RFI Vulnerability Scanning.docx

RFI – Vulnerability Scanning Solution Issued 01/27/2021 Department of State

This is a request for information only. This RFI is issued solely for information and planning purposes. It does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This request for information does not commit the DoS to contract for any supply or service whatsoever. Further, the DoS is not at this time seeking proposals and will not accept unsolicited proposals. Responders are advised that the DoS will not pay for any information or administrative costs incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the interested party’s expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued. It is the responsibility of the potential offerors to monitor DoS sources for additional information.

Purpose The objectives of the RFI are to get a broad overview of what is available in the marketplace and to create a short list of providers to be considered for a large quantity purchase. Therefore, the technical specifications are merely an expression of the intent, not a restrictive list of must-meet requirements.

Project Requirements DoS is aware of the overall changing of the threat landscape, with new Cyber risks emerging daily. DoS is interested in technology that will provide and accurate picture of the assets on the network, the priorities of these asset and where vulnerabilities lie within their network. DoS would like information on these types of products and how this automated system can be integrated with our on-prem environment and possible cloud integration.

BACKGROUND:

The Evaluation and Verification Scanning group (E&V Scanning) is a program within the Department of State’s Bureau of Diplomatic Security, Directorate of Cyber and Technology Security, Office of Cyber Monitoring and Operations, Cyber Operations (DS/CTS/CMO/CO) division which requires a system lifecycle refresh of the Enterprise Vulnerability scanning solution. Currently, the solution is running on an application that has reached its end-of-life period. Newer technologies have been presented that will allow for a more precise and comprehensive approach to continuous monitoring.

Current Cyber Security Architecture The DoS has deployed many different devices at its network borders to provide comprehensive cybersecurity. These devices include, but are not limited to, the following: stateful and application-layer firewalls, network intrusion detection/prevention systems, email gateways, and enterprise anti-virus scanners. Specifically, the Department makes use of the following capabilities with which the upgraded Vulnerability Scanning solution must interface:

1. Security Information and Event Manager (SIEM) – The DoS utilizes a SIEM system that collects logs / data sources from various security tools and strategic assets, to provide real-time event correlation and alerting capabilities.

2. Log Aggregation – captures, indexes and correlates real-time network data in a searchable repository, from which it can generate graphs, reports, alerts, dashboards and visualizations

3. Approximately 180,000 nodes across 2 geographically separate Points of Presences (POPs). Approximately 60 Low bandwidth post where Multiple OS - Microsoft, Linux, Debian, VMWare, Citrix, IPCOP, NetApp, Cisco and other

4. Cloud-hosted enclaves (AWS and Azure). Dev, Test, Pre-production and Production. The current scale of the entire cloud services environment is approximately 1000 endpoints but is expected to grow exponentially. The environments will have a mixture of IaaS, PaaS and SaaS services. Scanning these services will be reliant on the cloud APIs available from the chosen vendor. See basic diagram below:

SCOPE:

E&V scanning requires a robust solution that has the capability to immediately discover new and existing databases in the environment, immediately scan or schedule scans and accurately report findings through emailed notifications or viewing real-time alerts on a customizable dashboard. The solution should be Security Content Automation Protocol (SCAP) certified and should provide proof of a high security rating. An example would be an Upguard or Gartner report. The application must have the ability to be always up and always compliant through redundancy and continuous updates. The tool must be able to integrate with a multitude of software to allow for DoS to get the most out of their entire security platform while avoiding technological overlap. The solution must support the encryption of all data-at-rest, eliminate single points of failure on networking, storage, and the database server and provide the ability to do in-place upgrades which will reduce downtime.

The objective is to:

1. Produce a robust inventory of DOS managed DoS devices and databases through discovery scans and coordinate with IRM/IA to leverage iPost to influence user cooperation. (***iPost is a proprietary scoring application that DoS used to Grade their security posture within the Department**)

2. Assess the security posture of DOS overall environment, identify vulnerabilities, and enable system owners to mitigate risk.

3. Manage the configuration of DOS devices and ensure compliance with DOS configuration standards.

4. Provide vulnerability reports to document and analyze implemented controls.

5. Provide the option to integrate scanning results into our enterprise management console (iPost) to emphasize enterprise compliance with DOS standards.

6. Implement a network vulnerability and compliance scanning solution that will meet all stakeholder needs and avoid duplication of effort throughout the enterprise.

SUMMARY OF REQUIREMENTS:

The Vendor shall provide a solution that has the ability to meet the following requirements. The equipment in the solution must be 100% redundant against all components, i.e., compute/storage nodes, node power supplies, node disk drives, management systems, etc.

1. High – Considered Critical for our environment

· Ability to perform network sweeps and scans across the WAN to include discovery.

· Function across 2 geographically separate points of presence (POPs)

· Must be able to discover and scan multiple types of devices and databases to include SQL, SQLPlus, Oracle, MySQL, DB2, Postgres and others.

· The ability to run scheduled scans and the ability to use templates to quickly setup and execute ad-hoc scans

· Must provide continuous, uninterrupted detection (Always up, Always compliant)

· Ability to provide a real risk score that highlights the vulnerabilities most likely to be used in an attack

· A tagging system that can prioritize databases/systems that are most critical to our customer

· Have the ability to minimize/eliminate false positives and stale data from previous scans or data dumps

· Immediately detect and assess new devices/databases and new vulnerabilities the moment they access the network - The ability to provide true live monitoring

· Provide policy scanning to help benchmark systems against NIST standards, ensuring constant compliance

· Provide useful and concise remediation reporting that will provide recommendations on how to mitigate. Reports should be assignable to teams or team members and integrated into the ticketing system

· Having the ability to validate scan results and mitigation using an automated process that automatically prioritizes the most important assets first.

· Must have the ability to integrate with DoS cloud and virtual infrastructure (FedRamp approved is preferred)

· Provide for close integration--either by native Application Programming Interface (API), system server, database connection, or other means--with DoS’ current enterprise tools, Splunk & Syslog log aggregation solution

· Must have the ability to integrate with secure privilege access security tool

· Must have the ability to integrate with patch management and ticketing system as well as the DoS enterprise management console (iPost) and Exacta

· Must have the ability to prepare customized reporting and the ability to export aggregate data for inclusion into iPost

· Provide a single dashboard to compile all scan information and results in a centralized location. Dashboard must be customizable to provide a range of information, from an admin point of view to a high level CISO point of view

· Must provide granular RBAC to allow for a tiered response approach

· Solution shall be architected to support 99% availability and uptime Disaster Recovery (DR) requirements for DoS stakeholders utilizing the solution on a 24 x 7 x 365 basis

· Onsite assistance with deployment, configuration, training and support, using cleared individuals

2. Medium – highly-desired and will increase usability and efficiency of the product

· The ability to collect data from remote endpoints that cannot be actively scanned

· Ease of use monitoring and reporting for high level, non admins. A graphic dashboard that says which systems are affected, what is the planned remediation and what team owns the alert

· The ability to assess container images for vulnerabilities during the build process before systems or applications are deployed

· Integrated threat feed that will allow analyst to address the most current, critical and named vulnerabilities most likely to be exploited right now

3. Low - non-essential features that would improve the experience, but are not essential to operation or management of the product

· Product Experience in 100K+ node enterprise environment

· Vendor experience in supporting large US Government customers

· Supported by multiple certified manufacturer resellers.

· Provide the delta between scans to quickly find what has been remediated from scan to scan.

JUSTIFICATION

NIST 800-53 RA-3 (Risk Assessment) NIST 800-53 RA-5 (Vulnerability Scanning) NIST 800-53 SI-2 (Flaw Remediation)

SERVICES AND SUPPORT

The solution shall:

1. Include US-based OEM support accessible 24 hours a day x 7 days a week, by phone, web, email, and include a dedicated account subject matter expert (SME) for DoS, as well as a clearly defined escalation and resolution process included within the solution.

2. Deliver detailed description of warranty, license, and maintenance support services to include service level agreements and mean time to resolution projections for standard and severe support incidents. Warranties and proof of licenses shall be provided within 60 days of product delivery to the Government. All support and warranties are from their respective OEM.

3. Furnish specialized training options (optional CLINs) to include classroom and web-based training for engineers and system administrators, upon installation and additional training as needed. Separate by price line item. Training to cover administration of system for security staff, to include full life-cycle support of all components.

4. Outline clearly defined Returned Merchandise Authorization (RMA) processes, with 4-hour drop shipment of replacement components.

a. Vendor shall assume and accept that DoS will not return any hard drives.

5. Subject Matter Expert(s) (SME) Labor Requirements:

a. Onsite support & solution optimization at the DoS Security Operations Center (SOC) in Beltsville, MD for the period of performance in support of configuration and installation of the Contractor solution.

b. Lead on-site Contractor discovery effort to support creation of architecture, installation, and implementation plans

c. Engineering and configuration of system

d. Formulate a detailed installation / integration / implementation plan, accompanied by a schedule and resource allocation plan.

CAPABILITIES IDENTIFICATION:

It is the Bureau’s intent to identify potential sources of interest and to better understand Contractor capabilities. Therefore, please provide a technical response that presents solutions to the Government’s requirements. Please keep responses to a 10 page Maximum.

image1.png