ID08200DNS RFI - Protective Domain Name Service (DNS) Recursive Resolver.pdf

Request for Information (RFI) – Protective Domain Name Service (DNS) Resolver Service

Agency: Cybersecurity and Infrastructure Security Agency (CISA)

Market Research Agency: General Services Administration (GSA), Federal Acquisition Service (FAS), Region 8

Notice Type: Request for Information

NAICS: 541512 Computer Systems Design Services

GSA Reference: ID08200DNS Posted Date: May 4, 2020

GENERAL INFORMATION:

The General Services Administration (GSA), Federal Acquisition Service (FAS), Region 8 is issuing this Request for Information (RFI) on behalf of the Cybersecurity and Infrastructure Security Agency (CISA).

RFI OBJECTIVE:

The purpose of this RFI is to assist the Government in conducting market research focused on identifying potential vendors as well as to gain technical feedback from industry on capabilities and architectures that would provide a protective Domain Name Service (DNS) recursive resolver for U. S.-based government organizations. This information will be used for market research only. The Government is not obligated to release a future solicitation based on this market research.

BACKGROUND:

CISA is interested in offering a DNS recursive resolver service to protect against cybersecurity threats.

This service will be managed by CISA (Customer) and executed by a service provider (Provider). The intended users of the service will be federal agencies and potentially other levels of State, local, territorial, and tribal governments (Organizations).

PURPOSE:

CISA administers the implementation of information security policies for Federal civilian Executive Branch agencies, which includes deploying technologies to help defend these agencies. To minimize the effects of ransomware, phishing, botnets, and malware campaigns while enhancing our insight into these threats, CISA seeks to offer a policy-implementing Domain Name System (DNS) recursive resolver1 service that is executed by a service provider (Provider). The intended users of the service (Organizations) will be Executive Branch agencies, but we are interested in eventually offering the service to other U.S.-based government organizations, including other branches of the U.S. Government, and State, local, territorial, and tribal governments.

REQUIREMENT OBJECTIVES:

1. Protective DNS resolver service: A DNS resolver will provide general name resolution services (plaintext and encrypted DNS resolution; e.g., DNS over TLS and DNS over HTTPS, in both IPv4 and

1 See https://tools.ietf.org/html/rfc8499#page-21 https://tools.ietf.org/html/rfc8499#page-21

IPv6 address spaces) that overrides responses from public DNS records that trusted sources identify as harmful.

• The resolver’s purpose is to protect information and information systems from cybersecurity threats; it will not block content based solely on taste or organizational policy (e.g., pornography, gambling, social media, etc.).

• Filtering actions (e.g. allow, block, alert) will source from commercial, public, and government feeds and static lists (allow lists and block lists). Lists should be able to be dynamically generated based upon a defined logic. For instance, CISA may want to block recently registered domains for a period of time, or allow list currently registered .gov domains.

• CISA expects to influence which feeds are included and to manage various static lists, which should be easily updating (via application programming interface [API] web application). Filtering decisions should be reflected in the resolver’s responses in near-real time for users. Only CISA, not individual, downstream users or organizations, are expected to make global filtering decisions.

• The service is anticipated to be primarily used as an upstream resolver for individual Organization networks. CISA does not expect or seek central operational or policy control over the devices that may use the resolver, but we are interested in approaches that would protect mobile and roaming devices without a requirement for those devices to VPN into their home network. The approach needs to support device attribution to the parent Organization and limiting use of the resolver solely to Organizations that CISA authorizes to use the service.

• It is expected filtering will be done through DNS Response Policy Zones, or similar capability.

• The service must have high availability (e.g., anycast) and be resilient to attack (e.g., via a distributed denial of service). The internet-accessible hostname(s) of the service will use a CISA-managed .gov domain.

• At the initial operating capacity, the resolver will be expected to serve approximately 5 Organizations, with the total user base not to exceed 150,000 end-users (or approximately 450 million queries per day based on estimated average 3,000 queries per user per day).

The resolver is expected to scale to all Executive Branch agencies within 2 years of service, and scale to approximately five times that load to cover interested Organizations within 3 years of service.

2. Data warehouse: DNS queries will be logged and stored in the short term (e.g., 30 days) by the provider and in the long term in a data warehouse, which may be built and managed by the Provider or a third party.

• Logs will be stored efficiently and include, at a minimum, each field of the DNS query.

• The warehouse must be scalable. Stored data will be available for querying in near-real-time for a maximum period of time (e.g., one year).

3. Web application: The Provider will offer a web application to:

• Visually represent to CISA usage statistics and dashboards, provide alerts about domain blocking instances, enable analysis, and the updating of filtering lists.

• Allow Organizations to query their own DNS query history, including accompanying filtering adjudications. (This could also be made available via an API).

RFI RESPONSE:

Provide a narrative summary that addresses the objectives stated in this RFI and your capability to deliver the solution, including prior achievements. The Government welcomes feedback on the feasibility and utility of the stated objectives above.

The Government will only consider responses from industry partners which intend to do the work as a Prime contractor. Responses are required to include the following information:

CONTRACTOR INFORMATION:

□ Contractor Name and Address

□ DUNS Number and NAICS Code

□ Socio-economic status (HUBZone, Service-Disabled-Veteran-Owned, Woman- Owned, 8(a), Small Business, Large Business)

□ POC Phone and Email

□ Website URL

EXPERIENCE/CORPORATE CAPABILITIES:

1. Does your company have experience building and managing protective DNS resolver infrastructure and services that provide similar outcomes to those described in this RFI’s objectives?

a. Describe relevant implementations, including audience and scale.

b. Detail the approach your company has used during design, build, and service delivery, including challenges (e.g., scalability) you or your users encountered and how these were managed. Include any lessons learned that are applicable.

c. Describe your company’s ability to monitor and secure the technical infrastructure for a protective DNS resolver solution.

d. Describe your company’s support service capabilities (including dedicated help desk staff, capacity, limitations, etc.).

e. Describe your company’s ability to insulate a DNS resolver service against impact from any other customers (e.g., spikes in utilization, commingled log data).

2. Identify any existing Government contract vehicle (GWAC, Federal Supply Schedules, BPA, etc.)

your company currently holds that could support the protective DNS resolver service.

INFORMATION REQUESTED:

1. How will various threat intelligence feeds or lists (commercial, government) be processed to determine whether a domain resolves or not? How could CISA provide updates to those sources (accounting for submission methods and acceptable formats)?

2. What considerations should CISA take when modeling protective DNS performance and estimate costs, including any specific data points that should be used to formulate pricing estimates?

3. How should CISA model data volume and cost for a long-term data warehouse that stores DNS query data which is made it available for analysis? Are there any challenges that the CISA should considering when modeling data volume and cost?

a. CISA is also interested in the value of logging DNS responses in addition to queries, and how that would impact storage costs.

4. How could the resolver service protect mobile devices and cloud infrastructure directly (without forcing a VPN connection or allow listing Organization’s IP addresses), while maintaining the relationship between a given device and the parent Organization in logs?

5. How can the resolver be positioned relative to other resolvers, such as CISA’s EINSTEIN 3 Accelerated (E3A) that provides DNS sink holing based on classified information? (Note: the protective DNS resolver service is expected to be unclassified only.)

6. Identify any recommended technical performance standards or best current practices that are relevant to a protective DNS resolver solution?

7. Provide any additional technical information your company believes relevant to this RFI. For example, describe other DNS features (e.g. detection of DNS tunneling, hijacking, etc.) and other DNS services (e.g., hosted, authoritative DNS) you could offer.

8. Identify what is the recommended acquisition approach that the government should take in addressing this requirement.

CONTRACTOR NOTIFICATION:

This RFI is for information and planning purposes only, and does not constitute a RFQ, and is not to be construed as a commitment by the U. S. Government. No award will be made as a result of this RFI. All information is to be submitted at no cost or obligation to the Government. Any information that the Contractor considers proprietary should be clearly marked as such. All submissions become Government property and will not be returned, including any proprietary information. The Government may consider additional communications with submitting companies utilizing the contact information provided in the Corporate Overview to further the Government’s market research for the Protective Domain Name Service (DNS) Recursive Resolver.

• All responses are to use Times New Roman font, with a 12-point font, and one-inch margins, single spaced in all sections in Microsoft Word.

• Contractor Information section shall be no longer than 1 page in length.

• Response to questions should be no longer than 10 pages.

• All information submitted shall be UNCLASSIFIED.

• Any information that the Contractor considers proprietary should be clearly marked as such.

• All submissions become Government property and will not be returned, including any proprietary information.

Questions pertaining to this RFI should be submitted no later than 2:00pm ET on May 6, 2020 to Danny Hu at Daniel.Hu@gsa.gov and Diana Zoppi at Diana.zoppi@gsa.gov. All questions and answers will be added to this RFI announcement no later than COB May 11, 2020.

RFI responses shall be submitted no later than 2:00pm ET on May 22, 2020 via email to Danny Hu at Daniel.Hu@gsa.gov and Diana Zoppi at Diana.zoppi@gsa.gov.

Contractors who do not respond to this RFI are not excluded from any resulting solicitation(s).

mailto:Daniel.Hu@gsa.gov mailto:Daniel.Hu@gsa.gov