RFI_CISA Threat Intelligence Ent. Services - Data Characteristics - CSD_CB 12.20.22.pdf

Request for Information – Threat Intelligence Enterprise Services (TIES) Data Characteristics

Agency: Cybersecurity and Infrastructure Security Agency / Cybersecurity Division / Capacity Building

Market Research Agency: GSA on behalf of Cybersecurity and Infrastructure Security Agency (CISA)/Cybersecurity Division (CSD)/Capacity Building (CB)

Notice Type: Request for Information (RFI)

NAICS: 541512 Computer Systems Design Services

GSA Reference: 47QFRA23K0007 Posted Date: December 20, 2022

Amended Date:

I. GENERAL INFORMATION

This Request for Information (RFI) is being issued on behalf of the Cybersecurity and Infrastructure Security Agency’s (CISA) Cybersecurity Division (CSD) and Capacity Building (CB) sub-division for the development of Cyber Threat Intelligence (CTI) capabilities to be offered as a compendium of enterprise services to Federal, Intelligence Community, State and Law enforcement customers.

On November 16, 2022, CISA released an RFI requesting feedback and insight on the development and/or configuration of a CTI Exchange Platform. The subject RFI is a related follow-on request seeking feedback on the CTI Data and Information that would be made available for aggregation and integration into the notional Exchange platform highlighted in the previous request.

II. RFI OBJECTIVE

The purpose of this RFI is to assist the Government in conducting market research focused on identifying industry partners who can furnish and provide commercial cyber threat intelligence (CTI) data for aggregation and integration into a CISA sponsored Cyber Threat Intelligence Exchange Platform. These data characteristics and requirements include but are not limited to what is outlined below in Section IV.

The information provided as response to this RFI will be used for market research only. The Government is not obligated to release a future solicitation based on this market research.

III. BACKGROUND

CISA leads the national effort to defend critical infrastructure against the threats of today, while working with partners across all levels of government and in the private sector to secure against the evolving risks of tomorrow. CISA's mission includes protecting the Federal Government's networks and physical infrastructure, helping entities in the public and private sectors manage potential risk and enhancing public safety communications at all levels of government.

Capacity Building serves as CISA’s enterprise cybersecurity services management arm for national stakeholders and the lead for federal enterprise cybersecurity governance. CB enables its customers to manage cybersecurity risk by building their capacity to implement effective cybersecurity policies, tools, and procedures. CB helps stakeholders better manage cybersecurity risk by defining expectations for stakeholder cybersecurity; leading implementation and enforcement of cybersecurity requirements;

managing CISA’s cybersecurity services portfolio; building capacity; and enhancing collective defense and readiness. Specifically, CB enhances stakeholder cybersecurity readiness, bolsters enterprise capabilities and protections, and increases the community’s capacity to adequately manage cyber risk by:

1. Defining critical requirements, needs, and performance expectations.

2. Overseeing and guiding the implementation of key cybersecurity initiatives and urgent actions, including federal cybersecurity policy, leading practices, cyber directives and operational guidance.

3. Managing CISA’s cybersecurity services portfolio; evolving shared services, capabilities and delivery models; and delivering tailored services and assistance based on customer needs.

CB’s Threat Intelligence Enterprise Services

Members of the Federal cyber ecosystem face barriers through all stages of the CTI lifecycle.

Fragmented information about critical cyber threats reduces analysts’ abilities to effectively generate, use, and share CTI to make timely and informed decisions to support their missions. Critical CTI is spread across disparate feeds and exists in inconsistent data formats, which limits the collaboration needed to develop an accurate, shared threat picture. Further, the cyber maturity levels of participants in the CTI ecosystem vary widely. Specifically, the Federal cyber ecosystem lacks:

• Efficient procurement of CTI and CTI tools and services

• Effective tools, services, and capabilities for CTI collaboration and processing

• Assessments to assess maturity or create a roadmap to build and grow CTI capabilities

• Guidance to effectively use purchased CTI services and tools for network defense

• Awareness and centralization of CTI requirements

To solve this, the CB Cybersecurity Shared Services Office (CSSO) is working to establish Threat Information Enterprise Services (TIES).1 TIES will offer customers a suite of complementary CTI Services, Standards, and Guidance to improve their CTI production, utilization, and sharing capabilities. TIES will also allow customers to easily determine their needs (via self-assessments), research offerings, and procure and effectively use CTI services and tools. The TIES objectives are:

• CTI Generation: Improve CTI generation capabilities, i.e., collection, processing, and analysis.

• CTI Use: Improve capabilities to use CTI for cybersecurity decisions and actions.

• CTI Sharing: Improve capabilities to collaborate with partners and the broader security ecosystem.

IV. OPERATIONAL AND FUNCTIONAL OVERVIEW OF TIES SOLUTION

CISA intends to offer FCEB, SLTT and other stakeholders a streamlined CTI ingestion and sharing capability. The CB CTI exchange platform will be a one stop integration point for analysts and infrastructure to receive, share and collaborate on relevant and timely CTI, enabling teams to protect their environments and others. The platform’s collaboration capabilities allow analysts to work with others to further enrich CTI. Customers will have access to a centralized interoperable CTI platform to efficiently exchange, enrich, and analyze CTI to better reduce cyber risk.

A comprehensive cyber threat intelligence solution will enable collection and analysis of data from a range of feeds/channels, including social, mobile, and web sources. Third party threat intelligence data helps CISA and other agencies continually monitor their networks to detect breaches, domain and social media spoofing, and other threats associated with their vendors and suppliers. These feeds enable quick remediation for vulnerabilities, exposed assets and accounts. Common information required includes IoC management and history, network compliance, and TTPs observed in the sector.

CISA and Federal Civilian Executive Branch (FCEB) Government partners need commercial cyber threat intelligence (CTI) data to help monitor their networks for breaches, domain and social media spoofing, and other threats. Common information required includes Indicators of Compromise (IOC) management and history; security policy compliance; and Tactics, Techniques, and Procedures (TTPs) observed in the sector, and finished intelligence reporting. Both network and host-based sensor data are of interest. Of particular import is data from host-based sensors that could be mapped to the MITRE ATT&CK Framework and indicate adversary behaviors, e.g., commands executed, files, programs and tools accessed, and processes imitated that may only be observed in memory and therefore would not produce a hash or IOC. Ultimately CISA seeks to leverage such data to better understand adversary behavior, harden infrastructure security weaknesses and drive-up baseline controls across the FCEB.

The below overarching diagram highlights the notional solution operational construct for TIES. It is important to note that this RFI is focused solely on the characteristics and requirements associated with commercial threat intelligence feeds that will be integrated into the CTI Exchange Platform component (Figure 1 box outlined in red).

At a high level, CISA intends for the CTI exchange platform to:

• Serve as one stop integration point for analysts and infrastructure to receive and share relevant and timely CTI.

• Offer collaboration and analysis capabilities for analysts to work with others to further enrich

CTI.

• Ingest and aggregate CTI from Automated Indicator Sharing (AIS), commercial threat intelligence feeds, and other sources.

Figure 1. TIES Notional Portfolio

Figure 2. TIES Notional Operational Architecture

V. INDUSTRY MEETINGS

Based on responses provided by industry additional information may be requested. As a result, the General Services Administration with CISA, at the Government’s discretion, may schedule meetings with industry to discuss responses to this RFI. If a follow-up meeting is required, the Government will reach out directly to the industry partner point of contact.

VI. RFI RESPONSE

Interested parties should respond to this RFI outlining their capabilities (as guided by the below comments/questions and the overview listed above) as well as any recommendations to providing integration, services and solutions associated with the broad scope outlined above the Government should consider. Responses may include references to examples of consulting and/or implementation support that align with capabilities or services currently provided by the responder.

Contents The RFI response shall be split into two Sections.

“Section 1” of the response is for administrative information and shall include the following as a minimum:

A. Contractor name and facility address (list all relevant or significant office locations)

B. UIE number, Cage code, and NAICS code C. Socio-economic status (HUBZone, Service-Disabled-Veteran-Owned, Woman-Owned, 8(a), Small Business, Large Business) D. Facility clearance level E. POC name, phone, and email F. Website URL G. List of any GSA Vehicles such as GWACs (Alliant 2, VETS 2, etc.) or GSA Multiple Award

Schedule that the contractor has capable of meeting the required needs. Please include a brief narrative why, in your determination, that vehicle would or would not meet the needs of this possible requirement.

The number of pages in “Section 1” of the response shall be no longer than one (1) page in length.

“Section 2” of the submissions shall answer/address the below questions/requests as they relate to the consulting areas listed above.

Information requested:

Business Performance

1. What restrictions should be place on re-sharing of data and reports (e.g., IoCs, TTPs, finished intelligence reporting) as part of a derived product or in full to unlicensed recipients?

2. Please describe your current licensing model for threat feed and/or platform access, including examples of itemized bundles of licenses or product subscriptions

• Are there models or product bundles associated with data or intelligence reports for enterprise consumption and dissemination?

3. Please identify available historical or commercially available pricing for bundled itemized product offerings, including deployment and implementation services, professional support services and infrastructure costs.

Data Sourcing

4. Please assist the Government in understanding how industry sources the data offered. Example:

CTI data sources include but are not limited to proprietary network sensors and endpoint detection and response (EDR) tools (both internal or in use by customers), research your organization performs (e.g., open-source research and dark web research), or third-party CTI providers. Please list any third-party providers you source from and the types of data they provide.

5. Describe your organization’s process for developing finished intelligence reporting. How do you ensure the veracity of that analysis? Describe the qualifications/skills/background required of the analysts that develop your reporting?

Data Handling

6. What data/report marking, tagging and access control specifications supports your data offerings? What will be supported over the next 2 years? Please provide an estimated date supporting any future data marking or access control specifications.

7. What data tagging approaches are associated with your data offerings? What approaches are anticipated to be accommodated in the next 2 years? Please provide an estimated date you will be able to support any future data tagging approaches.

8. What processes are in place to address privacy standards, guidelines, and legal requirements as they relate to the data offered (i.e., scrubbing personally identifying information (PII) from a data feed)? Please specify whether the processes are manual or automated.

9. What processes do you employ to assess the quality of the CTI offered? How do you define CTI efficacy? What metrics are used to measure your CTI’s efficacy?

Data Criteria

10. Do your data and/or reporting offerings provide and correlate strategic (e.g., who and why), operational (e.g., how, and where) and tactical (what) CTI?

11. How do your data and/or reporting offerings map to the following: Diamond Model of Intrusion

Analysis1, MITRE ATT&CK and Lockheed Martin Cyber Kill Chain? Please describe how your data offerings map to additional models/frameworks not included here, if relevant to your data and/or reporting products.

12. Which unstructured data formats (e.g., human readable reports) and/or structured data formats and versions can you accommodate through your data offerings (e.g., STIX 2.1, MISP, generic JSON, generic XML, proprietary format)?

13. What threat detection data (e.g., network-based, and host-based) do you currently offer, and what do you expect to be able to offer within the next 2 years? Please provide an estimated date of availability for future data offerings.

14. What data and reporting related to cyber adversaries (including known nation-state actors) do you currently offer, and what do you expect to be able to offer within the next 2 years? Please provide an estimated date of availability for future data offerings.

• Do your data sources collect and provide information to help threat analysts conduct behavioral analysis on adversary tactics, techniques, and procedures? Please describe what data you offer.

• Please describe in detail what malware-related data (e.g., malware families, Malware Behavior Catalogue2) you currently offer, and what do you expect to be able to offer within the next 2 years. Please provide an estimated date of availability for future data offerings.

15. Do you currently offer the ability to correlate multiple instances of observed threat activity with specific threat groups (e.g., ransomware and other emerging threats), as well as targets of such threat activity with specific sectors (e.g., financial, health, energy sectors)?

16. What vulnerability-related data and/or reporting do you currently offer, and what do you expect to be able to offer within the next 2 years? Please provide an estimated date of availability for future data and/or reporting offerings.

17. What insights does your data and/or reporting provide into how adversary attack behavior correlates with victim security control weaknesses? One example could be, but would not be limited to, mapping observed MITRE ATT&CK TTPs with the MITRE DEFEND framework to help victims and potential targets harden their systems and become more resilient against attacks.

18. What data and/or reporting specifically related to Operational Technology (OT) and associated environment do you currently offer, and what do you expect to be able to offer within the next 2 years? Please provide an estimated date of availability for future data and/or reporting offerings.

19. What data and/or reporting specifically related to cloud threats to you currently offer, and what do you expect to be able to offer within the next 2 years? Please provide an estimated date of availability for future data offerings.

20. What data and/or reporting specifically related to supply chain threats to you currently offer, and what do you expect to be able to offer within the next 2 years? Please provide an estimated date of availability for future data and/or reporting offerings.

Logistical/Contracting Information:

21. What Government Information or Property would you need access to in order to implement a solution?

1 The Diamond Model of Intrusion Analysis (dtic.mil) 2 https://github.com/MBCProject/mbc-markdown https://apps.dtic.mil/sti/citations/ADA586960

22. Do you have any performance measurement objectives you would recommend the government consider for any possible resulting contract?

23. What contract type (or combination of types) would you foresee to accomplish a requirement like this?

VII. CONTRACTOR NOTIFICATION AND SUBMITTAL INSTRUCTIONS

This RFI is for information and planning purposes only and does not constitute a Request for Quote; it is not to be construed as a commitment by the U.S. Government. No award will be made from this RFI. All information is to be submitted at no cost or obligation to the Government. Any information that the contractor considers proprietary should be clearly marked as such. All submissions become Government property and will not be returned, including any proprietary information. Contractors who do not respond to this RFI are not excluded from any resulting solicitation(s).

The Government may consider additional communications with submitting companies using the contact information provided in the “Corporate Overview” to further the Government’s market research.

• All responses are to use 11-point Times New Roman font and one-inch margins, single spaced in all sections in Microsoft Word.

• Contractor Information section (Section 1) shall be no longer than one (1) page in length.

• Response to questions (Section 2) should be no longer than nine (9) pages in length.

• All information submitted shall be UNCLASSIFIED.

• Any information that the contractor considers proprietary should be clearly marked as such.

• All submissions become Government property and will not be returned (including any proprietary information).

Questions pertaining to this RFI should be submitted no later than 2:00 pm EST on January 5, 2023, to Diana Zoppi at diana.zoppi@gsa.gov and Daniel Hu at daniel.hu@gsa.gov.

RFI responses shall be submitted no later than 02:00 pm EST on Jan 17, 2023, via email to Diana Zoppi at diana.zoppi@gsa.gov and Daniel Hu at daniel.hu@gsa.gov.

mailto:diana.zoppi@gsa.gov mailto:diana.zoppi@gsa.gov mailto:daniel.hu@gsa.gov