Sole_Make_Model_Justification_Redacted.pdf

SOLE MAKE/MODEL JUSTIFICATION

Secret Server Enterprise Password Management

PR#1300677369

BACKGROUND:

Naval Undersea Warfare Center Division, Newport (NUWCDIVNPT), Code 1041, currently has a requirement to renew Thycotic Software Secret Server Enterprise Password Management Software Maintenance. The previous order, N66604-17-P-0056, expires on 11 February 2018.

Compliance with Task Order (TASKORD) 14-0018 requires that management of local and domain user IDs must have the ability to perform the following:

1. Have the ability change EA/DA account passwords to a unique value never used before, and establish a process to change passwords at the required frequency.

2. Establish a process to periodically verify that there are no unaccounted for or otherwise inappropriate EA/DA accounts.

3. Establish account usage, Pass-the-Hash detection, and remote desktop logon detection to monitor for Pass-the-Hash activity on all domain joined platforms.

Thycotic Software Secret Server Enterprise Password Management Software meets these requirements and allows NUWCDIVNPT to become compliant with the criteria stated with in

TASKORD 14-0018.

Secret Server will be implemented in the following environments: RDTE classified and unclassified, Secure Defense Research and Engineering (SDREN) and Boundary 3 Community of Interest (B3COI) domains including Production, Development and De-Militarized Zone

(ZDMZ).

SOLE MAKE/MODEL JUSTIFICATION WITH MINIMUM REQUIREMENTS:

Secret Server Enterprise Password Management Software licenses and support maintenance, developed by Thycotic Software Ltd., is currently the only software solution on the Navy’s DON Application and Database Management System (DADMS) list of approved software that can be used to meet the criteria listed above. It is also the only Enterprise software that will meet NUWCDIVNPT functional and operational needs which are detailed in the table below:

Product Comparison Matrix:

Functional Requirement

Establish a process to change passwords at the required frequency Yes No No Establish a process to periodically verify that there are no unaccounted for or otherwise inappropriate EA/DA accounts Yes No No

Establish account usage, Pass-the-Hash detection, and remote desktop logon detection to monitor for Pass-the-Hash activity on all domain joined platforms

Yes

No

No

DADMS approval software Yes No No Randomization of local and domain account passwords Yes No No Retrieval of the randomized encrypted passwords via database Yes No No Ability to create a policy to set the frequency of the password change Yes No No

DISSIMILAR MAKE/MODEL COST IMPLICATIONS AND OTHER IMPACTS:

NUWCDIVNPT must comply with TASKORD 14-0018 which dictates the minimum requirements list above. Without procuring Thycotic Software Secret Server Enterprise Password Management Software Maintenance , NUWCDIVNPT will not be compliant with TASKORDER 14-0018 which will result in the shutdown and removal of these enterprise systems.

CONCLUSION:

NUWCDIVNPT Code 1041 must procure Thycotic Software Secret Server Enterprise Password Management Software license maintenance support (specific part number shown below) to be compliant with TASKORD 14-0018 which directly impacts all classified and unclassified systems.

Mfg. Part No. Part No. Description Qty.

HRT-TSS-3004 Thycotic Secret Server Annual Support 1yr Renewal 06

The required software licenses and support maintenance can be procured directly from Thycotic Software or from of its partners or resellers.