FBO_IDS_Refresh_Sole_Make_and_Model_Justification_FBO.docx

Sole Make and Model Justification Intrusion Detection System Hardware, Licenses, and Support Services

PR: 1300503015

BACKGROUND/REQUIREMENT:

The Networks and Communication Branch (Code 10412) of the Naval Undersea Warfare Center, Division Newport (NUWCDIVNPT) operates computer network enclaves which must be defended against intrusion, unauthorized activity, and loss/theft of network resources. These enclaves include the unclassified Research, Development, Testing, and Evaluation (RDT&E) Unclassified Core Infrastructure which is externally connected via the Defense Research and Engineering Network (DREN); the Secure NUWCNET environment which is externally connected via the Secure Internet Protocol Network (SIPRNet); and the newly-activated Secure DREN (SDREN) environment which connects via the wide-area network of the same name. [Note: The current procurement is for the unclassified RDT&E and SNUWCNET environments only, as the SDREN environment is sufficiently provisioned.] One of the critical security controls mandated by the Defense Information Systems Agency (DISA) Network Infrastructure Security Technical Implementation Guide (STIG) and Network Policy STIG for these enclaves is a Network Intrusion Detection System (IDS). This “Sole Make and Model Justification” is to replace the existing and IA-compliant NIDS solution due to the vendor’s normal end-of-sale (EOS), and end-of-support lifecycles (EOL) for this equipment. Without this procurement NUWCDIVNPT will fall out of compliance with critical IA mandates on the affected enclaves, putting us at risk for loss of the Authorization to Operate (ATO) these networks.

Hardware, licenses and support services purchased under this Sole Make and Model Justification will be used to replace previous models currently utilized in the NUWCDIVNPT RDT&E Classified and Unclassified Network Infrastructure.

SOLE MAKE/MODEL JUSTIFICATION WITH MINIMUM REQUIREMENTS:

After careful investigation and analysis of all alternatives, Code 10412 has determined that the most cost-effective and operationally secure option to remain in compliance with STIG and IA authorities’ requirements for NIDS is to perform a direct replacement to our existing NIDS systems which eliminates the risk posed by the EOL of the current systems.

Replacement of current IDS equipment is required because after the manufacturer’s EOL date of 9 Oct 15 no support will be available. This includes software and configuration updates which are necessary for STIG compliance and the continued effective and safe operation of the devices. Since there is no direct “upgrade” to the existing equipment, the Parts List below reflects this branch’s attempt to engineer a replacement solution which best replicates the capabilities of the current environment while restraining cost.

A primary reason for this Sole Make and Model Justification is to achieve economies of scale by continuing to use Cisco’s technology ecosystem. NUWCDIVNPT’s use of Cisco will continue in the SDREN environment through at least that equipment’s EOL date in 2020. All current work processes and standard operating procedures are predicated upon the Cisco ecosystem’s methodologies and requirements. For example, when Code 10412 is directed by the Information Assurance Officer to configure the IDS to detect a certain type of new threat activity, our personnel will be able to develop a configuration once which is applicable in all environments. This effort would be at least doubled if the homogeneity of the IDS solutions were broken. Similarly, the long and manual-labor-intensive process of importing the latest software updates to the IDS several times per week is performed just once; then safely conducted to the other environments. This effort would also at least double in a heterogeneous environment.

Choosing to remain within the Cisco ecosystem means that NUWCDIVNPT may avoid the costs associated with integration of new technologies. These would at least include additional costs for personnel training and consulting by subject matter experts (SME) on the new system. Should a different ecosystem be procured, nearly all existing technical and administrative processes will have to be re-written and harmonized with the remaining Cisco environment to ensure no new vulnerabilities are introduced by the changes. This could be especially difficult where special interoperability agreements have been arranged with other branches and codes, thus is likely to result in some downtime and loss of IDS services during the migration. And while not quantifiable, there is great value in our long experience with the Cisco ecosystem which increases personnel and technical leadership efficiency and effectiveness across all environments.

The economies of scale extend beyond NUWCDIVNPT. The Division’s mandated Computer Network Defense Service Provider (CNDSP) is the Naval Cyber Defense Operations Command (NCDOC), which has recently migrated away from competing IDS ecosystems to the Cisco platform for the entire US Navy. Cisco was also named a “leader” in the most recent Gartner Magic Quadrant report for network IDS (5 July 2012), and is the most-deployed standalone IDS in the world today. As it is based on the SNORT open source network IDS, we enjoy advanced features that do not exist in other IDS systems. For example, NUWCDIVNPT uses some of these underlying open source capabilities to provide a basic network performance management (NPM) system simultaneously with the security functions. This meets another branch requirement at no additional cost, which would not be possible with a change in ecosystems.

DISSIMILAR MAKE/MODEL COST IMPLICATIONS AND OTHER IMPACTS:

The costs to source a different IDS solution provider would be excessively burdensome to the Networks and Communication Branch. In addition the costs for the new hardware a new ecosystem would necessitate retraining of key personnel leading to at least $20,000 in direct costs to the government in this fiscal year so that users could be trained before the EOL date of the existing infrastructure. Integrating a new system would also require the expert consulting support, for a further cost of another $20,000. The indirect costs of reintegrating IDS and redeveloping policies and procedures are estimated at 480 man-hours of effort for IDS administrators, network engineers, and IA personnel. This estimate is probably low as we cannot anticipate the added complexities of deconflicting divergent approaches in our environments. A changeover would also impact NUWCDIVNPT’s ability to defend its network resources because effectiveness and efficiency will suffer from the loss of personnel proficiencies gained through experience with the existing ecosystem. Our Computer Network Defense (CND) staff will go from being highly experienced experts with the current IDS system to novices with minimal training overnight. Even if a successful integration of a different IDS ecosystem were performed, the recurring costs of supporting two distinct IDS environments would approximately double the routine labor overhead of ongoing maintenance. Furthermore, responsiveness to emerging threats will be reduced as CND personnel will have to develop two completely different methods, rules, and configurations in time-sensitive situations for the heterogeneous environments.

CONCLUSION:

The devices identified in this procurement will be used to replace End of Life (EOL) equipment on the RDT&E network infrastructure. Without procuring these devices, the maintenance, and troubleshooting with vendor support will not be possible. This will eventually lead to a non-IA compliant network with a potential consequence of a shutdown.

Therefore, based on the above, it is requested that a sole make and model contract be awarded for this purchase.

VALUE ADDED RESELLERS:

Although Cisco is the sole manufacturer, Cisco products and maintenance support can be purchased from authorized/certified value-added resellers. In order to procure Cisco equipment, the vendor must be certified to the level of Premier, Silver, or Gold Cisco authorized partners (list of available partners: www.cisco.com/go/partnerlocator).