HSSS01-12-Q-0125.rtf

Request For Quotations HSSS01-12-Q-0125

United States Secret Service Statement of Work Network Forensics Training

Introduction:

The purpose of this solicitation is to obtain a 5 day training network forensics training course to be held at the US Secret Service Training Center in Laurel, MD during the weeks of either September 10-14, 2012 or September 15-19, 2012.

Organization United States Secret Service Criminal Investigative Division 950 H Street, NW Suite 5300 Washington DC, 20223

Mission The Secret Service was established as a law enforcement agency in 1865. While most people associate the Secret Service with Presidential protection, our original mandate was to investigate the counterfeiting of U.S. currency--which we still do. Today our primary investigative mission is to safeguard the payment and financial systems of the United States. This has been historically accomplished through the enforcement of the counterfeiting statutes to preserve the integrity of United States currency, coin and financial obligations. Since 1984, our investigative responsibilities have expanded to include crimes that involve financial institution fraud, computer and telecommunications fraud, false identification documents, access device fraud, advance fee fraud, electronic funds transfers, and money laundering as it relates to our core violations.

Background and Objective Background Today’s high tech environment presents new challenges to law enforcement as cyber criminals and others increasingly exploit computers and the Internet to threaten our banking, financial and critical infrastructures.

Statement of Work

1. DESCRIPTION OF SERVICES

The vendor must be able to provide a 5 day training course for 16 students to be held at the US Secret Service Training Center located in Laurel, MD either during the week of September 10-14, 2012 or the week of September 15-19, 2012. The training should include but is not limited to:

Network Analysis The OSI Model for Network Analysis

Command Line Unix DHCP Configuration DHCP Logging

Passive Evidence Acquisition Hardware-based Data Acquisition

Network Taps Software-based Evidence Acquisitions Use of tcpdump to capture packets Use of tcpdump to filter packets Filtering with BPF at the byte and bit level

Packet Analysis Using ngrep

Using tcptract

Firewall Configuration Inspecting and understanding ACLs

Extracting and preserving firewall configurations

Firewall Logging Exploring firewalls as data sources

Modifying ACLs to provide new evidence

Centralized Logging & Syslog Enterprise logging strategies

Compensating for poor network instrumentation

OS Logs and Splunk Aggregating OS logs

Using Splunk to visualize logged data Timeline correlation using Splunk

NIDS/Snort Understanding Network-based Intrusion Detection Systems

Reading and understanding Snort rules Leveraging Snort for forensic utility

Web Proxies & Encryption Dealing with encryption on the fly

Commercial and open-source solutions to MitMfGG (man-in-the-middle for Good Guys)

Squid Access Logs Exploring enterprise browser histories with Squid proxies

Squid Cache Exploring the contents of the enterprise web cache Reconstructing web sessions without the device in hand Advanced cache reconstruction: using scripting to rebuild

Wireless Access Points Functionality provided by WAPs

Difference in makes and models Examining WAP logs

Wireless Acquisition & Analysis Differences between various software programs

Best practices in acquisition

802.11 analysis at the packet level

Network-based Evidence Issues Understanding the “typical” network environment

Understanding digital evidence in a court setting Different categories of evidence

Crime Scene Considerations Understanding the network topology

Understanding the business environment Verification of an Incident Evaluating the seriousness of the situation

Formulating a Strategy Prioritizing the value of the resources available

Coming up with a plan of action

Collecting Priority and Volatile Evidence Acquiring the highest priority and most volatile evidence

Keeping our footprints small

Analysis of Authentication Logs -Building a timeline of activities based on authentication logs

- Detecting anomalous events through correlation and aggregation

Correlation of MAC and IP Addresses Tracing systems through dynamic networks

Correlation of activities by DHCP assignments

Firewall Log Analysis Understanding events from a new perspective

Correlation of activities with another data source

IDS Log Analysis

Corroboration from the Web Proxy Tracing the exploit back to its source

Reconstruction of the malicious content

Reconstruction of Suspect’s Activities Understanding the bad actor in context

Building a comprehensive theory of the case

Presentation of our Theory of the Case Making it all make sense to the stakeholders

Presentation of our analysis to the target audience

The course shall include hands on exercises involving the requirements listed above.

2. DELIVERABLES

The deliverables to be produced for this engagement are as follows:

Content and delivery of a 5 day computer network forensics course in accordance with the above noted requirements.

3. TYPE OF AWARD

The Government intends to award a firm fixed price contract for the 5 day network forensic course. The dates of the will be during the week of September 10-14, 2012 or the week of September 15-19, 2012. The training will be held at the US Secret Service Training Center, 9200 Powder Mill Road, Laurel, MD. The USSS will provide a classroom suitable for instruction at the USSS James J. Rowley Training Center.

4. INVOICING AND PAYMENT

All invoices will be paid within 30 days of receipt following delivery of services.

Point of Contact Jason A. Henslee

950 H Street, NW, Suite 5300 Washington DC, 20223

USSS Security Requirements All materials and discussions are considered law enforcement sensitive.

All contractor supplied software and magnetic media must successfully complete a virus scan prior to full acceptance.

Sensitivity of Information Requirements Any and all information processed by the contractor as described in this document will be considered sensitive but unclassified (SBU). Under this contract, non-government personnel will not have access to classified materials or information. Although individual elements are SBU in totality they represent access to the highly sensitive nature of the Secret Service operating environment.

INSTRUCTIONS FOR PREPARING THE QUOTE

General Information

The Offeror's quote must show‑‑

The solicitation number;

Offeror's Dun & Bradstreet (DUNS) number and Taxpayer Identification (TIN) number;

The name, address, telephone and facsimile numbers, and e-mail address of the Offeror;

Socio-Economic status (e.g., Service Disabled Veteran-Owned Small Business, 8(a) Business, Woman-Owned Small Business, HUBZone Business, Small Disadvantaged Business, Small Business, or Large Business);

Full details of proposed training to demonstrate compliance with requirement

Three (3) to five (5) references for both Past Performance information and to determine satisfaction of clients with previously provided training.

Must include full contact information for references – phone and e-mail

Include contract information to identify referenced training

EVALUATION FACTORS FOR AWARD

Proposals will be evaluated in relation to the following evaluation factors:

Evaluation criteria to be used to determine the successful offeror are:

Demonstration that proposed coursework includes all stated requirements

Past Performance – to include review of satisfaction of previous training clients Price These technical factors are listed in order of importance and, when combined, are more important that price. As technical capabilities become more equal, price will increase in importance. Offerors should submit a brief technical proposal in addition to their pricing proposal in support of their ability to meet the requirements of the Statement of Work. This proposal should include sufficient information to allow evaluation of the factors as stated above. Pricing should be stated as a fully burdened hourly rate.

Basis for Award The evaluation will be based on best value principles. Accordingly, award will be made to the responsible and technically acceptable Offeror whose proposal provides the greatest overall value to the Government, price and other factors considered. This will be determined by comparing the value of the differences in the technical capabilities for competing offers based on their demonstrated ability to meet the stated requirements and the stated satisfaction ratings of previous clients. In making this comparison, the Government is more concerned with obtaining superior training than with making an award at the lowest overall cost to the Government. However, the Government will not make an award at a significantly higher overall price to the Government to achieve slightly superior technical skills.

SOLICITATION CLAUSES AND PROVISIONS

52.252-1, Solicitation Provisions Incorporated by Reference. (FEB 1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this/these address(es): Federal Acquisition Regulation (FAR): http://www.acquisition.gov/far

Homeland Security Acquisition Regulation (HSAR): http://www.dhs.gov/xopnbiz/regulations/

(End of provision)

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders - Commercial Items. (FEB 2012)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.222-50, Combating Trafficking in Persons (FEB 2009) (22 U.S.C. 7104(g)).

[ ] Alternate I (Aug 2007) of 52.222-50 (22 U.S.C. 7104(g)).

(2) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(3) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Pub. L. 108-77, 108-78).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items: Contracting Officer check as appropriate.

[ ](1) 52.203-6, Restrictions on Subcontractor Sales to the Government (SEP 2006), with Alternate I (OCT 1995) (41 U.S.C. 253g and 10 U.S.C. 2402).

[ ](2) 52.203-13, Contractor Code of Business Ethics and Conduct (APR 2010)(Pub. L. 110-252, Title VI, Chapter 1 (41 U.S.C. 251 note)).

[ ](3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (JUN 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

[ ](4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (FEB 2012) (Pub. L. 109-282) (31 U.S.C. 6101 note).

[ ](5) 52.204-11, American Recovery and Reinvestment Act--Reporting Requirements (JUL 2010) (Pub. L. 111-5).

[ ](6) 52.209-6, Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (DEC 2010) (31 U.S.C. 6101 note).

[ ](7) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (JAN 2012) (41 U.S.C. 2313).

[ ](8) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (section 740 of Division C of Public Law 111-117, section 743 of Division D of Public Law 111-8, and section 745 of Division D of Public Law 110-161)

[ ](9) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (NOV 2011) (15 U.S.C. 657a).

[ ](10) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (JAN 2011) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

[ ](11) (Reserved)

[ ](12)(i) 52.219-6, Notice of Total Small Business Set-Aside (NOV 2011) (15 U.S.C. 644).

[ ](ii) Alternate I (NOV 2011).

[ ](iii) Alternate II (NOV 2011).

[ ](13)(i) 52.219-7, Notice of Partial Small Business Set-Aside (JUN 2003) (15 U.S.C. 644).

[ ](ii) Alternate I (OCT 1995) of 52.219-7.

[ ] (iii) Alternate II (MAR 2004) of 52.219-7.

[ ](14) 52.219-8, Utilization of Small Business Concerns (JAN 2011) (15 U.S.C. 637 (d)(2) and (3)).

[ ](15)(i) 52.219-9, Small Business Subcontracting Plan (JAN 2011) (15 U.S.C. 637(d)(4).

[ ](ii) Alternate I (OCT 2001) of 52.219-9.

[ ](iii) Alternate II (OCT 2001) of 52.219-9.

[ ](iv) Alternate III (JUL 2010) of 52.219-9.

[ ](16) 52.219-13, Notice of Set-Aside of Orders (NOV 2011) (15 U.S.C. 644(r)).

[ ](17) 52.219-14, Limitations on Subcontracting (NOV 2011) (15 U.S.C. 637(a)(14)).

[ ](18) 52.219-16, Liquidated Damages--Subcontracting Plan (JAN 1999) (15 U.S.C. 637(d)(4)(F)(i)).

[ ](19)(i) 52.219-23, Notice of Price Evaluation Adjustment for Small Disadvantaged Business Concerns (OCT 2008) (10 U.S.C. 2323)(if the offeror elects to waive the adjustment, it shall so indicate in its offer.)

[ ](ii) Alternate I (JUN 2003) of 52.219-23.

[ ](20) 52.219-25, Small Disadvantaged Business Participation Program--Disadvantaged Status and Reporting (DEC 2010) (Pub. L. 103-355, section 7102, and 10 U.S.C. 2323).

[ ](21) 52.219-26, Small Disadvantaged Business Participation Program--Incentive Subcontracting (OCT 2000) (Pub. L. 103-355, section 7102, and 10 U.S.C. 2323).

[ ](22) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (NOV 2011) (15 U.S.C. 657f).

[ ](23) 52.219-28, Post Award Small Business Program Rerepresentation (APR 2009) (15 U.S.C. 632(a)(2)).

[ ](24) 52.219-29, Notice of Set-Aside for Economically Disadvantaged Women-Owned Small Business Concerns (NOV 2011).

[ ](25) 52.219-30, Notice of Set-Aside for Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (NOV 2011).

[ ](26) 52.222-3, Convict Labor (JUN 2003) (E.O. 11755).

[ ](27) 52.222-19, Child Labor--Cooperation with Authorities and Remedies (JUL 2010) (E.O. 13126).

[X ](28) 52.222-21, Prohibition of Segregated Facilities (FEB 1999).

[X ](29) 52.222-26, Equal Opportunity (MAR 2007) (E.O. 11246).

[ ](30) 52.222-35, Equal Opportunity for Veterans (SEP 2010) (38 U.S.C. 4212).

[ ](31) 52.222-36, Affirmative Action for Workers with Disabilities (OCT 2010) (29 U.S.C. 793).

[ ](32) 52.222-37, Employment Reports on Veterans (SEP 2010) (38 U.S.C. 4212).

[ ](33) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496).

[X ](34) 52.222-54, Employment Eligibility Verification (JAN 2009). (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

[ ](35)(i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA-Designated Items (MAY 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

[ ](ii) Alternate I (MAY 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

[ ](36) 52.223-15, Energy Efficiency in Energy-Consuming Products (DEC 2007) (42 U.S.C. 8259b).

[ ](37)(i) 52.223-16, IEEE 1680 Standard for the Environmental Assessment of Personal Computer Products (DEC 2007) (E.O. 13423).

[ ](ii) Alternate I (DEC 2007) of 52.223-16.

[ ](38) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (AUG 2011). (E.O. 13513).

[ ](39) 52.225-1, Buy American Act - Supplies (FEB 2009) (41 U.S.C. 10a-10d).

[ ](40)(i) 52.225-3, Buy American Act--Free Trade Agreements--Israeli Trade Act (JUN 2009) (41 U.S.C. 10a-10d, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, Pub. L. 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, and 110-138).

[ ](ii) Alternate I (JAN 2004) of 52.225-3.

[ ](iii) Alternate II (JAN 2004) of 52.225-3.

[ ](41) 52.225-5, Trade Agreements (NOV 2011) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

[ ](42) 52.225-13, Restrictions on Certain Foreign Purchases (JUN 2008) (E.O.'s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

[ ](43) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (NOV 2007) (42 U.S.C. 5150).

[ ](44) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (NOV 2007) (42 U.S.C. 5150).

[ ](45) 52.232-29, Terms for Financing of Purchases of Commercial Items (FEB 2002) (41 U.S.C. 255(f), 10 U.S.C. 2307(f)).

[ ](46) 52.232-30, Installment Payments for Commercial Items (OCT 1995) (41 U.S.C. 255(f), 10 U.S.C. 2307(f)).

[X ](47) 52.232-33, Payment by Electronic Funds Transfer - Central Contractor Registration (OCT 2003) (31 U.S.C. 3332).

[ ](48) 52.232-34, Payment by Electronic Funds Transfer - Other than Central Contractor Registration (MAY 1999) (31 U.S.C. 3332).

[ ](49) 52.232-36, Payment by Third Party (FEB 2010) (31 U.S.C. 3332).

[ ](50) 52.239-1, Privacy or Security Safeguards (AUG 1996) (5 U.S.C. 552a).

[ ](51)(i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (FEB 2006) (46 U.S.C. Appx 1241(b) and 10 U.S.C. 2631).

[ ](ii) Alternate I (APR 2003) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items: (Contracting Officer check as appropriate.)

[ ](1) 52.222-41, Service Contract Act of 1965 (NOV 2007) (41 U.S.C. 351, et seq.).

[ ](2) 52.222-42, Statement of Equivalent Rates for Federal Hires (MAY 1989) (29 U.S.C. 206 and 41 U.S.C. 351, et seq.).

[ ](3) 52.222-43, Fair Labor Standards Act and Service Contract Act--Price Adjustment (Multiple Year and Option Contracts) (SEP 2009) (29 U.S.C. 206 and 41 U.S.C. 351, et seq.).

[ ](4) 52.222-44, Fair Labor Standards Act and Service Contract Act--Price Adjustment (SEP 2009) (29 U.S.C. 206 and 41 U.S.C. 351, et seq.).

[ ](5) 52.222-51, Exemption from Application of the Service Contract Act to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (NOV 2007) (41 U.S.C. 351, et seq.).

[ ](6) 52.222-53, Exemption from Application of the Service Contract Act to Contracts for Certain Services--Requirements (FEB 2009) (41 U.S.C. 351, et seq.).

[ ](7) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (MAR 2009) (Pub. L. 110-247).

[ ](8) 52.237-11, Accepting and Dispensing of $1 Coin (SEP 2008) (31 U.S.C. 5112(p)(1)).

(d) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, and does not contain the clause at 52.215-2, Audit and Records - Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor's directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR Subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e)(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1) in a subcontract for commercial items. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause--

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (APR 2010) (Pub. L. 110-252, Title VI, Chapter 1 (41 U.S.C. 251 note)).

(ii) 52.219-8, Utilization of Small Business Concerns (DEC 2010) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds $650,000 ($1.5 million for construction of any public facility), the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(iii) (Reserved)

(iv) 52.222-26, Equal Opportunity (MAR 2007) (E.O. 11246).

(v) 52.222-35, Equal Opportunity for Veterans (SEP 2010) (38 U.S.C. 4212).

(vi) 52.222-36, Affirmative Action for Workers with Disabilities (OCT 2010) (29 U.S.C. 793).

(vii) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(viii) 52.222-41, Service Contract Act of 1965 (NOV 2007) (41 U.S.C. 351, et seq.).

(ix) 52.222-50, Combating Trafficking in Persons (FEB 2009) (22 U.S.C. 7104(g)).

Alternate I (AUG 2007) of 52.222-50 (22 U.S.C. 7104(g)).

(x) 52.222-51, Exemption from Application of the Service Contract Act to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (NOV 2007) (41 U.S.C. 351, et seq.).

(xi) 52.222-53, Exemption from Application of the Service Contract Act to Contracts for Certain Services-Requirements (FEB 2009)(41 U.S.C. 351, et seq.).

(xii) 52.222-54, Employment Eligibility Verification (JAN 2009).

(xiii) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (MAR 2009) (Pub. L. 110-247). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xiv) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (FEB 2006) (46 U.S.C. Appx 1241(b) and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the contractor may include in its subcontracts for commercial items a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of clause)

USSS 3052.204-90, Unauthorized Use of the U.S. Secret Service Name.

In accordance with 18 U.S.C. 709, any contractor, except with the written permission of the Director of the U.S. Secret Service, who knowingly uses the words "Secret Service", "Secret Service Uniformed Division", "U.S.S.S.", "U.D." or any colorable imitation or such words or initials, in connection with or as a part of any advertisement, circular, book, pamphlet or other publication, play, motion picture, broadcast, telecast, other production, product or item, in a manner reasonably calculated to convey the impression that such advertisement, circular, book, pamphlet or other publication, product, or item, is approved, endorsed, or authorized by or by associated in any manner with, the U.S. Secret Service or the U.S. Secret Service Uniformed Division shall be punishable as follows: a corporation, partnership, business trust, association, or other business entity, by a fine under this title; an officer or member thereof participating or knowingly acquiescing in such violation or any individual violating this section, by a fine under this title or imprisonment for not more than one year, or both.

(End of clause)

52.225-25 Prohibition on Contracting with Entities Engaging in Sanctioned Activities Relating to Iran--Representation and Certification. (NOV 2011)