Fortify SAST RFI.pdf

DEPARTMENT OF THE AIR FORCE

AIR FORCE LIFE CYCLE MANAGEMENT CENTER (AFLCMC)

CRYPTOLOGIC AND CYBER SYSTEMS DIVISION

JOINT BASE SAN ANTONIO-LACKLAND, TEXAS 78243-7081

REQUEST FOR INFORMATION

UNIFIED PLATFORM INFRASTRUCTURE VALUE STREAM

19 August 2024

1) This Request for Information (RFI) is issued in accordance with the Federal Acquisition Regulation (FAR) clause 52.215-3 (Request for Information or Solicitation for Planning Purposes - Oct 1997) and is published to obtain information for use by the Air Force Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division (CCSD), Joint Base San Antonio - Lackland, Texas, for market research and planning purposes only in support of the Development, Security and Operations (DevSecOps) Infrastructure Value Stream (IVS) for Unified Platform (UP). UP is responsible for developing and sustaining a cloud-based platform that enables cyber operations across the Department of Defense (DoD).

2) THIS RFI IS NOT A REQUEST FOR PROPOSAL, INVITATION FOR BID, OR AN

ANNOUNCEMENT OF A SOLICITATION; IT IS ONLY INTENDED FOR

INFORMATION OR PLANNING PURPOSES. There is no bid package or solicitation document associated with this announcement. Response to this RFI is strictly voluntary and will not affect any potential offeror’s ability to submit an offer if a solicitation is released.

Any requests for a solicitation package will be disregarded. The Government does not intend to award a contract based on this RFI or otherwise pay for the information solicited.

No entitlement to payment of direct or indirect costs or charges by the Government will arise as a result of preparing submissions in response to this RFI and the Government's use of such information. Submittals will not be returned to the sender. Respondents to this RFI may be asked to provide additional information/details based on their initial submittals.

3) Our organization is presently utilizing Fortify Static Code Analyzer (SAST) and Fortify Dynamic Application Security Testing (DAST) for ongoing cybersecurity and testing operations. In our pursuit of identifying possible alternative solutions, we are conducting market research to assess products and services that can fulfill the specific criteria outlined in paragraph 4.

The organizational objectives of this research are as follows:

a) Identify and catalog available products and solutions in the market.

b) Evaluate the features, functionality, and pricing of each alternative to determine its suitability for our needs.

c) Assess the level of integration and compatibility of each alternative with our DevSecOps platform, while ensuring compliance with DoD security requirements.

d) Estimate the level of government resources required to migrate to a new solution, while maintaining our current operational capabilities.

4) The following are several key characteristics that we are employing to align with our organizational objectives, as previously stated in paragraph 3. Please note that this list is not comprehensive, but it does offer an overview of some of the most critical requirements for our specific environment:

a. To meet DoD CIO DevSecOps Reference Design compliance and perform continuous cybersecurity and testing activities, the tool must provide the following features:

i. Software must be containerized and deployable through helm charts.

ii. Language: should support a wide range of programming languages, including popular languages like Java, C++, Python, and JavaScript, as well as C#, TypeScript, CSS, HTML, Go, PHP, Helm, Java, JavaScript, Python, XML, Terraform, Ruby, Scala, Swift, Objective-C, C, C++, PL/SQL, T-SQL, and VB.NET. This broad language support ensures that the tool can be used across different development environments and can identify vulnerabilities in a variety of codebases.

iii. Integration: should be able to integrate with other development tools, such as IDEs, build systems, and CI/CD pipelines.

iv. Customization: should allow for customization of rules and policies to align with the organization's security standards.

v. Reporting: should provide comprehensive and actionable reports, highlighting vulnerabilities and prioritizing remediation efforts, Ex: should be able to make RestFUL API calls and trigger code scans and pull down the scan results.

vi. Compliance: should support compliance with industry standards, such as OWASP Top 10, SANS Top 25, and PCI DSS.

vii. Training and support: should provide training and support resources to help developers understand and remediate vulnerabilities.

viii. Speed and efficiency: should be able to analyze code quickly and efficiently, minimizing the impact on development cycles.

ix. Needs to support SAML integration for Single Sign-On (SSO).

x. Licensing based on the number of lines of code scanned and no restrictions on # of users or frequency of scanning.

xi. Licensing based on the number of lines of code scanned and no restrictions on # of users or frequency of scanning.

b. Static application security test and scan (SAST)

i. Static code analysis

ii. Source code linting

iii. Source code test coverage

iv. CI/CD integration

v. Customizable security scanning and reporting

vi. The tool must integrate with various package managers to provide security testing during the build process and applications, but as a minimum package managers must include the following: Maven, Gradle, NuGet, NPM, and RubyGems.

c. Dynamic Application Security Testing (DAST)

i. Web application scanning: should be able to scan web applications and APIs to identify security vulnerabilities such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF).

ii. Comprehensive testing: should be able to test all layers of the application stack, including the network, application, and database layers.

iii. Automated testing: should be able to automate the testing process, reducing the manual effort required to identify security vulnerabilities.

iv. Integration with development tools: should be able to integrate with development tools such as IDEs, build systems, and CI/CD pipelines to provide a seamless integration of security testing into the development process.

v. Reporting and remediation: should be able to provide detailed reports of security vulnerabilities and recommend remediation steps to address them.

vi. Support for a wide range of technologies: should support a wide range of technologies, including web application frameworks, programming languages, and protocols, to ensure comprehensive coverage of the application stack.

vii. Scalability: should be able to scale to handle large web applications and APIs, as well as multiple applications and services.

5) Our organization will consider both commercial and open-source solutions.

6) As indicated above, this is market research. Contractor responses will be used for planning purposes. Address any comments and/or questions regarding this RFI in writing by e-mail directly to the Contracting Officer, Contracting Officer: Maj Cassandra Ayala, Email: cassandra.ayala.1@us.af.mil Program Manager: Mr. Stephen Salinas, Email: stephen.salinas.1@us.af.mil

Response due date: Friday, 30 August 2024, 8:00 AM CST. Please annotate the subject line of e-mail responses as: “SAST Solution for Unified Platform RFI #1 Response- ‘contract vehicle”. Responses may be emailed to the addresses listed above. Include your contract vehicle in the subject line of email response along with your CAGE, and DUNs within the message or attachment.