RFP_Attachment_6_FA2_Price_Scenario.pdf

RFP Attachment 6 – FA2 Price Scenario

RFP # HQ0034-16-R-0258

Functional Area 2 Price Scenario

Price Analysis:

For purposes of effective price analysis, please cost the following hypothetical scenario, per your typical business model for one or both of the Functional Areas you plan to propose to. Provide separate lines for: 1)

Bounties; 2) Contractor Services; 3) Background checks (if applicable).

FA2 Price Scenario:

Scope: The scope of the challenge includes testing the source code and operational functionality of one DoD-wide time and payroll application. The application is Internet-accessible, but requires credentials to access. It has between 100,000 and 500,000 of code, written in Java with a MySQL database. The application itself is poorly maintained, is susceptible to basic attacks, especially Cross Site Scripting (XSS), Cross Site Request

Forgery (CSRF), and known exploits against system libraries (i.e., Heartbleed). The application is also susceptible to more advanced attacks including buffer overflows and privilege escalation attacks.

Bounties: The challenge will be closed, by invitation only, with approximately 50 high-performing researchers conducting persistent and effective testing. The DoD expects that these researchers would already have passed criminal background checks before being eligible to participate. The challenge is expected to last approximately one month, with reports being submitted rather evenly throughout the duration of the challenge, however, with few duplicate submitted reports. Approximately 120 valid and actionable vulnerability reports are expected – 60 XSS and CSRF attack reports, 30 public content manipulation, 12 remote code execution, and

18 privilege escalation attacks. DoD expects the triage team to prioritize and assign vulnerabilities through an industry standard severity schema, such as the Common Vulnerability Scoring System (CVSS) or the Common

Weakness Enumeration (CWE), and pay bounty awards based on common market prices for the vulnerabilities at that security level.

Services: The DoD Component that is responsible for the maintenance of the application is well organized and highly skilled. Although it is expected that the researchers provide possible fixes for the vulnerability, they will be able to work to remediate vulnerabilities without too much assistance from the contractor or the researchers.

Background Checks: DoD expects the Contractor to conduct commercial background checks of all eligible researchers. This will include a minimum background check that will include the ability to screen for felonies and, known or suspected, terrorist activities.

Travel: The Contractor would be expected to send its Program Manager and designated Technical Lead to attend a one day meeting with the DoD Tech Stakeholders at the Pentagon in Arlington, VA. However, the funding for the Travel Contract Line Item Number (CLIN) will be distributed based on actual cost on a Not to

Exceed basis.

Expense Rate or Fixed Price Total

Bounties

Firm Fixed Platform Services based on bounty amount

(This must include any overhead and profit you anticipate)

Background Checks (Rate Per Person)

Travel (Not to Exceed) $5,000.00 $5,000.00

Grand Total Amount: