those vulnerabilities that cannot be detected by a traditional HTTP request-response interaction?

2. Do your AST methods include the ability to analyze client-side logic, such as JavaScript or Java applets?

3. Do you perform memory safety evaluation as part of testing?

4. Should the software security architecture and/or deployment model of a given application be considered as part of AST?

Product Only

Service Only

Both https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 6/19

Q15. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

List any standards, accreditation regimes, generally accepted practices, and frameworks that your AST services or product(s) align with for the testing, evaluation, and validation of software, source code, components such as libraries and application program interfaces (APIs).

Q16. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

What source(s) does your company use to identify and understand cyber adversary behavior, tactics, techniques, procedures, and vulnerabilities to support testing approaches?

a. Please list and characterize the sources (threat information services, contracted support, open source, research, etc.).

b. How are these sources used to inform testing approach and method?

Q17. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

What tasks does your company perform during an analysis of the security of computer applications, web applications, mobile applications, or specialized utility programs?

Q18. Technical Questions - Multiple Choice

What types of testing are performed and/or supported by your company? (Check all that apply)

Static Application Security Testing (SAST)

Dynamic Application Security Testing (DAST) https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 7/19

Q19. Technical Questions - Multiple Choice

Which of the following tasks or activities may be performed during manual expert analysis testing by your company? (Check all that apply)

Interactive application security testing (IAST)

Mobile Application Security Testing (MAST)

Source code-level checks using static analysis

Source code-level checks using dynamic analysis

Binary or compiled code checks Using static analysis

Binary or compiled code checks Using dynamic analysis

Application scanning (for locally hosted apps)

Web application service scanning (SaaS cloud-hosted or web-delivered apps)

Other

Monitor Access Control Management – manually testing for password quality rules, default logins, password recovery, password changes, logout practices, path reversal, missing authorization, etc.

Dynamic Analysis – use of penetration testing capabilities that cover data collection, vulnerability assessment, launch simulated attacks, and report preparation.

Static Code Analysis – depending upon purpose and scope, code style enforcement, compiler level-checks seeking logical errors, etc.

Checking Server Access Controls – manually ensuring that user access is strictly controlled and looking for open access points.

Evaluating Entry Points – checking ingress and egress network points for unauthorized network activity to include access and filtering for sensitive traffic to and from those points.

Session Management – checking to see if the system is handling sessions properly to include idle time expiration, session termination after login as much as termination after maximum lifetime, session cookie scope, etc.

https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 8/19

Q20. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

Do you have a standardized testing service checklist for each of the performed testing methods or testing types?

If yes, how do you ensure the checklist is followed?

Q21. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

Describe your company’s experience level with the following:

a. Threat modeling

b. Automated testing

Password Management – checking for system enforcement of password policies, password storage, and proper use of encryption.

Brute-Force Attacks – attempting logins with invalid passwords, checking limits to failed login attempts, and checking for logins from suspicious or unknown devices.

SQL Injection – identifying and testing system access and acceptance of scripts related to system queries.

Cross-Site Scripting – checking for proper input and output encoding.

URL Manipulation – manual variations of input parameters for query strings to identify server acceptance.

Identifying High Risk Functions – checking policy and controls related to upload/download of files, insecure password storage, buffer overflows, etc.

Other (please specify) https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 9/19

c. Static analysis

d. Manual analysis to discover hardcoded passwords and private encryption keys, conducting black box tests, fuzzing, and mobile application security testing.

e. Other types of manual analysis (please specify).

Q22. Technical Questions - Short Answer

While performing manual AST, what methods or technology does your company integrate into the testing of Open-Source Software (OSS), no-code or low- code, or other third-party software?

Q23. Technical Questions - Short Answer

What vetting does your company do of suspected vulnerabilities before submitting a report to the customer?

Q24. Technical Questions - Short Answer

How are frequently identified findings verified against observed industry trends and https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 10/19 threat analysis reports (e.g., DBIR, OWASP Top 10, etc.)

Q25. Technical Questions - Short Answer

What quantitative metrics do you rely on to track performance of the testing services, and can summary data be shared for the following:

a. How frequently is the service performed?

b. How frequently does a testing service produce output?

c. How frequently does it generate findings?

d. How are findings verified? (e.g., false positives rate, how they are verified and eliminated).

Q26. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

How does your testing approach support the various software development methodologies (e.g.,DevOps, SecDevOps,etc.) in general, and the CI/CD pipeline specifically?

Q27. Technical Questions - Short Answer https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 11/19

What is your approach to and experience in incorporating AST into the SDLC upfront?

Q28. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

What security gates do you build into SDLC to explicitly accommodate the testing requirement?

Q29. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

Describe your approach to using findings and mitigations to derive recommendations for informing SDLC changes in order to avoid similar issues in the future?

Q30. Technical Questions - Multiple Choice

What types of API testing does your company perform and or support? (Check all that apply)

Runtime/Error Detection

Security Testing

UI Testing

Interoperability and WS compliance Testing https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 12/19

Q31. Technical Questions - Multiple Choice

Do you perform security testing of Operational Technology (OT) software, code, and/or applications? If yes, what OT topologies? (Check all that apply)

Q32. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

What languages, operating systems, hardware can you perform AST on (e.g., source, binary)?

Q33 Technical Questions Short Answer

Penetration Testing

Fuzz Testing

Human Machine Interface (HMI) software

Data Historians

Control Application Software

Supervisory control and data acquisition (SCADA)

Distributed Control Systems (DCS)

Programmable Logic Controller-Based (PLC)

Building Automation Systems (BAS)

Physical Access Control Systems (PACS)

Industrial Internet of Things (IIoT)

Other (Please explain) https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 13/19

Q33. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

What setup do you require for performing manual tests? (e.g., containers, cloud servers, virtual machines, bare metal, specific network connections, etc.)

Q34. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

What assets do you require for performing manual testing? (e.g., source code – only for the application or all libraries as well, runnable programs, third party dependencies, etc.)

Q35. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

Do you perform destructive tests?

a. If so, how many copies of the target do you need?

b. Do you perform recoverable destructive tests?

c. If the test is potentially destructive, then what procedures are followed to prevent accidental destruction?

Q36. Technical Questions - Short Answer https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 14/19

What do you do with the output of a static analysis tool?

a. If you use tools for testing, how do you select the diagnostics (e.g., alerts, warnings, etc.) to investigate and which to ignore?

Q37. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

Do you evaluate source code against a standard, e.g., MISRA or CERT?

a. If so, which standards can you support?

Q38. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

Can you do in situ testing? (e.g., testing on an installed system, either IT or OT)

a. If so, how do you protect against service disruptions?

Q39. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

What level of granularity does your manual analysis reach? (e.g., the application, components within the application, modules within the component, etc.)

https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 15/19

Q40. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

How do you perform Software Composition Analysis (SCA)?

a. What assets do you need to perform SCA? (e.g., binary application, source code, etc.)

b. If you use a SCA, what do you do with the output of a SCA tool?

Q41. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

What kind of incremental AST can you perform? (e.g., an update comes out, what kind of incremental testing can you do? Or are you required to perform the entire evaluation from scratch?)

a. What assets do you need for an incremental test?

Q42. Technical Questions - Short Answer

Do your services require the use of an API product?

https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 16/19

a. If yes, what capabilities does the API provide?

b. If no, what are the plans to add this capability to support automation efforts?

Q43. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

How do you ensure that your application security testing experts maintain their skills and are continually exposed to advances in this field?

a. Describe how you deliver ongoing training and development (to your full application security testing team—managers and technical staff) including both fundamental knowledge and training on new AST tooling features and changes.

b. Do you objectively assess the practitioner knowledge and capability of your AST team using real-world threats and vulnerabilities (not purely academic testing)?

c. What knowledge, skills or abilities are valued most in the field of application security testing?

d. How many of your staff have GWAPT, OSWE or GMOB certifications? Please list the number of staff by type.

https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 17/19

Q44. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

Do you maintain and update, as applicable, a service or product roadmap?

a. What is your product development cycle (differentiating bug fix releases, minor enhancements, and major product feature updates)? Please describe in terms of frequency based on your actual release cycle for the past two years.

b. What is your planned product release schedule for the upcoming year period?

c. How do product maintenance or support plans affect update availability?

Q45. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

Does your company employ personnel to complete all aspects of AST, or do you subcontract AST work? (Please specify which parties do which scopes of work.)

Q46. Technical Questions - Short Answer Limited to 1900 characters, if more space is needed, please include in your capability file.

Please provide any additional AST relevant information (e.g., best practices, techniques, or approaches) that is not addressed by the RFI questions.

Q47. Optional Feedback: Please provide any feedback or questions you may have related to this requirement and the Draft PWS.

https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 18/19 q

Please do not include capabilities information. Capabilities information will be deleted and not included in the report to the Agency. This section is only for questions or feedback to the Agency about this requirement.

Q48. Capability Website Address: Please provide a URL to a capability website for your company. This website may be used instead the file below and/or in combination with the file above.

Q49.

Optional Capabilities Statement:

Capabilities Statements should include relevant experience, relevant experience are projects that are similar to the described requirements that have occurred in the past 5 years. Please include at most 3 relevant projects and the following information:

1. Customer Name

2. Customer POC/Client Email

3. Total Contract Value

4. Period of Performance

5. Brief Description of Services Provided

6. Is there a CPARS available, yes or no?

Please note: Only one (1) file can be uploaded here. Be sure you stack/combine your documents prior to uploading.

Please do not provide general capabilities statements. Only provide relevant information related to this requirement. This is optional.

https://feedback.gsa.gov/jfe/form/SV_diKD19fUVeBAvoG 19/19

Powered by Qualtrics A

Q50.

AFTER YOU SUBMIT YOUR RESPONSE:

A confirmation email will be sent to the provided POC email with confirmation that your response has been received with a copy of your completed responses.

Disclaimer By submitting your response (clicking Submit) you grant the U.S. General Services Administration (GSA) the authority to share your information with other Government entities including Federal, State and Local Governments as well as the right to publish your market research response, including your company name, POC contact information, on public-facing

Government websites.

Drop files or click here to upload

Submit http://www.qualtrics.com/