QA DMS-2324-046 Final.pdf

Securing Recursive DNS

Request for Information (RFI)

DMS-23/24-046

Questions & Answers

Questions and Answers

The Department’s responses to timely submitted questions are below:

Question No.

Page/Section Reference Question Answer

Section IV Response

Submission Guidelines

2.a

To assist in providing an accurate design, can DMS provide approx.

how many users will be supported by the secure DNS resolvers on Day 1 of implementation, and the approximate user count if all agencies adopted secure DNS resolvers?

The Department does not have an approximate user count. However, resolvers currently process approximately 10 million recursive queries per day.

If your solution has a maximum volume of daily recursive queries, please include the information in your response.

Vendors are encouraged to provide information about their offerings. The information may be utilized by the Department to design a future solicitation.

2 Section IV 8.a

“Plans ensuring service continuity, considering Florida's unique geographical challenges” does the Securing Recursive Domain Name Systems require the ability to deploy with several tiers of redundancy to mitigate against any potential man-made [sic] or natural disasters to include High Availability (HA), as well as being able to be deployed in a mesh deployment where multi-site redundancy can be achieved where a site that is temporarily disconnected can continue to act independently until connectivity can be restored, to include Disaster Recovery (DR) scenarios where geographic redundancy can be achieved where a secondary site can be promoted to act as a primary until all services can be restored?

High Availability and Disaster Recovery abilities may be desired.

Vendors are encouraged to provide information about their offerings. The information may be utilized by the Department to design a future solicitation.

3 Section III Goal

“The overarching aim is to amplify the resilience and security of DNS infrastructure, especially against targeted DNS cyber threats.” Is the goal to provide a comprehensive Secure DNS solution that provides both traditional Response Policy Zone (RPZ) block and allow lists, but in addition can detect advanced

DNS over HTTPS (DOH) and DNS over TLS (DOT) abilities are optional, but not required. All other abilities listed may be desired.

Vendors are encouraged to provide information about their offerings. The information may be utilized by the Department to design a future solicitation.

Page/Section Reference Question Answer

DNS attacks to including DNS tunneling, data exfiltration through DNS, denial of service attacks, and detecting of malicious traffic or DNS traffic trying to circumvent DNS resolvers through DNS over HTTPS (DOH) or DNS over TLS

(DOT)?

4 Section IV 2.a

“Architectural Design - Cloud, virtual, appliance-driven, hybrid, etc.” is the requirement for the Securing Recursive Domain Name Systems solution to provide cloud, virtual, appliance, and hybrid deployment models, that all act as a unified system providing a management plane through a single pane of glass interface to access and administer all devices regardless of deployment methodology, including when multiple methods are used to include, hardware, VM, and multi-cloud?

Ease of management and ability for the State Cyber Security Operations Center (CSOC) to facilitate investigations may be desired.

Vendors are encouraged to provide information about their offerings. The information may be utilized by the Department to design a future solicitation.

5 Section IV 2.b

“Integration with Threat Intelligence Platforms or Services” is the goal for the Securing Recursive Domain Name Systems to provide Open APIs and integrations with additional security solutions such as Next Gen Firewalls (NGFW), SIEM tools, and other security solutions to asset is providing an automated detection and response to security events?

The ability to integrate and expand in the future may be desirable.

Vendors are encouraged to provide information about their offerings. The information may be utilized by the Department to design a future solicitation.

6 Section IV 8.a

“Plans ensuring service continuity, considering Florida's unique geographical challenges” does the Securing Recursive Domain Name Systems require the ability to deploy with several tiers of redundancy to mitigate against any potential man made or natural disasters to include High Availability (HA), as well as being able to be deployed in a mesh deployment where multi-site redundancy can be achieved where a site that is temporarily disconnected can continue to act independently until connectivity can be restored, to include

Please see the Answer to Question No. 2.

Page/Section Reference Question Answer

Disaster Recovery (DR) scenarios where geographic redundancy can be achieved where a secondary site can be promoted to act as a primary can be restored?

Can DMS provide some additional details or a problem statement describing some of the current issues they would like to overcome with this solution?

The Department may desire to extend query logging retention for cyber investigations, apply intelligence to recursive queries before answering, and intercept DNS tunneling and data exfiltration.

Vendors are encouraged to provide information about their offerings. The information may be utilized by the Department to design a future solicitation.

Are the concerns implied in securing recursive DNS focused on users / devices / networks or all the above?

While future needs may require these abilities, the Department understands that the responses to this RFI are not required to cover all these concerns.

Does DMS require implementation of DNSSEC support for validation of existing recursive queries?

Responses should support DNSSEC validation of recursive queries.

How do you foresee the implementation of the DevSecOps paradigm in the context of the Contract:

How will we validate the solution from a security perspective, are we going to be able to provide the full services and solutions around this?

Who will help us with the response questions related to security?

Please see the Answer to Question No. 7. Additionally, please include all solution capabilities in your response.

Please describe the structure of the continuous development and deployment approach (CI/CD) that you propose to use, along with the specific tools that you propose to use in the different phases of the development, deployment, and operation

Vendors are encouraged to provide information about their offerings. The information may be utilized by the

Page/Section Reference Question Answer lifecycles. In your response, please explain how this will allow for the prioritization of functionalities, the management of the backlog and the iterations planned for each of the expected releases?

• Architectural Design - Cloud, virtual, appliance-driven, hybrid, etc.

b. Integration with Threat Intelligence Platforms or Services,

c. Reporting and Active Monitoring capabilities; and

d. Log Retention policy and duration, along with retrieval methods.

• Architectural Design - Cloud, virtual, appliance-driven, hybrid, etc.

b. Integration with Threat Intelligence Platforms or Services,

c. Reporting and Active Monitoring capabilities; and

d. Log Retention policy and duration, along with retrieval methods.

Are we able to design solutions that are nonstandard?

Vendors are encouraged to provide information about their offerings. The information may be utilized by the