RFI 23.24-12, Automated Fuzzer.pdf
PDF 105 KB Posted
- Solicitation number
- RFI-06616
- Issued by
- Leon County, Tampa City, Florida
About this file
This document is a Request for Information (RFI) issued by the Florida Department of Revenue (FDOR) seeking information on an automated fuzz testing solution for their SAP applications. The goal is to identify a software testing tool that can detect vulnerabilities and security flaws in their SAP GUI, S/4HANA, Fiori, and Java-based enterprise applications prior to deployment. The RFI outlines the required compatibility with SAP versions 7.5, ECC 6.0 EHP 8, and future releases, as well as the ability to integrate with cloud-hosted SAP instances. It also requests details on the types of vulnerabilities the fuzzing tool can detect, the automated techniques employed, and the reporting and analysis capabilities. Vendors are asked to provide information on licensing models, pricing, support, and customer references by the response deadline of October 6, 2023.
The RFI is part of a broader state and local contract opportunity issued by the Florida Department of Revenue, which covers jurisdictions in Leon County and Tampa City. Interested vendors are encouraged to review the full scope of work and comply with all submission requirements. Pricing details, set-asides, and funding sources are not explicitly provided in this RFI document.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Vendor Questions and Department Responses.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Subject: Request for Information # 23/24-12 – Fuzz Testing Solution (with automated Fuzzer) for SAP Applications
Background: As per the IRS recommendations, Florida Department Of Revenue (Child Support Program) would like to conduct fuzz testing on its SAP applications prior to releasing code into a production environment. As per the NIST framework guidelines, fuzz testing induces program failures by deliberately introducing malformed or random data into software programs.
The fuzz testing needs to be implemented using an automated software testing tool that has fuzzing features out of the box or allows for scripting of the testing tool to insert random data into test cases.
In this regard, FDOR is currently seeking an automated fuzz testing solution compatible with SAP ABAP based applications (SAP NetWeaver 7.5, SAP ECC 6.0 EHP 8, S/4HANA, B/4HANA) and Java based applications (Enterprise Portal). We are interested in obtaining detailed information about your product offering to assess its compatibility with our existing infrastructure and security requirements.
NIST Publication source: https://doi.org/10.6028/NIST.SP.800-53r5
RFI Submission Schedule
RFI Posting Date: 09/25/2023
Vendor Questions Due (NLT): 12:00 PM, 09/29/2023
Posting Close Date: 12:00 PM, 10/06/2023
Any submissions after close date will not be considered.
We kindly request that you provide us with the following information regarding your software security testing solution:
1. Overview:
a. Provide a brief overview of your software testing product and its key features.
b. Describe the purpose and objectives of your solution in relation to SAP GUI applications.
2. Supported SAP Versions:
a. Specify the SAP versions that are compatible with your software testing tool.
b. Indicate if your solution supports Windows operating systems.
c. Is your solution compatible with SAP S/4Hana, SAP Fiori and other future releases of SAP?
3. Cloud Support:
a. Can the automated fuzz testing solution be integrated with SAP instances located in a cloud, such as Microsoft Azure or Amazon Web Services?
https://doi.org/10.6028/NIST.SP.800-53r5
4. Fuzzing Capabilities:
a. Describe the types of vulnerabilities or security flaws that your automated fuzzer is designed to detect in SAP GUI applications. (Example: Ex. Recursive Fuzzing, Replacive Fuzzing, XSS, Integer Overflows, Format String Errors, Buffer Overflows, SQL Injection, Passive/Active SQL injection, LDAP Injection, XPATH Injection, XML Injection etc.)
b. Provide details about the automated fuzzing techniques employed by your solution.
• If automated fuzzing is not supported out-of-the-box, please describe an example of how your testing tool could be programmed to generate random and malformed input into SAP GUI forms.
c. Explain how your application security testing software handles various data types, such as input validation and boundary testing.
d. Are the test executions recorded, with the ability to see the steps played back in a simulated or video format?
5. Test Case Management:
a. Describe how your solution manages and organizes test cases for SAP applications.
b. Explain if your tool allows for customization of test cases or the ability to import test cases from external sources.
6. Reporting and Analysis:
a. Describe the reporting capabilities of your automated testing tool.
• Include information about the types of reports generated and their format.
b. Include example of error messages and corrective action measures to be implemented.
c. c. Can confidential data returned by the test execution be masked in the reports, such as SSN or other personal identifying information.
d. d. Explain how your solution assists in analyzing and prioritizing identified software vulnerabilities?
7. Integration:
a. Describe the ease of integration of your application testing software with existing SAP applications – on premises and the cloud.
b. Explain if your solution requires any additional software or tools for its operation.
c. Explain if your solution provides for multiple role-based access.
d. Explain if your solution provides for multifactor authentication.
8. Performance and Scalability:
a. Provide information on the performance metrics of your application testing software, such as speed, efficiency, and resource utilization.
b. Explain the scalability features of your solution, including its ability to handle testing of large-scale SAP applications.
9. Licensing and Pricing:
a. Is your product offered as an on-premises solution or as Software as A Service (SaaS)? If SaaS, can the test cases be run against SAP instances installed on Azure Cloud or Amazon Web Services?
b. Is your SaaS solution FedRamp certified? If yes, is it FedRamp low, medium or high?
c. Provide details on the licensing model for your automated software testing tool.
d. Outline the pricing structure, including any recurring costs or additional fees.
e. Can your solution be procured under an alternate contract source or state term contract
(NASPO, GSA etc.)?
10. Support and Maintenance:
a. Describe the support and maintenance services provided with your software testing tool.
b. Specify the availability of technical support, updates, and bug fixes.
11. Customer References:
Please provide at least two references from public and government organizations that have used your testing tool to perform automated fuzz testing of SAP applications. Include their contact information (name, company, email, and phone number).
12. Additional Information:
If there are any additional features, benefits, or information that you believe are important for us to consider, please provide them here.
File details come from the government source that posted it. Updated .