NDR Sources Sought Notice.pdf

1. BACKGROUND

The Office of Cyber Monitoring and Operations within the Department of State’s Bureau of

Diplomatic Security, Directorate of Cyber and Technology Security manages a comprehensive portfolio of cybersecurity tools deployed to secure the Department of State’s (DOS) networks and data. This document outlines the requirements supporting the technical replacement and maturation of the Enterprise Network Detection and Response.

2. SCOPE

2.1. Security Posture

2.1.1. The DOS Cyber Protection program requires the capability to monitor network traffic to rapidly detect, assess and act upon anomalous activity on the

Department’s networks. The ideal solution will baseline normal network activity, evaluate network packet metadata, and leverage threat intelligence to identify and escalate potential threat activity. The Department needs a solution that will leverage advances in Artificial Intelligence and Machine Learning to streamline threat detection and response actions.

2.2. Monitoring and Incident Response Responsibilities

2.2.1. The scope of the Department’s monitoring and incident response responsibilities encompasses a hosted environment (network) that includes but is not limited to: 1) on-prem Sensitive but Unclassified (SBU); 2) SBU Azure

Cloud environments, and 3) SBU AWS cloud environments. Various applications and services are hosted through multiple cloud service models such as IaaS, PaaS, and SaaS.

2.3. Scalable Capacity

2.3.1. In addition, the Department recognizes the need for any network detection and response capability to include a strategy and scalable capacity to monitor multiple disparate environments. These environments include: air-gapped networks; dedicated internet networks (DINS); Demilitarized Zones (DMZs) hosted domestically and overseas (not connected to the enterprise network); and multiple, distinct Cloud Service Providers (CSPs) such as Google Cloud, AWS

Commercial, AWS GovCloud, Azure Commercial, and Microsoft Azure

Government (MAG).

2.3.2. Contractor solutions shall not include managed service elements outside the scope of SaaS hosting. The contractor solution shall be turned over to the

Department for daily management and operations.

3. OBJECTIVES

The objectives of the solicitation for the refresh and maturation of the Department’s Intrusion

Detection System to a Network Detection and Response solution includes the following:

Functionality & Capabilities, Department System Integration, Services and Support, and

Solution Training.

4. FUNCTIONALITY & CAPABILITIES

The Functionality & Capabilities requirements define the minimum acceptable levels of operations and functionality that the Network Detection and Response (NDR) shall be required to meet, as defined by industry-standard criteria, federal policies, and anticipated future needs of the Department of State.

The contractor shall provide the functionality and capability listed below which includes but is not limited to the following:

Administrative Requirements:

4.1.SaaS and FedRamp Certified

4.1.1. Contractor solutions must be Cloud-hosted SaaS solutions and must be

FedRamp certified by time of contract award (tentatively NLT September

15).

4.2.Solution Management

4.2.1. Provide consolidated management capability allowing for centralized analysis, monitoring, reporting, configuration, policy assignment, and device management.

4.2.2. Ensure high availability of solution management (console resilience).

4.2.3. Implement role-based access controls (RBAC) supporting the assignment of administrators, users, and readers into hierarchical roles and/or groups with varying and customizable levels of access, permission, and management.

4.3. Logs

4.3.1. Provide capability to securely, automatically transmit to an external log management solution (ex. syslog server):

4.3.1.1. Authentication logs.

4.3.1.2. Solution application logs.

4.3.1.3. Solution audit/system logs.

4.3.2. Provide capability to securely, automatically transmit system and application logs that assist in troubleshooting by providing information relevant to permission issues or account credential failures for failed or partial scans.

Technical Capability Requirements:

Account management local on each device

Custom signature development

Integrates with external EDR and SOAR solutions

Log generation for analysis

Needs integration with Splunk

Analyze raw network packet traffic or traffic flows

Aggregate individual alerts into structured incidents to facilitate threat investigation

Alert aggregation of logical security incidents based on multiple factors

Automated responses (host containment or traffic blocking). North/South as well as

East/West

Model normal network traffic and highlight unusual traffic activity that falls outside of normal range

Monitoring and analyzing traffic in an IaaS environment

Perform traditional detection techniques, such as intrusion detection and prevention (IDP) signatures, rule-based heuristics and threshold-based alerts

Provide automatic or manual response capabilities to react to the detection of malicious network traffic

Provide detection based on behavioral techniques, including machine learning and advanced analytics that detect anomalies

Ability to normalize and enrich collected data with contextually relevant information

Automated Incident Response: Ability to initiate predefined and custom automated responses to security incidents

Centralized management for deploying updates, configurations and use cases

Deep inspection of application layer data

Engage in real-time capture and analysis of network traffic, extracting metadata, understanding communication patterns, detecting potential threats, identifying anomalies, and logging activity

Identify and assess vulnerabilities within the network that could be exploited by attackers

Integrate with 3rd-party threat intelligence feeds

Modules to support IaaS management and data events at the CSP API level

Must monitor and analyze all traffic flows

Provide forensics tools to assist in investigating security incidents

Provide network replay actions

Support integration to other cyber tools - automated response either through integration with other tools or natively

Support rule-based, signature, and threshold alerting

Utilize machine learning and behavioral analysis to establish normal network behavior baselines.

Will need to cover both on-premises (including virtual) and cloud assets

Capability to break SSL for packet inspection