Questions_and_Answers_-_11-30.pdf

Questions and Answers

Solicitation: HE1AA-P-13-0002

November 30, 2012

1. Is there a specific format for the proposal? Are there any page limitations for the

Technical Approach & Past Performance?

No format or limit. We will only accept electronic proposals sent via email. Our inbound mailbox limit is around 20MB.

2. Please define the ingress and egress points of the network (are these only the POPs or do they also include all I/O devices such as workstations with USB ports etc.).

Only POPS (4). See response to question 13 for additional details.

3. Are software upgrades, patches, etc. for vendor products only or to include existing products/equipment?

Vendor product only. We are purchasing a service; vendor is responsible for management and maintenance.

4. Are Managed Services performed only @ boundary?

Yes

5. Is the managed service for 24x7 x365 days operation?

Yes

6. Any certifications required for the trained threat analyst? Eg DoD 8570 IAT II or IAT III

The requirement is for a trained threat analyst(s); certifications can be a supporting factor.

7. Should there be role based access controls for service portal access by GSA personnel?

This is currently not a requirement as access will be limited to key agency personnel involved in this function.

8. Can the system acquire log information from the 20K nodes i.e. workstations & servers to support APT detection? No; there are no direct feeds.

The requirement is for the vendor to be able to monitor all traffic at POPs and correlate against vendor APT signatures to identify APT activity; not garden variety malicious code.

9. Describe the connectivity options for deploying an appliance into the GSA network.-

Vendor managed device just inside our egress FW with spans.

10. Is communication of the alert information between GSA and the MSP deemed sensitive and thus require FIPS encryption?

Yes.

11. What network devices are deployed in the GSA architecture (Cisco, Juniper, etc)? Will the solution have access to interface with these devices to acquire info.

Cisco devices are predominant. The vendors managed device will receive a span of all inbound/outbound traffic only; there will be no direct interfaces to agency IT systems.

12. What is the number of POPs and the bandwidth available at each POP?

4 POPs at 500 Mbps each. Ability to scale up to 1Gb on all 4 locations with no reprovisioning required.

13. Can any software be loaded onto the workstations/servers to support the APT detection solution?

NO

14. What is the number of internet points of presence and the bandwidth at each location.

708,737 Total Inbound Message Volume at Postini Gateway. Reporting limitations prevents us from collecting an hourly breakdown to determine peak hour stats.

15. What is the number of emails received by the 20,000 users per day? and per hour peak email loads during the 8:00 to 5:00 PM work day?

4 POPs at 500 Mbps each. Ability to scale up to 1Gb on all 4 locations with no reprovisioning required

16. What is the peak number of emails per hour after Spam Filter and AV?

531,878 Inbound volume after SPAM & A/V filters

17. How many of these emails have attachments?

29,496 quantity with Attachment(s)

18. What is the total number of mailboxes? 20,000 for each user?

22,382 Total Mail Boxes; 17639 users and shared accounts and 4743 are Groups.

GSA's email is hosted in Google Apps for Government in Google's cloud; Postini provides message filtering. It is not an on-premise solution.