RFP_358696_ATTACHMENT 6_Statement_of_Need.pdf

FNAL CASB Statement of Needs

To address the increased usage of cloud applications across the Fermi National Accelerator Laboratory IT portfolio, the FNAL Cybersecurity Team (CST) is requesting the procurement and deployment of a Cloud Access Security Broker (CASB) solution as an component to CST’s suite of cybersecurity tools .

A Cloud Access Security Broker (CASB) is software that serves to add an additional security layer between users and cloud applications and provides a centralized set of tools to manage cloud application policy, authentication to cloud services , and which will s ignificantly improve vis ibility for FNAL cloud environments .

Project Purpose

In continuing toward CST’s goal to secure FNAL resources and support the lab’s miss ion, we believe it is imperative to continue to meet the security challenges faced by FNAL’s growing Cloud portfolio by procure a CASB by the end of fiscal year 2024.

The initial security challenges we aim to address via deployment of a CASB solution include:

• Limited vis ibility for cloud services across the FNAL cloud environment (both known/sanctioned and unknown/unsanctioned services , also referred to as Shadow IT)

• Limited ability to monitor and manage data transferred to and from cloud systems

• Limited ability to enforce cloud access policies

• Limited ability to detect and respond to security incidents in the cloud

Project Benefits CST believes that the procurement and deployment of a CASB solution will result in numerous benefits for the organization, including but not limited to:

1. Continued movement toward aligning with Zero Trust Architecture and improved Cloud security posture as required by EO 14028.

2. Reduced risk across the FNAL Cloud landscape via improved vis ibility, access control, monitoring, and alerting.

3. Improved ability to assess and enforce Cloud policies and security controls .

FNAL Cybersecurity Tea m 2024 CASB Project

Fermi Na tiona l Accelera tor La bora tory | 2

Project Requirements The selected CASB solution should meet most of the following technical and business requirements :

1. Enable the CST team to discover cloud services in use that have not yet been approved

2. Provide a catalog of known cloud services with risk scoring

3. Provide the ability to verify and enforce authentication requirements including SSO and MFA

4. Provide vis ibility and ability to audit users and user permiss ions

5. Provide increased vis ibility on data in motion for cloud services (basic DLP functionality)

6. Provide native integration with the majority of approved cloud and SaaS applications within the FNAL IT portfolio

7. Provide robust reporting and alerting capabilities in the event of security incidents in the cloud

8. Generate useful metrics and data analysis for reporting

9. Provide default policy templates that meet NIST SP 800-53 requirements for FISMA

Low and Moderate systems

10. Natively, or with little fr iction, integrate with exis ting suite of cybersecurity tools (e.g

SIEM, WAF, Logging Infras tructure, IDS, etc.)

11. Vendor should provide adequate support and opportunities for profess ional services , as necessary

12. Provide browser isolation solution

13. Allow for the ability to support transition into a full SASE framework long term (full ZTA architecture)

Project Requirements