N65236-16-R-0032 Cyber Red Team Industry Day Presentation.pdf

Space and Naval Warfare Systems Center Atlantic

Pre-Acquisition Planning Industry Day

SPAWARSYSCEN Atlantic Cyber Red Team and Operational Test Support Single Award Contract (SAC)

N65236-16-R-0032

April 12, 2018

Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018). 1

Agenda

0700 Check-in 0800 Opening Remarks 0805 Cyber Red Team and Operational Test Support

(N65236-16-R-0032) Overview – Background / Scope of Work 0830 Cyber Red Team Overview – Contracts 0845 Break 0915 Question and Answer Session 0945 Adjourn

Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

Purpose

▼ The purpose of this Industry Day is to provide interested offerors with:

An introduction to key players involved in this acquisition.

Insight into SPAWARSYSCEN Atlantic Cyber Red Team requirements and how they will support the Command.

Specific information on the anticipated contract requirements; including programs and platforms supported.

To promote a common understanding of the procurement requirements, anticipated solicitation terms and conditions and draft evaluation criteria.

An opportunity to network with the Government’s contracts and technical team.

Ability to ask questions and provide feedback to the Government. Our goal to make this Industry engagement more efficient and effective in acquisition planning and execution.

Introduction and Administrative Notes

▼ This is an Unclassified briefing.

▼ Questions are encouraged! Please submit questions in writing using the white 3 x 5 cards provided. This will help ensure a non-attributional record and also provide us with accurate minutes of the conference.

▼ The last portion of the agenda will address questions and answers. We will attempt to answer as many questions as possible during the allotted question and answer period. This is not a forum for open discussions.

▼ A written copy of questions and answers (along with copies of the slides and any other info) will be posted as soon as possible on the SPAWARSYSCEN Atlantic e-Commerce website: https://e-commerce.sscno.nmci.navy.mil.

REMINDER: Government’s final position on this requirement will be in WRITING https://e-commerce.sscno.nmci.navy.mil/

Contract Strategy General Overview

▼ Recent developments:

Market Research conducted via e-commerce website/FBO: Posted 18 May 17 closed on 1 June 17.

Based on Market Research, procurement will be set aside for Service-

Disabled Veteran-Owned Small Businesses (SDVOSBs).

Source Selection Plan in process.

Pre-solicitation draft RFP in process.

SPAWARSYSCEN Atlantic Red Team Service Area Test and Evaluation Service Center

SPAWARSYSCEN Atlantic Cyber Red Team and Operational Test Support

Contracting Players

Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

▼ Contracts POCs:

2.0 Contracts Lead | PCO: Dan Vola

− E-mail: daniel.vola@navy.mil

Contract Specialist: Elisha Kidwell − E-mail: elisha.kidwell@navy.mil mailto:daniel.vola@navy.mil mailto:elisha.kidwell@navy.mil

Definition of DoD Cyber Red Team

Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

▼ A DoD Cyber Red Team is a group of DoD personnel (military, civilian, contractor) authorized and organized to emulate a potential adversary’s exploitation or attack capabilities against a targeted mission or capability. DoD Cyber Red Teams operate to identify exposed information and vulnerabilities of the target’s security posture; support information assurance readiness; create a degraded, disrupted, or denied cyber environment; develop the skills and exercise capabilities of cyber forces; participate in evaluation of Computer Network Defense Service Providers (CNDSPs) and its subscribers;

and provide Protect Services for CNDSPs or support OPSEC surveys. A DoD Cyber Red Team achieves its purpose by conducting cyberspace operations and limited supporting operations in the physical domains. -- Definition from the Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.03 Enclosure A.

▼ Nine teams currently accredited under CJCSM 6510.03:

• SPAWARSYSCEN Atlantic • Navy Red Team

• National Security Agency • Army Red Team

• Defense Information Systems Agency • 177th Information Warfare Aggressor Squadron – USAF

• Army Threat Systems Management Office • 57th Information Warfare Aggressor Squadron – USAF

• Marine Corps Red Team

Red Team

Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

▼ One of 9 DoD cyber Red Teams certified under CJCSM 6510.03 by National Security Agency and accredited by U.S. Cyber Command (USCYBERCOM).

Accredited in July 2014 and re-accredited in 2017.

▼ Certified to perform Remote, Local (Onsite), Long-Term Persistence, User-Driven / Phishing, and Wireless cyber red team operations.

Eventually adding Close Access (Physical Access) operations.

▼ Established in 2011 to meet SPAWARSYSCEN Atlantic Cybersecurity Service Provider (CSSP) External Assessment requirements.

Assess the Cybersecurity / Information Assurance programs for SPAWARSYSCEN Atlantic

CSSP’s subscribers & assess the performance of SPAWARSYSCEN Atlantic CSSP’s service delivery.

▼ Performs adversarial cyber functions for Developmental Testing & Operational Testing in support of major acquisitions; Penetration Tests; Secure Software Code Review.

Includes traditional Transmission Control Protocol/Internet Protocol (TCP/IP) based systems and

“other” systems.

Red Team Service Area Overview

Red Team Service Lead

Red Team Operations Teams Software Development Team Infrastructure Support Team Program Support Team

Red Team Technical Lead

Operational Test Coordinator

Developmental Test Coordinator

Infrastructure Support

Infrastructure Support

Infrastructure Support

Tool Developer

Tool Developer

Tool Developer

Program Support

Program Support

Program Support

Red Team Operator

Red Team Operator

Red Team Operator

Contract will support additional resources in these blocks below.

Red Team Roles

Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

▼ Red Team Service Center Lead: ensures cost, schedule, and performance commitments are maintained in keeping with the Cyber Red Team Accreditation

▼ Technical Lead: ensures the accuracy and quality of all deliverables ▼ Developmental Test Coordinator: facilitates planning and execution of all Developmental

Test events ▼ Operational Test Coordinator: facilitates planning and execution of all Operational Test events ▼ Program Support: ensures processes and procedures are functioning in accordance with the Cyber Red Team Accreditation (contractor Subject Matter Expert (SME) support required) ▼ Red Team Operators: provide the knowledge, skills, and abilities necessary to execute assessments and operations (contractor SME support required) ▼ Software Tool Development role: ensures software-based capabilities enable Red Team

Operations within prescribed parameters (contractor SME support required) ▼ Infrastructure Support: role ensures requisite infrastructure is available and functioning within prescribed parameters (contractor SME support required)

Requirements Review

Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

▼ Teams will be a mix of government and contractor resources.

▼ The Government requires contractor SME support for the existing accredited DoD

Cyber Red team in the following roles:

Red Team operators Software tool developers Program support / Accreditation support analysts Infrastructure support engineers/technicians

▼ Resourcing under this contract will provide the following support in the realm of cyber operations:

Operational Test requirements (e.g. CVPA and Adversarial Assessments) Developmental Testing (e.g. cyber table tops, testing within cyber ranges) Opposing Forces (OPFOR) for cyber exercises Assessments of CSSPs Purple Team interaction with CSSPs

Requirements Review (continued)

Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

▼ Operations will occur against a variety of system types:

Commercial-Off-the-Shelf (COTS) Information Technology - (Windows, Linux, etc.)

Embedded systems - (Medical devices, MILSTD 1553 bus, Vehicle controller area network bus) Industrial Control Systems (ICS) / Supervisory Control and Data Acquisition (SCADA) –

HVAC controllers, power meter networks, building access control ▼ Operations will utilize the following methods for which SPAWARSYSCEN Atlantic is certified: local, remote, user driven, persistence and wireless.

▼ Contractor will support development of new and refinement of existing cyber security tools to be used during by operators during operations. Tools will include:

Compromised infrastructure management system Remote Access Toolkits (RATs) Zero day and other vulnerability exploits

Requirements Review (continued)

Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

▼ The following programming languages are or could be in use by the Red Team:

Python, Ruby, PHP, ASP Powershell, .net, F#, Go, Rust, Javascript C, C++, Visual Basic, Java, Assembly

▼ The contactor will be expected to support execution of scripted “playbooks” against CSSP infrastructure for the purposes of validating CSSP detection/response capabilities (people, processes and technology) – Referred to as purple teaming.

▼ The contractor shall support certification activities related to maintaining the DoD Cyber Red Team accreditation by providing expertise in creating/maintaining/implementing processes and procedures to support/maintain certification in accordance with the DoD Cyber Red Team Evaluators Scoring Metrics (ESMs).

Places of Performance & Travel

▼ Primary Places of Performance SPAWARSYSCEN Atlantic in Charleston, SC

− If additional locations are anticipated, they will be identified at the task order level.

▼ Travel Conduct local assessments and operations when remote execution options are not possible.

Trips in general will last one to two weeks.

Locations: Worldwide

− Additional locations will be identified at the task order level.

16Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

Contract Type: • Performance-Based Services

• Indefinite Delivery/Indefinite Quantity (IDIQ)

All services authorized and funded by placement of delivery/task orders

• Single Award Contract (SAC) Pricing Arrangement: • Cost Plus Fixed Fee (CPFF) – Contractors must have approved accounting system Period of Performance: • Five-year base ordering period

• One (1) Six-month Option Ordering Period (FAR 52.217-8, Option to Extend Services)

Target Solicitation/Award Dates: • Solicitation Issued – Anticipated 3nd QTR FY18

• Proposals Received – Anticipated 3rd QTR FY18

• Contract Award – Anticipated 3rd QTR FY19

Competitive Environment: • Small Business Set-Aside for SDVOSBs

NAICS: • 541519 - Other Computer Related Services, Size Standard: $27.5M Security Access Requirements: • Most Personnel must possess a Secret clearance some require up to

Top Secret/Sensitive Compartmented Information

• No safeguarding is required

Solicitation Overview

NAICS Code Selection

▼ Based upon the specific Cyber Security Scope of work for this requirement, the appropriate Product Service Code (PSC) for this requirement is D310 - IT and Telecom – Cyber Security and Data Backup.

Defense Procurement and Acquisition Policy (DPAP) PSC Selection Tool cross references PSC D310 to North American Industry Classification System (NAICS) 541519 - Other Computer Related Services. https://psctool.us/.

▼ Based upon the specific Cyber Security scope of work, the most appropriate and corresponding applicable NAICS code for this requirement is 541519 - Other Computer Related Services.

▼ Based upon market research conducted to date and the quantity of viable SDVOSB sources capable of performing the Cyber Red Team requirements, the Government will obtain optimal competition under NAICS 541519.

https://psctool.us/

NAICS Code Selection (continued)

19Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

▼ Factor A – Red Team Operations Capability Subfactor A1: Cyber Red Team Support Subfactor A2: Operational Test Support

▼ Factor B – Red Team Support Capability Element B1: Cyber Red Team Tools Support Element B2: Purple Team Support Element B3: Cyber Red Team Accreditation Support All Factor A and Factor B contract specific reference data responses shall specify which Subfactor(s) and Subfactor Element(s) (i.e. Element B1, Element B2, Element B3) their contract narrative reference is addressing.

▼ Factor C – Software Development Plan ▼ Factor D – Past Performance ▼ Factor E – Cost

Source Selection – Draft Evaluation Factors

20Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

▼ Factors’ Order of Relative Importance Factor A (Red Team Operations Capability) is significantly more important than

Factor B (Red Team Support Capability).

− Subfactor A1 (Cyber Red Team Support) is more important than Subfactor

A2 (Operational Test Support). Subfactors A1 and A2 will be rolled up into an overall Factor A technical rating.

Factors A and B, when combined, are significantly more important than Factor E (Cost).

Factor C (Software Development Plan) and Factor D (Past Performance) will be evaluated on an Acceptable/Unacceptable basis.

NOTE: A proposal that receives a rating of “Unacceptable” in any non-cost factor will result in the entire proposal being determined "Unacceptable" and ineligible for award.

Source Selection – Draft Factors’ Order of Relative Importance

21Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

Factor A: Red Team Operations Capability

SubFactor A1: Cyber Red Team Support The Government will evaluate the offeror’s submission of at least two examples of their experience supporting DoD Cyber Red Teams. Examples shall include all of the following information:

• Identification of the type of assessment performed (e.g. local, remote, user drive, persistence, wireless or close access)

• Description of the methodology used for assessment planning

• Description of coordination activities undertaken

• Summary of the assessment execution

• Summary of the resultant deliverables provided before, during and after the conclusion of the assessment

• Identification of the specific accredited DoD Cyber Red Team(s) supported

-- The Government considers examples of multiple types of assessments to be more valuable than multiple examples of the same type of assessment.

SubFactor A2: Operational Test Support The Government will evaluate the offeror’s submission of at least one example of their experience supporting Cooperative Vulnerability Penetration Assessments AND at least one example of their experience supporting Adversarial Assessments as defined by Director, Operational Test and Evaluation (DOT&E) memo titled “Procedures for Operational Test and Evaluation of Cybersecurity in Acquisition Programs” dated 3 Apr 2018. Examples shall include all of the following information:

• Type of assessment performed (either CVPA or AA)

• The name of program supported and identify the lead Operational Test Agency involved

• Type of system under test (e.g. embedded system, commodity information technology, industrial controls system)

• Characteristics of the system, highlighting anything that is special or unique that increased the complexity of the testing

• Identification of at least one test case involving the system under test that was judged by the DOT&E as meeting test adequacy

-- The Government considers examples of multiple types of systems under test to be more valuable than multiple examples of testing of the same types of systems. For example, identification of complex test cases are considered more valuable than basic ones.

Factor A: Red Team Operations Capability

22Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

Factor B: Red Team Support Capability

Element B1: Cyber Red Team Tools Support The Government will evaluate the offeror’s submission of at least three examples of cyber tools developed in support of accredited DoD Cyber Red Teams. Examples shall include all of the following information:

• Identification of the specific accredited DoD Cyber Red Team(s) supported by the tool if for classification reasons the offeror can not divulge which Red Team(s) use their developed tools they can at least describe how many Red Team(s) used it and for how long

• A brief description of the tool and its function

• A description of how the tool is used to support Cyber Red teaming

-- The Government considers examples of multiple types of tools performing different functions to be more valuable than multiple examples of the same type of tool.

Element B2: Purple Team Support The Government will evaluate the offeror’s submission of at least one example of their experience supporting purple teaming between accredited DoD Cybersecurity Service Providers (CSSPs) and DoD Cyber Red teams. Examples shall include all of the following information:

• Identification of the specific accredited DoD Cyber Red Team and Cybersecurity Service Provider involved.

• An overview of the specific test case (include what was tested: people, processes or technology)

• A description of how the red team established deconfliction processes and procedures and subsequently executed the test

• A description of the result of the testing. The description shall include, if applicable, any lessons learned or resultant changes to the cybersecurity service provider which may include changes to technology, processes or personnel.

-- The Government considers examples of purple team testing resulting in lessons learned by the CSSP and/or resultant changes in the area of personnel, processes or technology by the CSSP to be more valuable than testing that results in no lessons learned or changes.

Factor B: Red Team Support Capability

23Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

Factor B: Red Team Support Capability (continued)

Element B3: Cyber Red Team Accreditation Support The Government will evaluate the offerors submission of at least three examples of experience assisting DoD Cyber Red teams that ultimately resulted in successful certification and accreditation for the DoD Cyber Red Team utilizing Red Team Evaluator Scoring Metrics referenced in CJCSM 6510.03. Examples shall include all of the following:

• Identification of the specific accredited DoD Cyber Red Team(s) supported

• Specific metric evaluated and offeror's recommendations for changes to improve the Red Team's compliance with the metric.

Examples of recommendations can include creation of new processes or changes to existing processes.

--Identification of examples where Red Team certifiers highlighted an offeror's recommendations on a particular metric as a best practice are considered valuable to the Government.

Factor B: Red Team Support Capability (continued)

Corporate Experience reference data for any company, division, subsidiary, etc. that is not included in the technical and cost/price proposal for this contract effort will not be considered. If an offeror fails to included the minimum number of current and relevant contract references for the proposed team to perform Factors A and B, a rating of “Unacceptable” will be assigned, the proposal will be rejected, and the offeror will not be considered for contract award.

Basis for Award

▼ “Best Value” utilizing tradeoff source selection process among cost and non-cost factors.

Evaluation factors other than cost, when combined, are significantly more important than cost/price; however, cost/price is an important factor and should be considered when preparing proposals.

DoD Source Selection Procedures

▼ The objective of the evaluation is to make a source selection decision based on any strengths, weaknesses, significant weaknesses, and deficiencies identified in the offeror’s proposal. See the DoD Source Selection Procedures Guide at:

http://www.acq.osd.mil/dpap/policy/policyvault/USA004370-14-DPAP.pdf http://www.acq.osd.mil/dpap/policy/policyvault/USA004370-14-DPAP.pdf

Break

▼ Reminder - Please submit your questions if you have not already done so.

▼ We will break until 0915.

▼ The Question and Answer Session will commence at that time.

Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

Please note that all questions and the official answers will be posted on e-Commerce

27Statement A: Approved for Public Release. Distribution is unlimited (12 April 2018).

▼ Thank you for attending!

▼ A compilation of all questions and answers discussed today and any questions we may have been unable to address will be posted on the SPAWARSYSCEN Atlantic e-Commerce website: https://e-commerce.sscno.nmci.navy.mil.

Along with copies of the slides and any other info.

▼ For questions, please forward to: elisha.kidwell@navy.mil.

REMINDER: Government’s final position on this requirement will be in WRITING

Closing Remarks https://e-commerce.sscno.nmci.navy.mil/ mailto:elisha.kidwell@navy.mil